Low-Cost Local Login for Nonprofits (A Cookbook)

by avzaman

The misallocation of funds due to the reliance on Micro$oft Windows in nonprofit organizations is completely unnecessary.

Licenses get purchased for the operating system and a slew of extra proprietary Micro$oft cloud features, much of which goes unused.  I've witnessed this firsthand.

In October 2025, all of us saw many businesses doing away with their perfectly fine old computers that could not install Windows 11 because of obscene hardware requirements.  Even with workarounds you can never guarantee a security update will work properly.  Switching to Linux computers integrates better with most open-source projects for IT Service Management (ITSM) solutions as well as any free cloud features!  For the past year, I have been working on a method of combining free cloud services and open-source software to give nonprofits a framework for easily implementable cost saving measures for their IT needs.

Nonprofits should be able to focus entirely on their goals.  They require a minimum of overhead to run a website, own a few email addresses, and use some computers to work on documents and maybe QuickBooks.  Google Workspace is at the center of most of this and provides many free features to registered nonprofits such as custom emails, file sharing, cloud user administration, and so on.  By combining this with some free features in the Google Cloud panel, we can get user administration without having to set up an LDAP server or get involved with Micro$oft Active Directory at all!

This article explains how to use Google Workspace for nonprofits and the open-source project authd to provide logins to computers.  From there, it's simply a matter of installing your preferred browser and logging into whatever web interface the organization sees fit.

Cloud Setup

First, you'll need to create a Google Workspace account and get approval for the nonprofit tier of service.  Note that the email used to sign up for the Google Workspace will be the default administrator until roles are changed manually.

You can sign up for Google Workspace for nonprofits at: www.google.com/nonprofits/eligibility

You will need:

1. Your organization's nonprofit registration number (EIN in the U.S.).
2. Your organization's physical address.
3. Your organization's online contact information.
4. To link your public domain, you will need to add a DNS TXT record via your domain registrar.

Now that Google Workspace is set up, we need to set up an OAuth 2.0 token for the organization in Google Cloud.  To do that, go to cloud.google.com and log in with that Google Workspace administrator account.

Next, click the console button in the top-right to go to the GCP console for the organization.

Next, click the box in the top-right that may say My First Project or the name of your organization and a window will pop up listing all the projects for your organization.

Click Create New Project and name it whatever you want.  A project is needed to create the OAuth token.  I named mine ubuntu-authd.

Before we can create the token, we need to go through the OAuth consent screen.  This is found from the hamburger menu in the top-left -> APIs & Services -> OAuth Consent Screen.  Then click Get Started to go through the prompts and agreements.

Next, set up the OAuth 2.0 Client ID from the authd wiki.  You can find instructions on how to do this at: documentation.ubuntu.com/authd/edge-docs/howto/configure-authd

Save the generated Client ID JSON for later, as we will need it to configure authd on Ubuntu to connect to the organization Google Cloud.  The OAuth 2.0 client creation is in the free tier of Google Cloud.

Desktop Setup

The next step is to enable any cheap hardware we can get our hands on as a glorified web browser (nonprofits can get deals at techsoup.org).

Download the latest Ubuntu LTS ISO image from: ubuntu.com/download/desktop

Next, use balenaEtcher or some similar tool to burn the ISO image to the USB drive.

After that, boot from the drive on the target machine and install Ubuntu.

Once Ubuntu is installed and you have the root user info saved, we can begin installing and configuring the authd broker.  To do this, add the authd repo to your package repository:

$ sudo add-apt-repository ppa:ubuntu-enterprise-desktop/authd

Then install authd and the Snap package manager.  Snap is needed to get the latest platform specific packages for authd:

$ sudo apt install authd snap

Next, using Snap, install the authd broker for Google:

$ sudo snap install authd-google

To get authd working, we need to create a directory under the authd package and copy over the platform specific .conf folder into it:

$ sudo mkdir -p /etc/authd/brokers.d/ $ sudo cp /snap/authd-google/current/conf/authd/google.conf /etc/authd/brokers.d/

Finally, edit the broker.conf file to include the Client ID and secret from that OAuth 2.0 client from earlier in Google Cloud.  The file is found by default in: /var/snap/authd-google/current/broker.conf

[oidc] issuer = https://accounts.google.com client_id = <CLIENT_ID> client_secret = <CLIENT_SECRET>

After restarting the authd service and the authd-google service, the new configs should be loaded and you can log out and log back in with any user made in the Google Workspace.

$ sudo systemctl restart authd $ sudo snap restart authd-google

To login, at the sign in screen for the computer, select Not listed?:

Put in the associated user email.  Then it will ask to select an authentication method.  Click Google:

A verification screen will pop up:

Next, use a browser on another device.  Verify the login by going to google.com/device and entering the given code:

There's a lot of configuration that can be added to the authd broker, just make sure to restart both authd and authd-google after every configuration change to ensure proper updates.  Configurations can be found at: documentation.ubuntu.com/authd/stable-docs/howto/configure-authd

Conclusion

Linux inherently has a more secure design with root privileges needed for pretty much any important operation, mainly software installation.

So after you install a browser (and LibreOffice if users want to edit documents offline), the workstation can be safely used by anyone in the organization with a Google Workspace account.  Make sure to keep the root account password confidential!

Leading up to October 2025, I saw many organizations replacing any computer that would not automatically upgrade to Windows 11.  This solution allows nonprofits to skip the spending on expensive cloud subscriptions and Micro$oft Windows licenses, as well as future proof the cheap hardware that is available to them.

My next article in this "cookbook" will be a solution for free remote support.  Please write with your comments and questions!  As with any open-source project, the more ideas pooled, the better this can get!