Enforcing Google SSO at macOS Login with Swif | Help Center

Swif’s Identity Login Policy lets you replace the local macOS login window with Google Workspace Single Sign-On. Users authenticate with their Google credentials, and Swif provisions (or verifies) the matching local account before sign-in completes.

1 Prerequisites

Requirement	Details
macOS 11 Big Sur or later	Ensure the Swif Agent v1.235.0+ is installed.
Google Workspace tenant	Admin rights to create an OAuth 2.0 client. Application Type: Web Application.
Swif Org Admin	Ability to create policies and deploy to Mac devices.

2 Create a Google Workspace OAuth Client

Go to Google Cloud Console → APIs & Services → Credentials.
Click Create Credentials → OAuth client ID →Application Type: Web Application.
Authorized redirect URI → add https://127.0.0.1/ (loopback).
Save → copy the Client ID and Client secret.

3 Create an Identity Login Policy in Swif

Policies → Create New Policy → Identity Login Policy.
Fill the fields:

Field	Example	Description
clientId	`XXXXXXXX-…apps.googleusercontent.com`	Your Google OAuth Client ID.
clientSecret	`GOCSPX-yyy…`	Google OAuth Client Secret.
discoveryURL	`https://accounts.google.com/.well-known/openid-configuration`	Google’s OIDC metadata URL.
redirectURI	`https://127.0.0.1/`	Loopback redirect the macOS agent listens on.
scopes	`openid email profile`	Minimum scopes for ID token + profile.
shouldSetGoogleAccessTypeToOffline	`true`	Requests a refresh token (keeps login valid offline).
createAdminUser	`true`	If the local macOS user doesn’t exist, create it with admin rights.
mapFirstname / mapLastname	`given_name` / `family_name`	JWT claims → macOS record fields.
mapUsername / mapFullusername	`name`	Maps entire Google address to macOS short user name.

Tip: Leave onlineAuthenticationGracePeriod blank—macOS login already requires fresh Google auth each boot.

Save the policy.

4 Assign the Policy to Devices

Choose the Mac devices or Smart Group that should enforce Google SSO.
Click Deploy.
Swif pushes a configuration profile that replaces the standard macOS login window.

5 User Flow

At startup, the login window shows a Sign in with Google button (or username field if cached).
The user’s browser opens to accounts.google.com, prompting Google credentials and MFA.
On success, Swif:
1. Parses the ID-token claims.
2. Creates (or unlocks) the local macOS account.
3. Logs the user in—all without storing the Google password locally.

6 Troubleshooting

Issue	Resolution
Blank login window	Verify profile installed (System Settings → Privacy & Security → Profiles).
OAuth loop fails	Confirm redirect `https://127.0.0.1/` in Google console and policy.
Offline Mac can’t authenticate	Ensure shouldSetGoogleAccessTypeToOffline = true (refresh token).
User not found	Check mapping fields—`mapUsername` should match the short name format you expect.

7 Security Notes

Setting createAdminUser = true grants local-admin rights—use only if required.
Enforced SSO means local passwords no longer unlock the Mac; keep Google MFA enabled for best security.

Deploying the Identity Login Policy ensures every macOS sign-in is backed by Google Workspace—closing credential gaps and aligning device access to your IdP. For assistance, contact Swif Support.