CIAM Google Dev and Test User Flow Checklist

Purpose

Complete Google sign-in setup in one pass for:

Synkronyx ERO CIAM (dev)
Synkronyx ERO CIAM (test)

within the nonproduction CIAM tenant.

Naming convention standard used by automation:

Dev: B2C_1_SUSI_ERO_DEV
Test: B2C_1_SUSI_ERO_TEST
Prod: B2C_1_SUSI_ERO_PROD

Tenant and Application Targets

Tenant name: Synkronyx ERO CIAM (nonproduction)
Tenant ID: 78ddb811-8ab7-4d7b-bfb8-c3d96e04d00d
Tenant domain: sknxerononproduction.onmicrosoft.com

Applications:

ERO PWA (DEV)
- Client ID: 0946d2ef-6436-4226-a9c4-81e7bc969f3c
ERO PWA (TEST)
- Client ID: a5efb7a0-a66e-439d-8fb8-66f6908aeac5

Redirect URI manifests:

settings/google-redirect-uris-dev.txt
settings/google-redirect-uris-test.txt

Step 1: Switch Tenant Context

Open Microsoft Entra admin center.
Open Manage tenants.
Select Synkronyx ERO CIAM (nonproduction).
Click Switch.
Confirm top-right tenant context is nonproduction.

Step 2: Configure Google IdP Once at Tenant Level

Preferred automated path from repository root:

./scripts/deploy/bootstrap-google-oauth.ps1 -Environment dev -SkipProjectBootstrap -EnsureGoogleApiKey -UserFlows B2C_1_SUSI_ERO_DEV
./scripts/deploy/bootstrap-google-oauth.ps1 -Environment test -SkipProjectBootstrap -EnsureGoogleApiKey -UserFlows B2C_1_SUSI_ERO_TEST

Manual portal fallback:

Go to External Identities.
Open All identity providers.
Select Google under Built-in providers.
Click Configure or Edit.
Paste Google Client ID.
Paste Google Client Secret.
Click Save.

Note: Google IdP is tenant-level and is reused by both DEV and TEST user flows. Note: Microsoft account and Entra providers remain unchanged by this automation.

Step 3: Update Google OAuth Redirects

Open Google Cloud Console for project synkronyx-ero.
Open APIs and Services.
Open Credentials.
Open the OAuth 2.0 Web client used for Entra federation.
In Authorized redirect URIs, add every URI from settings/google-redirect-uris-dev.txt.
Add every URI from settings/google-redirect-uris-test.txt.
Remove duplicates if Google flags duplicates.
Click Save.

Step 4: Create DEV User Flow

Back in Entra, go to External Identities.
Open User flows.
Click New user flow.
Choose Sign up and sign in.
Set Name to B2C_1_SUSI_ERO_DEV.
In Identity providers, enable Google.
Enable one local fallback option:
- Email one-time passcode, or
- Email and password.
In User attributes, select Email and Display Name.
Click Create.

Step 5: Attach DEV Application to DEV Flow

Open B2C_1_SUSI_ERO_DEV.
Open Applications.
Click Add application.
Select ERO PWA (DEV).
Confirm reply URL is http://localhost:4321/ for local workstation development.
Click Save.

Step 6: Create TEST User Flow

Go to User flows.
Click New user flow.
Choose Sign up and sign in.
Set Name to B2C_1_SUSI_ERO_TEST.
Enable Google in Identity providers.
Enable the same local fallback method used in DEV.
In User attributes, select Email and Display Name.
Click Create.

Step 7: Attach TEST Application to TEST Flow

Open B2C_1_SUSI_ERO_TEST.
Open Applications.
Click Add application.
Select ERO PWA (TEST).
Set reply URL to the TEST cloud callback URL.
If TEST cloud callback is not ready, temporarily set http://localhost:4321/ for flow validation and replace before CI or CD release.
Click Save.

Step 8: Validate DEV Flow

In User flows, open B2C_1_SUSI_ERO_DEV.
Click Run user flow.
Choose app ERO PWA (DEV).
Set redirect URI to http://localhost:4321/.
Start flow.
Confirm Google button appears and sign-in succeeds.

Step 9: Validate TEST Flow

In User flows, open B2C_1_SUSI_ERO_TEST.
Click Run user flow.
Choose app ERO PWA (TEST).
Set redirect URI to TEST cloud callback URL.
Start flow.
Confirm Google button appears and sign-in succeeds.

Completion Criteria

All are true:

Google provider is configured in nonproduction tenant.
DEV flow exists and is bound to ERO PWA (DEV).
TEST flow exists and is bound to ERO PWA (TEST).
Redirect URIs from both manifests are present in Google OAuth client.
Run user flow passes for DEV and TEST.