> ## Documentation Index
> Fetch the complete documentation index at: https://docs.kvelden.com/llms.txt
> Use this file to discover all available pages before exploring further.

# SSO with Google Workspace

> Connect Google Workspace to Enclave for enterprise single sign-on via OIDC or a custom SAML app, with the exact field mappings.

Connect **Google Workspace** to Enclave. **OIDC** is the simplest path with Google; **SAML** is also supported via a Google Workspace custom SAML app. See [Authentication](/organization/authentication) for how SSO fits with the rest of Enclave.

<Info>
  **Where:** **Organization → Single Sign-On** in Enclave (Owner role). One email domain maps to one connection.
</Info>

## Option A — OIDC (recommended)

<Steps>
  <Step title="Create an OAuth client in Google Cloud">
    Google Cloud console → **APIs & Services → Credentials → Create Credentials → OAuth client ID → Web application**.

    * **Authorized redirect URI:** `https://<your-enclave-host>/api/auth/oidc/callback`
    * Configure the **OAuth consent screen** (Internal, for your Workspace).
    * Copy the **Client ID** and **Client Secret**.
  </Step>

  <Step title="Add the connection in Enclave">
    **Add Connection → OIDC** (or pick the **Google** quick-pick):

    | Field                     | Value                         |
    | ------------------------- | ----------------------------- |
    | Domain                    | your Workspace email domain   |
    | Issuer URL                | `https://accounts.google.com` |
    | Client ID / Client Secret | from the previous step        |
  </Step>

  <Step title="Verify domain, enable, test">
    Complete [domain verification](/organization/sso/okta#verify-your-domain), enable, and sign in.
  </Step>
</Steps>

## Option B — SAML 2.0 (custom SAML app)

<Steps>
  <Step title="Create a custom SAML app in Workspace">
    Google **Admin console → Apps → Web and mobile apps → Add app → Add custom SAML app**. On the **Google IdP details** screen, download the **Certificate** and note the **SSO URL** and **Entity ID**.
  </Step>

  <Step title="Service provider details (in Google)">
    | Google field   | Value                                                                                                       |
    | -------------- | ----------------------------------------------------------------------------------------------------------- |
    | ACS URL        | `https://<your-enclave-host>/api/auth/saml/acs`                                                             |
    | Entity ID      | your connection's **per-connection metadata URL** (`https://<host>/api/auth/saml/metadata/<connection-id>`) |
    | Name ID format | `EMAIL`                                                                                                     |
    | Name ID        | Basic Information → Primary email                                                                           |

    Add an **email** attribute mapping. Turn the app **ON for everyone** (or the right OUs).
  </Step>

  <Step title="Add the connection in Enclave — map the fields">
    **Add Connection → SAML.** From Google's **IdP details**:

    | Google value                                                  | Enclave field              |
    | ------------------------------------------------------------- | -------------------------- |
    | **SSO URL**                                                   | **SSO URL**                |
    | **Entity ID** (`https://accounts.google.com/o/saml2?idpid=…`) | **IdP Entity ID / Issuer** |
    | **Certificate**                                               | **X.509 Certificate**      |

    <Warning>
      **IdP Entity ID / Issuer** = Google's **Entity ID**
      (`https://accounts.google.com/o/saml2?idpid=…`), not any metadata download URL.
      A wrong value fails with `idp_issuer_mismatch`.
    </Warning>
  </Step>

  <Step title="SP certificate, domain verify, enable">
    Generate the **SP signing certificate** on the connection card, set Google's **Entity ID** (SP) to the per-connection metadata URL shown there, complete [domain verification](/organization/sso/okta#verify-your-domain), enable, and test.
  </Step>
</Steps>

## Shared steps & troubleshooting

Domain verification, SP-certificate generation, provisioning mode, Require-fresh-sign-in, and Single Logout work the same across IdPs — see the [Okta guide](/organization/sso/okta) and [Authentication](/organization/authentication). The [troubleshooting table](/organization/sso/okta#troubleshooting) applies to Google too.