ZTNA - Connecting 3rd Partry IdP (Google, Entra, Auth0)

ZTNA - Connecting 3rd Partry IdP (Google, Entra, Auth0)

Connecting an External Identity Provider in Zitadel

This lets users click "Sign in with Google", "Sign in with Microsoft", "Sign in with  Github", etc on your Zitadel login screen and authenticate with the client's already established account. Zitadel acts as the identity broker between the external IdP and the downstream app (Netbird). 

Setup for Google Workspace as an example

As an example we documented the setup of Google Workspace. All other IdP's will follow a very close path. Contact uplevel support if you are not able to find your IdP setup in the Zitadel documentation

Step 1: Create OAuth Credentials in Google Cloud Console

  1. Go to console.cloud.google.com and create a project (or use an existing one).
  2. Navigate to APIs & Services > Credentials.
  3. Click Create Credentials > OAuth client ID.
  4. Select Web application as the application type.
  5. Under Authorized redirect URIs, add: https://$your.domain.uplevel-ztna.net/ui/login/login/externalidp/callback
  6. Save and copy the Client ID and Client Secret.

If your Google Workspace admin restricts OAuth apps, you may need to allowlist this Client ID in the Workspace Admin Console under Security > API Controls > App Access Control.

Step 2: Add Google as an IdP in Zitadel Console

  1. Log into your Zitadel Console as an IAM admin.
  2. Go to Default Settings (profile button, bottom left of the sidebar).
  3. Scroll to Identity Providers and click New.
  4. Zitadel offers a Google template. Select it.
  5. Paste in the Client ID and Client Secret from Step 1.
  6. The template pre-fills scopes (openid, profile, email). These are fine for most setups.
  7. Configure these optional settings based on your preference:
    • Automatic creation: Enable this if you want Zitadel to auto-create a local user when someone logs in with Google for the first time.
    • Automatic update: Enable this if you want profile changes in Google (name, email, etc.) to sync back to the Zitadel user on login.
    • Account linking: If enabled, users can link their Google identity to an existing Zitadel account.
  8. Save the provider.

Step 3: Activate the Provider

After saving, find the new Google provider in the Identity Providers list and activate it.

Step 4: Enable External IdP Login in the Login Policy

  1. Navigate to Default Settings > Login Behavior and Security (or go directly to https://$your.domain.uplevel-ztna.net/ui/console/.
  2. Ensure Allow External IDP is enabled in the login policy.
  3. Save.

If you only want this for a specific organization rather than instance-wide, go to the org settings instead and override the login policy there.

Step 5: Test

Open an incognito window, navigate to your Zitadel login page, and you should see a "Sign in with Google" button. Clicking it should redirect to Google's OAuth consent screen, then back to Zitadel. If automatic creation is enabled, the user is provisioned on first login.

Notes

  • This same process works for other providers. Zitadel has built-in templates for Google, GitHub, GitLab, Apple, Microsoft/EntraID, and others. For anything else, use the Generic OIDC or Generic SAML template. - KB article
  • If you want to restrict login to a specific Google Workspace domain, you can add the hd (hosted domain) parameter to the scopes or handle it with Zitadel Actions (server-side scripts that run during the auth flow).
  • For per-organization IdP configuration (e.g., one department uses client uses Google Workspace, another uses GitHub), configure the IdP at the organization level instead of the instance default. Zitadel supports domain discovery to route users to the correct IdP based on their email domain.

    • Related Articles

    • ZTNA - Setup Your First Peers

      Getting started setting up ZTNA Prerequisites Two hosts running Windows, macOS, Linux, Android, or iOS Administrator credentials for both hosts Internet connection on both hosts.- For the best proof of concept, the hosts should not be on the same ...

    • Client VPN - OpenVPN with TOTP MFA

      Our legacy Client VPN Setup Article is located here for all Operating Systems Client VPN is an add-on, flat rate, paid feature. We do not charge per account created. MSP's are able to create 1 management Client VPN account per customer at no charge. ...

    • Site-to-Site VPN - Non-Uplevel (3rd Party VPN)

      Introduction You can quickly set up IPsec tunnels to connect to third-party firewalls and cloud services. We currently have 'pre-configured' configurations for Microsoft Azure, Amazon AWS, etc. to remove the complexity from connecting to those ...

    • Azure vs. Uplevel Active Directory

      Portions of this article are from the Blog post on our website - https://www.uplevelsystems.com/blog/uplevel-ad-vs-azure-ad-whats-the-difference Introduction On-premises Microsoft Active Directory, Uplevel Active Directory compatible Directory ...

    • Client VPN - ( L2TP-IPSEC, SSTP, SSL)

      Login to your Uplevel Portal From your Customer's Configuration Page choose VPN Click the Checkbox next to Enable VPN Choose Click here to add a VPN user Enter Username, Password, and the Security Group the User is a Member of Install SoftEther VPN ...