A cool feature we had on our wish list for a long time will be in our next version 60 build: Login with your Google account.

The way this works is the web front end pulls a JavaScript library from a Google server that handles the details for the Google login; once the login is done, Google provides a token the PBX backend can use to pull the email address of the logged-in account and set up a user session, just as if the user had logged in with his or her username and the password.

Google has done a lot to make the login convenient and secure, providing two-factor authentication and email notifications as part of Google G Suite service. There is nothing the end user needs to do to make this work.

The email address in the user account must match the email account in the Google account; if a user has multiple email addresses, one match will be sufficient. It makes no difference if it’s a free Gmail account or a paid Google business account.

The domain for this feature must be set up on the Google side: for this you have to log in to the Google API site and create credentials for the domain. It isn’t possible to use wildcard domain names, so every domain name that can be used for the login must be listed; if you are using a secure connection you should only enter the https address; if you are using multiple domain names, they must be listed separately. There is a wizard at https://developers.google.com/identity/sign-in/web/sign-in you can use to set this up:

After picking a name for your login, you need complete some minimal configuration. The PBX uses "Web browser" as configuration; the URL must match the URL that you use for logging in:

The final screen shows you the Client ID you need to copy into the PBX web interface. A typical client ID has the form xxxxxxxxxxxx-xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx.apps.googleusercontent.com.

Copy the Client ID into the domain settings, "Google sign in client ID." Hit the save button.

The next time someone visits the login page, there will be a small login field under the login submit button to trigger the login process; right now this service is only available for user accounts. 

System and domain administrators still need to use their username and password credentials as before. Fortunately, most browsers today support storing those credentials, so repeated logins shouldn’t be too inconvenient.

This will be generally available for 60.2 builds. We have already included it in some 60.1 test builds.