# Google Workspace

Steps verified in the identity provider's admin console.

Recommended protocol: SAML 2.0.

## SAML 2.0

### Connect Google Workspace with SAML 2.0

This guide is not available in your language yet; it is shown in en.

1. In the Google Admin console (super administrator) go to Apps \> Web and mobile apps.

   ![Apps > Web and mobile apps in the Admin console](/assets/idp-guides/google-workspace/saml-1.png)

2. Click Add app \> Add custom SAML app, enter an App name and click Continue.

   ![Add app menu with Add custom SAML app](/assets/idp-guides/google-workspace/saml-2.png)

3. On the Google Identity Provider details page use Download Metadata (Option 1), or copy the SSO URL and Entity ID and download the certificate (Option 2), upload it in KeenAuth and click Continue.

   ![Google Identity Provider details with Download metadata, SSO URL and Entity ID](/assets/idp-guides/google-workspace/saml-3.png)

4. On Service Provider Details enter ACS URL **ACS URL** and Entity ID **SP entity ID**; the ACS URL must start with `https://`.

   ![Service provider details with ACS URL and Entity ID](/assets/idp-guides/google-workspace/saml-4.png)

5. Set Name ID format to PERSISTENT (the default is UNSPECIFIED) and keep Name ID as Basic Information \> Primary email, then click Continue. On Attribute mapping click Add mapping for Basic Information \> First name, Last name and Primary email, and optionally add Group membership.

   ![Attribute mapping with Add mapping and Group membership](/assets/idp-guides/google-workspace/saml-5.png)

6. Click Finish, then on the app's page open User access, set Service status to ON for everyone or for the organizational units that should sign in and click Save. Use Test SAML login and run the KeenAuth connection test.

   ![App page with User access and Test SAML login](/assets/idp-guides/google-workspace/saml-6.png)


## OpenID Connect

### Connect Google Workspace with OpenID Connect

This guide is not available in your language yet; it is shown in en.

1. On the Google Auth Platform Clients page click Create client, choose Application type Web application, enter a Name, under Authorized redirect URIs click Add URI and enter **redirect URI** (HTTPS, no wildcards), then click Create. The client secret is shown only once at creation; store it securely. Settings can take from 5 minutes to a few hours to take effect.

   ![Create OAuth client ID with Web application and an authorized redirect URI](/assets/idp-guides/google-workspace/oidc-1.png)

2. In KeenAuth use issuer `https://accounts.google.com` and add your Workspace primary domain to the connection's allowed email domains.
3. KeenAuth requires the hd claim: personal Google accounts do not carry it and are rejected.
4. Enter the client ID and secret in KeenAuth and run the connection test with a Workspace account.

## SCIM 2.0

There is no separate guide for this protocol; follow the [generic guide](/docs/integrations/generic-scim).

Values in bold are shown on the connection's page in the Admin Portal, where this guide has them filled in.