Skip to content

Single sign-on with Google Workspace

Use OIDC. Google ID tokens carry no group membership, so if you want to map Workspace groups to Preloop roles or teams, use the SAML app instead (Alternative: SAML).

Verify your Workspace email domain first (Single sign-on).

Create the OAuth client

  1. In the Google Cloud console, pick a project owned by your Workspace organisation. Under Google Auth Platform > Branding (the OAuth consent screen), set the audience (user type) to Internal, so only accounts in your Workspace can sign in.
  2. Under Clients, create an OAuth client of type Web application. Leave the authorized redirect URIs empty for now.
  3. Copy the client ID and client secret.

Finish in Preloop

  1. Go to Account settings > Single sign-on and click Add OIDC connection.
  2. Issuer: https://accounts.google.com. Enter the client id and secret. Scopes: openid email profile. Choose the default role and whether first sign-in creates a membership. Enable the connection and save.
  3. Add the connection's callback URL to the OAuth client's Authorized redirect URIs in Google and save.
  4. Click Test sign-in.
  5. Optional: turn on Require single sign-on (Enforcement and break-glass).

Alternative: SAML

Create the SAML app

  1. In Preloop, go to Account settings > Single sign-on, click Add SAML connection, enter a name and save. Copy the SP metadata URL and the ACS URL.
  2. In the Google Admin console, go to Apps > Web and mobile apps > Add app > Add custom SAML app.
  3. On Google Identity Provider details, download the IdP metadata XML.
  4. On Service provider details:
  5. ACS URL: the Preloop ACS URL.
  6. Entity ID: the Preloop SP metadata URL.
  7. Name ID format: EMAIL. Name ID: Basic Information > Primary email.
  8. Leave Signed response off. Google signs the assertion, which is what Preloop requires by default.
  9. On Attribute mapping:
  10. Primary email → email.
  11. Optional: First name or a display name → displayName.
  12. Optional: under Group membership, choose the groups to send and name the app attribute groups. Google sends only the groups you select here.
  13. Finish, then turn the app ON for the organizational units or groups that should sign in.

Finish the SAML connection in Preloop

  1. Edit the connection. Under Import identity provider metadata, paste the contents of the downloaded metadata XML, click Preview metadata, then Apply metadata to editor.
  2. If you send groups, set Groups claim or attribute to groups and add mappings.
  3. Choose the default role and whether first sign-in creates a membership. Enable the connection and save.
  4. Click Test sign-in.
  5. Optional: turn on Require single sign-on (Enforcement and break-glass).