Google Workspace and role mapping

Google Workspace sign-in over OpenID Connect gives member access only. To map groups to abilities, use SAML.

For: Administrators (the admin ability) · Last updated

Google Workspace works with Workforce Intelligence over OpenID Connect, with one limit: a standard Google sign-in for a third-party application cannot carry a roles or groups claim. Role mapping therefore has nothing to read, and nobody is granted abilities from Google groups. You have two options.

Option 1: OpenID Connect, member access only#

Everyone with an address on the domain can sign in and receives membership only. You assign abilities afterwards on the Team page (Settings > Administration > Team).

  1. In the Google Cloud console, create an OAuth client of type Web application. Add the OIDC redirect URI from the Single sign-on page (it ends in /auth/callback) as an Authorized redirect URI.
  2. On the Single sign-on page, add the domain as OpenID Connect (OIDC). The Issuer is always https://accounts.google.com. Enter the Client ID and Client secret.
  3. Leave Claim name blank and add no mapping rows.
  4. Verify the domain.

Sign-in needs the email address to be verified by Google and to belong to the configured domain.

Option 2: SAML, to map groups to abilities#

SAML can carry attributes, and Google's custom SAML app can send group membership as one.

  1. Add the domain as SAML 2.0 and copy its service provider details, following Set up SAML 2.0.
  2. In the Google Admin console, add a custom SAML app (Apps > Web and mobile apps). Give Google the Assertion consumer service (ACS) URL and the Service provider entity ID, and set the Name ID format to EMAIL with the Name ID taken from the primary email.
  3. In the app's attribute mapping, add the Group membership mapping, choose the Google groups to send, and give it an app attribute name such as groups.
  4. Download Google's metadata and add it to the domain with Add identity provider details.
  5. Leave Role attribute name blank if the attribute is named groups or roles; otherwise enter the name you chose.
  6. Use Edit mapping, with each Google group's name as the value, as described in Map provider roles to abilities.

Turn the app on for the organizational units that should use it.

Group values are matched exactly as Google sends them. Check one sign-in in the audit log to see which abilities were granted.