Configuring Google Single Sign On (SSO)

There are multiple areas in PaperCut where Google SSO can be configured, including Mobility Print, Print Deploy, and when logging into the PaperCut admin and user web interfaces.

Setup Google SSO for Mobility Print (Chromebooks)

For Mobility Print on Chromebooks, by default there’s a Sign in with Google button so users don’t have to re-enter their credentials to log in. This is for environments where user accounts have Gmail email addresses or Gmail accounts.

In the case of an environment where there are user accounts that do NOT have Gmail email addresses or Gmail accounts, you might want to consider turning off Single sign on. If you don’t, these users might click the Sign in with Google button and not be logged in because their account won’t be registered in PaperCut NG/MF.

To turn off Single sign on for Chromebooks:

1. Select Enable Printing > Mobile/BYOD.
2. In the Mobility print section, uncheck the option ‘Allow users to sign-in with their Google account’.
3. Click Apply.

Setup Google SSO for Print Deploy

Note: Ensure the email address being used to log in to SSO already has an associated user account in PaperCut NG/MF.

1. Select Enable Printing > Print Deploy.
2. Click Settings.
3. Under Authentication methods, ensure that the Google checkbox is selected.
4. Set the User Identity method to PROMPT.
5. Click Save.

Note: Switching the User Identity method to PROMPT will impact the configuration for all of your Print Deploy clients, so all Windows, Mac, Chrome, and Linux clients will now be prompted to authenticate.

Set up Google SSO for Admin and User web interfaces

Google Workspace users can always log in to the PaperCut NG/MF Admin or User web interfaces by typing their Google credentials in the Username and Password fields.

If Google SSO has been configured as below, the Username and Password fields will still show on the login screen, but there will also be a Sign in with Google button for users to click instead.

Create the client secret JSON file in Google Workspace

1. Ensure your PaperCut NG/MF system environment is ready before you start to set up users to log in to PaperCut NG/MF using their Google credentials.

2. Ensure your organization owns a top-level, public fully qualified domain name (FQDN), for example:

   • schoolname.region.edu
   • campusname.school.region.edu

3. We highly recommend you use a secure browser connection, so ensure that you have one. Refer to Forcing use of HTTPS/SSL only . Ensure:

   • user and admin access to the system is restricted to be only via SSL
   • HSTS is turned on.

4. Log in to the Google Workspace Developer’s API console . The Google APIs Dashboard screen is displayed.

5. In the title bar, next to the Google APIs heading, click the dropdown list showing a project name. The Select from popup is displayed.

6. Do one of the following:

   • If a project is already set up for synchronization withPaperCut NG/MF, click the project’s name. The API Dashboard is displayed with the project name in the title bar. Go to the next step.
   • If a project is not set up yet, create a new project:
   1. At the top right of the popup, click NEW PROJECT. The New Project screen is displayed.
   2. In the Project name field, type a name that identifies the project you’ll use for PaperCut NG/MF, for example, PaperCut NG/MF Authorise.
   3. Click Create. The Credentials screen is displayed.
   4. In the title bar, next to the Google APIs heading, click the project name drop-down. The Select from popup is displayed.
   5. Click the new project’s name. The Google APIs main screen is displayed with the project name in the title bar, and the APIs Credentials popup is displayed.

7. Select the OAuth consent screen tab. The OAuth consent screen is displayed.

8. Type the details you want users to see when users log in to PaperCut NG/MF Admin or the User Web interface.

   Note: If the PaperCut NG/MF Application Server isn’t available on the internet, the Homepage URL will fail to validate on the OAuth consent screen and the message “Request contains an invalid argument” is displayed.

9. Click Save. The Credentials screen is displayed.

10. Click Create credentials, then select OAuth client ID.The Create OAuth client ID screen is displayed.

11. Select Web application. Additional fields are displayed.

12. In the Name field, type the name for your OAuth Client ID.
    
    Note: This is the name that PaperCut NG/MF will use to identify itself to Google when authorizing/authenticating users. A good example here is PaperCut MF OAuth Client ID.

13. In the Authorised redirect URIs field, type the full URI of your PaperCut NG/MF Application Server, for example:
    
    https://papercut.schoolname.region.edu:9192/api/oauth2callback
    
    Note: Unlike the Authorised JavaScript origins URI, this field requires the full URI. Make sure you include the trailing path.

14. Click Create. The OAuth client popup displays your client ID and client secret. You will use these credentials when you set up the sync source in PaperCut NG/MF.

15. Click OK. The Credentials screen is displayed. No need to save the credentials from here because you’ll download them in a few steps.

16. Click      to download the credentials as a JSON file.
    
    Note: The file is called client_secret_<your Client ID>.JSON. This is the client secret JSON file you need to be able to authorize PaperCut NG/MF to sync with Google.
    
    Note: Ensure the URI for the Admin interface you log in to is exactly the same as the URI specified you entered when setting up Google Workspace (on the Create OAuth client ID screen, in the Authorized JavaScript origins field). For example,  https://papercut.schoolname.region.edu:9192/admin

17. In the Admin web interface, select Options > User/Group Sync; then scroll to the Single Sign on with Google section.

18. Select the Enable the “Sign in with Google” button on the Admin and User web interfaces checkbox.

19. Click Choose file, then select the JSON file you downloaded.

20. Click Upload client secret. The file is uploaded.

21. Test with real users to confirm the Sign in with Google button is visible on the PaperCut NG/MF login screen and works as expected.