How to Configure Google as an OIDC Identity Provider on Zyxel USG FLEX H Series

This article explains how to configure Google as an OIDC Identity Provider (IdP) for the Zyxel USG FLEX H Series firewall.

OpenID Connect (OIDC) allows users to authenticate to the Zyxel firewall using their Google account. The Zyxel firewall redirects the user to Google for authentication and receives the authentication result after a successful sign-in.

In addition to the basic OIDC configuration and validation, this article also demonstrates how to use Google OIDC with the Zyxel Captive Portal. The guide covers the complete authentication flow, including Google authentication, Captive Portal configuration, HTTPS certificate settings, and optional DNS configuration.

The configuration in this article was tested using Google Cloud and a Zyxel USG FLEX H Series firewall in a test environment.

The configuration in this article uses Google Cloud and a Zyxel USG FLEX H Series firewall in a test environment.

Note: If you need to configure Microsoft Entra ID as the OIDC Identity Provider instead of Google, see How to Configure Microsoft Entra ID as an OIDC Server on Zyxel USG FLEX H Series.

Prerequisites

Before starting the configuration, make sure you have:

• A Zyxel USG FLEX H Series firewall with uOS 1.39 or later.
• A Google Cloud account with permission to create and manage applications.
• A test Google account for authentication.
• Administrative access to the Zyxel firewall.
• A publicly reachable FQDN for the Zyxel firewall.
• HTTPS access to the Zyxel firewall.

Note: The Google account used for testing must be able to sign in to the configured Google application.

1. Create a Google Cloud Project

Create a new project in Google Cloud for the OIDC configuration.

1. Enter a project name, for example:

   Zyxel OIDC Google

2. Leave the automatically generated Project ID unchanged.
3. Select the required Billing account.
4. Select your Organization.
5. Keep the selected Parent resource.
6. Click Create.

Note: The Organization and Parent resource depend on your Google Cloud environment. If your account belongs to an organization, select the appropriate organization instead of using No organization.

After creating the project, select Zyxel OIDC Google from the project list to make it the active Google Cloud project.

Note: Make sure the correct project is selected before configuring Google Auth Platform. All OIDC settings created in the following steps will belong to this project.

2. Open Google Auth Platform

• Open the newly created project.

• Go to Google Auth Platform.
• Click Get started.

3. Configure App Information

• Under App Information, enter the App name and select the User support email. Click Next.

• Under Audience, select External and click Next.

• Note: Select External when users outside your Google organization need to authenticate through this OIDC configuration. The application is initially placed in testing mode.

Under Contact Information, enter the email address that Google can use to contact the application owner. Click Next. Under Finish, select I agree to the Google API Services: User Data Policy and click Continue.

Click Create to complete the configuration.

4. Create an OAuth Client

In Google Auth Platform Click Create client. 

For Application type, select Web application. Enter a name for the OAuth client, for example:
Zyxel OIDC Google OAuth client ID 

Leave Authorized JavaScript origins empty.

Under Authorized redirect URIs, click Add URI and enter the Redirect URI configured on the Zyxel firewall:

https://h200.zylab.uk:1003/oauth2/callback

Click Create.

After the OAuth client is created, Google displays the Client ID and Client secret.

Important: Copy and securely store the Client ID and Client secret immediately. Google will no longer display the client secret after this dialog is closed.

Click OK. The newly created OAuth client should appear under OAuth 2.0 Client IDs.

5. Add Test Users

1. Go to Google Auth Platform → Audience.
2. Under Test users, click Add users.
3. Enter the Google account that will be used for testing.
4. Click Save.
5. Verify that the account appears in the Test users list.

Note: Keep the application in Testing status during the initial configuration and testing. Only users added under Test users can authenticate while the application is in this mode.

6. Configure Google OIDC on the Zyxel Firewall

Log in to the Zyxel USG FLEX H Web Configurator.

Go to: User & Authentication → User Authentication → AAA Server

Click Add and select OIDC Server. Configure the OIDC server with the following settings.

Note: The Redirect Address must be the FQDN of the Zyxel firewall. The Zyxel-generated Redirect URI is based on this address. For this example, the generated Redirect URI is https://h200.zylab.uk:1003/oauth2/callback. This exact URI must be configured under Authorized redirect URIs in the Google OAuth client.

Click Apply to save the configuration.

6.1. Test the OIDC Configuration

• After applying the configuration, scroll down to Configuration Validation.
• Click Test.
• A new browser tab opens and redirects you to the Google sign-in page.
• Select the Google account that was previously added under Test users.

• Complete the Google authentication.
• After successful authentication, verify that the Zyxel page displays

Verify that the user's email address is displayed as the Username and that the email claim is detected as the Login Name Attribute.

In our test environment, the authentication was successful and Google returned the expected OIDC claims, including iss, sub, email, and email_verified.

Note: If the test result shows group_list: Request had insufficient authentication scopes, this does not indicate an OIDC authentication failure. The user authentication itself is successful, but group information cannot be retrieved with the scopes currently configured. For this basic Google OIDC authentication test, leave Group Attribute empty.

Note: The Advanced Settings at USG FLEX H GUI are optional.

7. Configure Captive Portal Authentication

Log in to the Zyxel USG FLEX H Web Configurator.

Go to: Captive Portal → Authentication Policy

Click Add and configure the authentication policy as follows:

For the Exempt List, add the DNS service.

Leave the Walled Garden List empty for this basic test.

Under Advanced Settings, leave the default values unchanged.

Click Apply to save the configuration.

Note: The Incoming interface must match the network interface/VLAN from which the clients access the Captive Portal. In this example, clients are connected through ge3.

Note: The Advanced Settings at the USG FLEX H GUI are optional. They are not required for basic Google OIDC authentication.

7.1. Configure Captive Portal HTTPS Settings

Go to:

Captive Portal → Authentication Policy → Settings

Configure the server settings as follows: