Skip to main content
Connect Google Workspace to Enclave. OIDC is the simplest path with Google; SAML is also supported via a Google Workspace custom SAML app. See Authentication for how SSO fits with the rest of Enclave.
Where: Organization → Single Sign-On in Enclave (Owner role). One email domain maps to one connection.
1

Create an OAuth client in Google Cloud

Google Cloud console → APIs & Services → Credentials → Create Credentials → OAuth client ID → Web application.
  • Authorized redirect URI: https://<your-enclave-host>/api/auth/oidc/callback
  • Configure the OAuth consent screen (Internal, for your Workspace).
  • Copy the Client ID and Client Secret.
2

Add the connection in Enclave

Add Connection → OIDC (or pick the Google quick-pick):
3

Verify domain, enable, test

Complete domain verification, enable, and sign in.

​
Option B — SAML 2.0 (custom SAML app)

1

Create a custom SAML app in Workspace

Google Admin console → Apps → Web and mobile apps → Add app → Add custom SAML app. On the Google IdP details screen, download the Certificate and note the SSO URL and Entity ID.
2

Service provider details (in Google)

Add an email attribute mapping. Turn the app ON for everyone (or the right OUs).
3

Add the connection in Enclave — map the fields

Add Connection → SAML. From Google’s IdP details:
IdP Entity ID / Issuer = Google’s Entity ID (https://accounts.google.com/o/saml2?idpid=…), not any metadata download URL. A wrong value fails with idp_issuer_mismatch.
4

SP certificate, domain verify, enable

Generate the SP signing certificate on the connection card, set Google’s Entity ID (SP) to the per-connection metadata URL shown there, complete domain verification, enable, and test.

​
Shared steps & troubleshooting

Domain verification, SP-certificate generation, provisioning mode, Require-fresh-sign-in, and Single Logout work the same across IdPs — see the Okta guide and Authentication. The troubleshooting table applies to Google too.