SWIF.ai

Swif’s Platform SSO Policy lets you replace the local macOS login window with Google Workspace Single Sign-On. Users authenticate with their Google credentials, and Swif provisions (or verifies) the matching local account before sign-in completes.

___________________________________________________________

Go to Google Cloud Console → APIs &amp; Services → Credentials.

Click Create Credentials → OAuth client ID →Application Type: Web Application.

Authorized redirect URI → add <code>https://127.0.0.1/</code> (loopback).

Save → copy the Client ID and Client secret.

1. Go to Google Cloud Console → APIs &amp; Services → Credentials.
2. Click Create Credentials → OAuth client ID →Application Type: Web Application.
3. Authorized redirect URI → add <code>https://127.0.0.1/</code> (loopback).
4. Save → copy the Client ID and Client secret.

3 Create an Platform SSO Policy in Swif

Policies → Create New Policy → Platform SSO Policy.

1. Policies → Create New Policy → Platform SSO Policy.
2. Fill the fields:

Choose the Mac devices or Smart Group that should enforce Google SSO.

Swif pushes a configuration profile that replaces the standard macOS login window.

1. Choose the Mac devices or Smart Group that should enforce Google SSO.
2. Click Deploy.
3. Swif pushes a configuration profile that replaces the standard macOS login window.

At startup, the login window shows a Sign in with Google button (or username field if cached).

The user’s browser opens to <code>accounts.google.com</code>, prompting Google credentials and MFA.

1. Parses the ID-token claims.
2. Creates (or unlocks) the local macOS account.
3. Logs the user in—all without storing the Google password locally.

1. At startup, the login window shows a Sign in with Google button (or username field if cached).

2. The user’s browser opens to <code>accounts.google.com</code>, prompting Google credentials and MFA.
3. On success, Swif:
 1. Parses the ID-token claims.
 2. Creates (or unlocks) the local macOS account.
 3. Logs the user in—all without storing the Google password locally.

Setting Create Admin User = true grants local-admin rights—use only if required.

Enforced SSO means local passwords no longer unlock the Mac; keep Google MFA enabled for best security.

- Setting Create Admin User = true grants local-admin rights—use only if required.
- Enforced SSO means local passwords no longer unlock the Mac; keep Google MFA enabled for best security.

Deploying the Platform SSO Policy ensures every macOS sign-in is backed by Google Workspace, closing credential gaps and aligning device access to your IdP. For assistance, contact <a href="mailto:support@swif.ai" rel="nofollow noopener noreferrer" target="_blank">Swif Support</a>.

Enforcing Google SSO at macOS Login

Find answers and get help from Intercom Support and Community Experts

This site employs cookies and other technologies that we and our third party vendors use to monitor and record personal information about you and your interactions with the site (including content viewed, cursor movements, screen recordings, and chat contents) for the purposes described in our Cookie Policy. By continuing to visit our site, you agree to our {websiteTermsLink}, {privacyPolicyLink} and {cookiePolicyLink}.

This site uses cookies and similar technologies ("cookies") as strictly necessary for site operation. We and our partners also would like to set additional cookies to enable site performance analytics, functionality, advertising and social media features. See our {cookiePolicyLink} for details. You can change your cookie preferences in our Cookie Settings.

We use cookies to make our site work and also for analytics and advertising purposes. You can enable or disable optional cookies as desired. See our {cookiePolicyLink} for more details.

Advertising cookies are set by our advertising partners to collect information about your use of the site, our communications, and other online services over time and with different browsers and devices. They use this information to show you ads online that they think will interest you and measure the ads' performance. Social media cookies are set by social media platforms to enable you to share content on those platforms, and are capable of tracking information about your activity across other online services for use as described in their privacy policies.

These cookies enable the website to provide enhanced functionality and personalisation. They may be set by us or by third party providers whose services we have added to our pages. If you do not allow these cookies then some or all of these services may not function properly.

These cookies are necessary for the website to function and cannot be switched off in our systems.

These cookies allow us to count visits and traffic sources so we can measure and improve the performance of our site. They help us to know which pages are the most and least popular and see how visitors move around the site.

You have the right to opt out of the sale of your personal information. See our {cookiePolicyLink} for more details about how we use your data.

Your Privacy Choices

We use cookies to enhance your experience. You can customize your cookie preferences below. See our {cookiePolicyLink} for more details.

Cookie Settings

Link, Press control-option-right-arrow to exit

Empty Help Center

Uh oh. That page doesn’t exist.

Disappointed

Neutral

Smiley

Thinking...

Searching through sources...

Analyzing...

Tickets submitted through the messenger or by a support agent in your conversation will appear here.

Requirement	Details
macOS 11 Big Sur or later	Ensure the Swif Agent v1.235.0+ is installed.
Google Workspace tenant	Admin rights to create an OAuth 2.0 client. Application Type: Web Application.
Swif Org Admin	Ability to create policies and deploy to Mac devices.

Field	Example	Description
Client ID	`XXXXXXXX-…apps.googleusercontent.com`	Your Google OAuth Client ID.
Client Secret	`GOCSPX-yyy…`	Google OAuth Client Secret.
Discovery URL	`https://accounts.google.com/.well-known/openid-configuration`	Google’s OIDC metadata URL.
Redirect URI	`https://127.0.0.1/`	Loopback redirect the macOS agent listens on.
Scopes	`openid email profile`	Minimum scopes for ID token + profile.
Should Set Google Access Type To Offline	`true`	Requests a refresh token (keeps login valid offline).
Create Admin User	`true`	If the local macOS user doesn’t exist, create it with admin rights.
Map First Name / Map Last Name	`given_name` / `family_name`	JWT claims → macOS record fields.
Map Username / Map Full Username	`name`	Maps entire Google address to macOS short user name.

Issue	Resolution
Blank login window	Verify profile installed (System Settings → Privacy & Security → Profiles).
OAuth loop fails	Confirm the redirect `https://127.0.0.1/` in Google console and policy.
Offline Mac can’t authenticate	Ensure shouldSetGoogleAccessTypeToOffline = true (refresh token).
User not found	Check mapping fields—`mapUsername` should match the short name format you expect.
Error setting local password to cloud password	There is a conflict with your password policy. You can change the cloud password or remove the password policy from the device.

Enforcing Google SSO at macOS Login

1 Prerequisites

2 Create a Google Workspace OAuth Client

3 Create an Platform SSO Policy in Swif

4 Assign the Policy to Devices

5 User Flow

6 Troubleshooting

7 Security Notes