IT Onboarding Instructions

Hackley Clubz uses Sign in with Google to authenticate members of the Hackley School community. This way no one has to remember their password. There is no risk of passwords being compromised. And, because it’s a strong guarantee that the only users of the system are people at Hackley.

For Google Workspace accounts managed by Hackley School, a Google Workspace administrator must configure Hackley Clubz as an approved application. This is particularly important for student accounts, since Google Workspace for Education may restrict third-party applications for users under 18.

Hackley Clubz uses Google only to authenticate users and obtain their basic identity information. Google authentication provides Hackley Clubz with basic information such as:

• Name
• Email address
• Google account identifier
• Profile picture, if available (we don’t use this now but we may in the future)

Hackley Clubz does not require access to Gmail, Google Drive, Google Calendar, Google Docs, or other Google Workspace content in order to sign users in.

Google describes openid, email, and profile as authentication-only scopes used for Sign in with Google.

Google Workspace Domains

Hackley Clubz is intended to support Hackley-managed accounts including:

• @students.hackleyschool.org
• @hackleyschool.org

Google Workspace App Access Control is generally configured by organizational unit (OU) rather than by the user’s email domain.

Because Hackley Clubz may be used by both students and faculty — including faculty serving as club advisors — we recommend enabling Hackley Clubz for the top-level organizational unit. But the main thing is that it should be accessible to teachers, students, and administrators - basically anyone who would join or sponsor a high school club.

Google states that leaving the top-level organizational unit selected applies the configuration to all users in the organization.

If students.hackleyschool.org and hackleyschool.org are managed within the same Google Workspace organization, this single top-level configuration should cover users in both domains.

If the domains are managed by separate Google Workspace organizations, the configuration should instead be completed separately in each Admin Console.

Hackley Clubz OAuth Client IDs

Hackley Clubz has three Google OAuth clients because authentication is supported on the web, iOS, and Android.

Web

718237225971-lnpashlp5ksska1p1i0mnqathdj5jcao.apps.googleusercontent.com

iOS

718237225971-9uismnjpue7np67ctocm0a4gc7kla1hr.apps.googleusercontent.com

Android

718237225971-8ekf8k3mtcgo4toog1l46qh5q384ni3b.apps.googleusercontent.com

All three Client IDs should be configured.

Configuration Instructions

The following steps should be completed by a Google Workspace administrator with the appropriate Service Settings administrator privilege.

1. Open API Controls

Sign in to the Google Admin Console (https://admin.google.com/) and navigate to:

Security → Access and data control → API controls

Then click:

Manage App Access

This is Google’s App access control section for applications that authenticate through Google OAuth.

2. Configure the Web Client

Under Configured apps, click:

Configure new app

In the search field, enter the complete Web Client ID:

718237225971-lnpashlp5ksska1p1i0mnqathdj5jcao.apps.googleusercontent.com

Click Search.

Select the matching application from the results.

Google permits administrators to locate an application directly by its OAuth Client ID.

3. Select the Organizational Unit

Google will ask who the configuration should apply to.

Leave the top-level organizational unit selected.

This is the recommended configuration for Hackley Clubz because both students and faculty may need access to the application.

According to Google’s documentation, leaving the top-level OU selected applies the setting to all users in the Google Workspace organization.

Click Continue.

4. Configure Access to Google Data

For Access to Google data, select:

Specific Google data

This is preferable to granting Hackley Clubz broad Trusted access.

Google defines Specific Google data as allowing an application to request access only to the OAuth scopes specifically selected by the administrator. By contrast, Trusted permits access to all Google Workspace services and OAuth scopes, including restricted services.

Hackley Clubz only needs the scopes required for Google authentication.

Allow the Google Sign-In/basic identity scopes requested by the application, corresponding to:

openid

email

profile

Depending on how the Admin Console displays them, these may appear as Google Sign-In or basic account-information permissions rather than exactly those three strings.

Google specifically notes that administrators using Specific Google data must include the Google Sign-In scopes required by the application.

These authentication scopes provide basic identity information; they do not grant access to a user’s Gmail, Drive documents, Calendar events, or similar Workspace content.

Click Continue, review the configuration, and click Finish.

