A team of about tenA shared password vault with Google sign-in

A small team shared the logins for their customers’ sites and servers, and the way they shared them had grown up informally. They needed one place for every credential, that each person could open with the account they already use, and that the business itself controlled.

I set up a self-hosted password manager on the business’s own infrastructure and connected it to Google Workspace.

• Staff sign in with their Google Workspace accounts, limited to the business’s own domain, so there’s no extra password to forget.
• The vault is shared through one group, because Google’s sign-in doesn’t tell it which groups someone belongs to. Adding a new person is a single step.
• Self-registration and email recovery are off: every account is created deliberately.
• A separate break-glass administrator login stays on alongside Google sign-in, with a written procedure for falling back if single sign-on ever breaks.
• The trade-off was written down and agreed: letting Google sign-in open the vault directly means the server can technically read it. For a team this size, ease of use won, knowingly.