Integrating Google login (OAuth 2.0) with a PEGA application

Integrating Google login (OAuth 2.0) with a PEGA application involves several steps, including setting up a Google API project, configuring OAuth 2.0 in PEGA, and writing the necessary code to handle authentication. Below is a complete guide to achieving this integration.

Step 1: Set Up Google API Project

1. Create a Project in Google Cloud Console:
   • Go to the Google Cloud Console.
   • Create a new project or select an existing one.
2. Enable OAuth 2.0 and Obtain Credentials:
   • Navigate to APIs & Services > Credentials.
   • Click Create Credentials and select OAuth 2.0 Client IDs.
   • Configure the consent screen with the required information.
   • Create the OAuth 2.0 client ID and secret. Choose Web application as the application type.
   • Add authorized redirect URIs, such as https://your-pega-app-domain/prweb/oauth2callback.

Step 2: Configure OAuth 2.0 in PEGA

1. Create OAuth 2.0 Provider:
   • In the PEGA Designer Studio, navigate to Records > Security > OAuth 2.0 Provider.
   • Click Create and fill in the following details:
     • Name: GoogleOAuth
     • Authorization Endpoint: https://accounts.google.com/o/oauth2/auth
     • Token Endpoint: https://accounts.google.com/o/oauth2/token
     • Redirect URL: https://your-pega-app-domain/prweb/oauth2callback
   • Save the record.
2. Create OAuth 2.0 Client Registration:
   • Navigate to Records > Security > OAuth 2.0 Client Registration.
   • Click Create and fill in the following details:
     • Name: GoogleClient
     • Client ID: [Your Google Client ID]
     • Client Secret: [Your Google Client Secret]
     • Provider: GoogleOAuth
     • Scope: openid email profile
   • Save the record.

Step 3: Create Authentication Service in PEGA

1. Create an Authentication Service:
   • Navigate to Records > Security > Authentication Service.
   • Click Create and select OIDC (OpenID Connect).
   • Fill in the following details:
     • Name: GoogleLogin
     • Authentication Type: OIDC
     • Issuer: accounts.google.com
     • Client Registration: GoogleClient
     • Attribute Mapping: Map the Google attributes (e.g., email, given_name, family_name) to the corresponding PEGA properties.
   • Save the record.
2. Configure the Authentication Service:
   • On the Mappings tab, specify the mappings for the email, first name, and last name attributes.
   • On the Advanced tab, configure the Redirect URL to point to the appropriate callback URL in your PEGA application.
   • Enable the service and save the changes.

Step 4: Implement Login and Callback Handling

1. Create a Custom Login Button:
   • Add a login button to your PEGA application’s login screen, which redirects users to the Google OAuth 2.0 authorization endpoint.
   • Example HTML code for the login button
2. Handle OAuth 2.0 Callback:
   • PEGA handles the OAuth 2.0 callback automatically if the authentication service is configured correctly.
   • Ensure that the callback URL in Google API Console matches the one specified in the PEGA authentication service.

<button onclick="window.location.href='/prweb/GoogleLogin/oauth2authorize'">Login with Google</button>

Step 5: Test the Integration

1. Deploy and Test:
   • Deploy your PEGA application and navigate to the login screen.
   • Click the “Login with Google” button and follow the authentication flow.
   • Upon successful authentication, PEGA should create or update the user profile based on the attributes received from Google.

Step 6: Debugging and Logs

1. Enable Logging:
   • Enable logging for OAuth 2.0 and authentication services to troubleshoot any issues.
   • Navigate to Configure > System > Operations > Logs and enable relevant logging levels.
2. Check PEGA Logs:
   • Monitor PEGA logs for any errors or warnings related to OAuth 2.0 authentication.

Example PEGA Configuration

Example PEGA Configuration

OAuth 2.0 Provider Configuration:

• Name: GoogleOAuth
• Authorization Endpoint: https://accounts.google.com/o/oauth2/auth
• Token Endpoint: https://oauth2.googleapis.com/token
• Redirect URL: https://your-pega-app-domain/prweb/oauth2callback
• Userinfo Endpoint: https://openidconnect.googleapis.com/v1/userinfo
• Scope: openid email profile

OAuth 2.0 Client Registration:

• Name: GoogleClient
• Client ID: [Your Google Client ID]
• Client Secret: [Your Google Client Secret]
• Provider: GoogleOAuth
• Scope: openid email profile

Authentication Service Configuration:

• Name: GoogleLogin
• Authentication Type: OIDC
• Issuer: accounts.google.com
• Client Registration: GoogleClient
• Attribute Mapping:
  • Email: email
  • First Name: given_name
  • Last Name: family_name

Mappings Tab Configuration:

• Email: .pyEmailAddress
• First Name: .pyFirstName
• Last Name: .pyLastName

Advanced Tab Configuration:

• Redirect URL: https://your-pega-app-domain/prweb/oauth2callback
• Enable: Yes

Custom Login Button

Add this button to your PEGA application’s login screen:

<button onclick="window.location.href='/prweb/GoogleLogin/oauth2authorize'">Login with Google</button>

Example PEGA Rules

1. Create Data Transform for Mapping Attributes:
   • Name: MapGoogleUserAttributes
   • Context: User Data
   • Mappings:
     • pyUserIdentifier -> Param.email
     • pyFirstName -> Param.given_name
     • pyLastName -> Param.family_name
     • pyEmailAddress -> Param.email
2. Create Activity for User Authentication:
   • Name: AuthenticateGoogleUser
   • Steps:
     • Step 1: Call MapGoogleUserAttributes
     • Step 2: Use the pxCreateOperator activity to create or update the user in PEGA.

Testing and Debugging

1. Enable Logging:
   • Navigate to Configure > System > Operations > Logs.
   • Set the logging level to DEBUG for OAuth 2.0 and authentication services.
2. Monitor Logs:
   • Check PEGA logs for errors or warnings related to OAuth 2.0 authentication and user creation.

Conclusion

By following the steps outlined above, you can integrate Google login with your PEGA application. This integration enhances the user experience by allowing users to authenticate using their Google accounts, simplifying the login process and leveraging Google’s secure authentication mechanisms. Ensure that all configurations are correctly set, and test thoroughly to confirm the integration works seamlessly.

References

1. Google Cloud Console
2. PEGA Academy
3. PEGA Community
4. PEGA Documentation
5. OAuth 2.0 Overview