# Configure Google OAuth2 Authentication

To enable Google OAuth2, you must register a new application with Google.

## Create Google OAuth2 Keys

In the Google environment, follow these steps:

1. Navigate to the [Google Credentials](https://console.cloud.google.com/projectselector2/apis/credentials?) page.
2. Click **Create credentials > OAuth client ID**.
3. Select the **Web application** type.
4. Enter **Name** , such as Kloudfuse.
5. Enter URL of the kloudfuse installation in the **Authorized JavaScript Origins**.

Example: `kloudfuse.yourcompany.com`

6. Enter URL that has the `/oauth2/callback` of the kloudfuse in the **Authorized redirect URIs**.

Example: `kloudfuse.yourcompany.com/oauth2/callback`

7. Click **Create**.
8. Copy the **Client ID** and **Client Secret** from the `OAuth Client` modal.

Save it for next steps.

## Enable Google Auth in Kloudfuse

## Option 1: Use Client ID and Secret

In your `custom-values.yaml` file, add google client ID and secret:

```yaml
 kfuse-auth:
   oauth2-proxy:
     config:
       clientID: "REPLACE_CLIENT_ID"
       clientSecret: "REPLACE_CLIENT_SECRET"
```

## Option 2: Use Kubernetes secrets

In the kfuse namespace, create 2 kubernetes secrets:

1. Create a secret called `kfuse-auth-users` as mentioned here.
2. Create a new kubernetes secret, `kfuse-auth-users`; you can also update an existing secret.

Use the output of `cat users.txt| base64` as the value of `users.txt` entry in the secret.

Use the `edit` command if editing an existing secret.

Edit Secret

```console
   kubectl edit secret kfuse-auth-users
   ```

Create kubernetes secret kfuse-auth-users

```yaml
   apiVersion: v1
   data:
     users.txt: |-
       <base64-encoded-value-from-above>
   kind: Secret
   metadata:
     name: kfuse-auth-users
   type: Opaque
   ```

1. Create a new kubernetes secret, `kfuse-auth-google`.

Use base64-encoded values for client id and client secret from [`kfuse-auth-users`](https://docs.kloudfuse.com/platform/3.2.5/sso-google/#secret-kfuse-auth-users) secret.

To generate cookie secret, see the OAuth2 Proxy documentation for [Generating a Cookie Secret](https://oauth2-proxy.github.io/oauth2-proxy/configuration/overview/#generating-a-cookie-secret).

Create kubernetes secret kfuse-auth-google

```yaml
   apiVersion: v1
   data:
        client-id: <base 64 encoded google client id>
        client-secret: <base 64 encoded google client secret>
        cookie-secret: <base 64 encoded random value>
   kind: Secret
   metadata:
         name: kfuse-auth-google
   type: Opaque
   ```

2. Include the two secrets in your `custom-values.yaml` file:

Add secrets to `custom-values.yaml`

```yaml
   kfuse-auth:
        oauth2-proxy:
          config:
            existingSecret: "kfuse-auth-google"
          htpasswdFile:
            existingSecret: "kfuse-auth-users"
   ```