SSO - Login with Google

We would like to offer an option to log in with Google. Hoes does this work mapping users to Google accounts? I think we would still have to add/authorize users via the /settings/users page, but we would not be managing user's passwords. It would be nice to be able to authorize someone based on a group membership, but that can be handled as part of another issue.