5. Configure the iOS Client

Repeat the same procedure:

Security → Access and data control → API controls → Manage App Access → Configure new app

Search for:

718237225971-9uismnjpue7np67ctocm0a4gc7kla1hr.apps.googleusercontent.com

Then:

1. Select the matching Hackley Clubz application.
2. Leave the top-level organizational unit selected.
3. Select Specific Google data.
4. Permit the Google Sign-In/basic identity scopes requested by the application.
5. Click Continue and Finish.

6. Configure the Android Client

Repeat the procedure for the Android Client ID:

718237225971-8ekf8k3mtcgo4toog1l46qh5q384ni3b.apps.googleusercontent.com

Again:

1. Select the matching application.
2. Apply the configuration to the top-level organizational unit.
3. Select Specific Google data.
4. Permit the Google Sign-In/basic identity scopes.
5. Finish the configuration.

7. Verify the Configuration

Return to:

Security → Access and data control → API controls → Manage App Access

Verify that Hackley Clubz is configured for the organization and that all three OAuth Client IDs are covered:

Google’s interface may group related OAuth clients together in some views. The important requirement is that the OAuth clients used by all three platforms are configured for the appropriate users.

8. Test Authentication

After configuring the application, test with Hackley-managed Google accounts.

We recommend testing at least:

• One @students.hackleyschool.org student account
• One @hackleyschool.org faculty or staff account

If possible, test authentication on:

• Hackley Clubz on the web
• Hackley Clubz for iOS
• Hackley Clubz for Android

Each user should be able to select their Hackley Google account and successfully authenticate.

Google notes that changes to these settings can take up to 24 hours, although they typically take effect more quickly.

Security Notes

No Google Workspace administrative access is required

Hackley Clubz does not need:

• Google Workspace administrator credentials
• Domain-wide delegation
• Service-account impersonation
• Access to the Admin SDK

The configuration described above simply permits Hackley users to authenticate themselves to Hackley Clubz using their existing Google accounts.

No Gmail, Drive, or Calendar access is required

Hackley Clubz does not need Google OAuth permission to read or modify:

• Email
• Google Drive files
• Google Docs
• Google Sheets
• Google Calendar
• Google Classroom data
• Contacts

The application uses Google authentication to establish the identity of the person signing in.

The school’s Google passwords are never provided to Hackley Clubz

Authentication occurs through Google’s own Sign in with Google system. Hackley Clubz receives the resulting Google identity information rather than the user’s Google password.

Troubleshooting

“Access blocked” or admin_policy_enforced

If a Hackley user sees a message indicating that their administrator has blocked access, first verify that the OAuth Client ID being used by that platform has been configured under:

Security → Access and data control → API controls → Manage App Access

Google documents admin_policy_enforced as an error that can occur when an organization’s administrator does not permit the user to use Sign in with Google for the application.

Web login works, but iOS or Android does not

The web, iOS, and Android applications use different OAuth Client IDs.

Confirm that all three Client IDs listed above have been configured, rather than only the Web Client ID.

Faculty can log in, but students cannot

This may indicate that the configuration applies to a faculty organizational unit but not to the OU containing student accounts.

Verify that Hackley Clubz is configured at the top-level organizational unit, or otherwise explicitly includes the student organizational units.

Google Workspace for Education provides additional controls over third-party applications for users under 18, so a configuration that works for adult accounts does not necessarily establish that student accounts have been enabled.

Students can log in, but faculty cannot

Similarly, check that the configuration was not applied only to the student OU.

Hackley Clubz should normally be configured at the top-level organizational unit so that students, faculty, staff, and club advisors who are entitled to use Hackley Clubz can authenticate.

Summary for IT

The required configuration is:

Application: Hackley Clubz

Users: Top-level Google Workspace organizational unit

Access level: Specific Google data

Purpose: Sign in with Google / identity authentication only

Google Workspace content access: None required

OAuth clients: Web + iOS + Android

Web

718237225971-lnpashlp5ksska1p1i0mnqathdj5jcao.apps.googleusercontent.com

iOS

718237225971-9uismnjpue7np67ctocm0a4gc7kla1hr.apps.googleusercontent.com

Android

718237225971-8ekf8k3mtcgo4toog1l46qh5q384ni3b.apps.googleusercontent.com

Google’s current Workspace administrator documentation for this process is available here:

Google Workspace: Control which apps access Google Workspace data