View a markdown version of this page

Set up enterprise sign-in with Google Workspace for Amazon Quick on desktop - Amazon Quick
Step 1: Create an OIDC application in Google WorkspaceStep 2: Add the desktop connector with your identity provider configurationStep 3: Download, verify, and distribute the desktop application
Services or capabilities described in Amazon Web Services documentation might vary by Region. To see the differences applicable to the China Regions, see Getting Started with Amazon Web Services in China (PDF).

Set up enterprise sign-in with Google Workspace for Amazon Quick on desktop

 Applies to: Enterprise Edition 
   Intended audience: System administrators 

Use these steps only if you choose Configure Identity Provider when you add the desktop connector. Most organizations don't need a separate identity provider configuration for the desktop application. For the default setup, see Turning on desktop access.

This page walks you through the three steps to set up enterprise sign-in with Google Workspace:

  1. Create an OpenID Connect (OIDC) application in Google Workspace and record its values.

  2. Add the desktop connector with your identity provider configuration.

  3. Download, verify, and distribute the desktop application.

Before you begin, review the prerequisites in Setting up Amazon Quick on desktop for enterprise deployments and Using a dedicated identity provider configuration (advanced).

Note

To sign in, users need an active Amazon Quick web session in their browser. The email address in Google Workspace must exactly match the user's email address in Quick, and Google Workspace must not mark that email address as unverified. For more information, see How sign-in works with a dedicated identity provider.

Step 1: Create an OIDC application in Google Workspace

Register an OAuth client in the Google Cloud Console. The Amazon Quick desktop application uses this client to authenticate users through the authorization code flow with PKCE. Google issues a refresh token automatically when the authorization request includes the access_type=offline parameter. Quick includes this parameter automatically. No additional scope or grant type configuration is required.

For more information, see OAuth 2.0 for Mobile & Desktop Apps in the Google for Developers documentation.

To create the Google OAuth client

  1. In the Google Cloud Console, navigate to APIs & Services → Credentials → Create Credentials → OAuth client ID.

  2. Configure the following settings:

    OAuth client settings
    Setting Value
    Application type Desktop app
    Name Amazon Quick Desktop

  3. Choose Create.

  4. Note the Client ID and Client secret. You need these values in later steps.

To configure the OAuth consent screen

  1. In the Google Cloud Console, navigate to Google Auth Platform → Branding.

  2. Set the User type to Internal. This restricts sign-in to users in your Google Workspace organization.

  3. Fill in the required app information and choose Save.

To configure scopes

  1. In the Google Cloud Console, navigate to Google Auth Platform → Data Access.

  2. Add the following scopes: openid, email, profile.

  3. Choose Save.

Record the following OIDC endpoints. You enter these values, together with the Client ID you noted earlier, in Step 2.

OIDC endpoint values
Field Value
Client ID The Client ID from your OAuth client
Issuer URL https://accounts.google.com
Authorization endpoint https://accounts.google.com/o/oauth2/v2/auth
Token endpoint https://oauth2.googleapis.com/token?client_secret=<CLIENT_SECRET>
JWKS URI https://www.googleapis.com/oauth2/v3/certs
Note

Append your client secret to the token endpoint as a client_secret query parameter so that token exchange succeeds. For example, https://oauth2.googleapis.com/token?client_secret=<CLIENT_SECRET>. Replace <CLIENT_SECRET> with the client secret generated for your OAuth client.

Step 2: Add the desktop connector with your identity provider configuration

In the Amazon Quick console, add the desktop connector and enter the values that you recorded in Step 1.

Important

Adding the desktop connector turns on desktop access for all users in your account right away. To roll out desktop in stages, restrict the Quick desktop capability in a custom permissions profile before you add the connector. For more information, see Turning on desktop access. You can also restrict the capability after you add the connector.

To add the desktop connector

  1. Sign in to the Amazon Quick console as an administrator.

  2. Choose your profile icon, and then choose Manage account.

  3. In the navigation pane, choose Inbound connectors, and then choose the Quick Desktop tab.

  4. Choose Add desktop connector.

  5. For the identity setup, choose Configure Identity Provider, and then enter the values that you recorded in Step 1:

    Identity provider configuration values
    Field Value
    Issuer URL The exact OIDC issuer URL from Step 1, including any required path suffix.
    Authorization endpoint The OIDC authorization endpoint URL from Step 1.
    Token endpoint The OIDC token endpoint URL from Step 1.
    JWKS URI The JSON Web Key Set URI from Step 1.
    Client ID The OIDC client identifier (Client ID or Application (client) ID) that you recorded in Step 1.

  6. Choose Confirm.

  7. Verify that the connector card shows the name Quick Desktop and the status Enabled.

Note

Adding the desktop connector is a one-time, account-level action. After the connector is enabled, all users in your account can sign in with your identity provider. Users don't need to turn anything on themselves.

Step 3: Download, verify, and distribute the desktop application

In this step, you install the desktop application, verify that enterprise sign-in works, and then distribute the application to your users.

First, download and install the application. For download locations and installation steps, see Downloading and installing.

Then, verify that enterprise sign-in works.

To verify enterprise sign-in

  1. Open the Amazon Quick desktop application.

  2. On the sign-in screen, choose Continue with SSO.

  3. (Optional) Select your Amazon Web Services Region, or choose Dynamic to detect your Region automatically.

  4. Sign in with your corporate credentials. The application redirects to your identity provider, and then opens the Home screen after sign-in succeeds.

Tip

If sign-in fails, check the values that you entered in Step 2 against the values from Step 1. For more information, see Troubleshooting enterprise sign-in for Amazon Quick on desktop.

Finally, distribute the application to your users. Direct them to Getting started with the Amazon Quick desktop application for download, installation, and sign-in instructions. Users choose Continue with SSO and sign in with their corporate credentials. They don't need any other setup.