> ## Documentation Index
> Fetch the complete documentation index at: https://launchdarkly.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Google Workspace

<View title="Developer" />

<View title="Federal docs" />

<View title="EU docs" />

This topic explains how to configure Google Workspace to support single sign-on (SSO) in LaunchDarkly.

> [!NOTE]
>
> **Google OAuth is different from Google Workspace SSO**
>
> The procedures in this topic explain how to configure SSO for Google Workspace. To learn how to configure Google OAuth instead, read [Google OAuth](/docs/home/account/oauth-google.md).
>
> If a member signs in to LaunchDarkly using Google OAuth, they cannot also sign in to the same account using Google Workspace SSO. Similarly, if you invite a member to join a LaunchDarkly account using Google Workspace SSO, they cannot also sign in using Google OAuth.

## Prerequisites

To configure SSO for LaunchDarkly using Google Workspace, you must complete the following prerequisite:

* Configure SAML for authentication. For more information, read the [Google knowledge base](https://support.google.com/a/answer/6087519).

Use the table below to configure Google fields for LaunchDarkly:

<table>
  <thead>
    <tr>
      <th>Google field</th>
      <th>LaunchDarkly setting</th>
    </tr>
  </thead>

  <tbody>
    <tr>
      <td>ACS URL</td>
      <td>Use LaunchDarkly's Assertion Consumer Service URL value.</td>
    </tr>

    <tr>
      <td>Entity ID</td>
      <td>Use LaunchDarkly's Entity ID value.</td>
    </tr>

    <tr>
      <td>Start URL</td>
      <td>Use LaunchDarkly's Start URL value.</td>
    </tr>

    <tr>
      <td>Signed Response</td>
      <td>Check this box.</td>
    </tr>

    <tr>
      <td>Name ID</td>
      <td>Select `Basic Information` and `Primary Email`.</td>
    </tr>

    <tr>
      <td>Name ID Format</td>
      <td>Select `EMAIL`.</td>
    </tr>

    <tr>
      <td>Attribute Mapping</td>

      <td>
        Enter `role` as the `application attribute`, and select the [custom user attribute](https://support.google.com/a/answer/6208725?hl=en) that corresponds to the
        desired role. You will map `customRole` and `teamKey` in a later step.
      </td>
    </tr>
  </tbody>
</table>

## Configure SSO for LaunchDarkly with Google Workspace

Before you create the LaunchDarkly app in Google Workspace, you must create LaunchDarkly-specific fields for roles, custom roles, and teams.

To configure these fields:

1. Log into Google Workspace.
2. Navigate to your user directory by clicking **Directory** and then **Users**.
3. Click the **Manage user attributes** icon. A popup screen appears:

![The "Manage user attributes" icon.](https://mintcdn.com/launchdarkly/unfRSXbmQkdGxJjN/images/__third_party/google-manage-user-attributes.png?fit=max\&auto=format\&n=unfRSXbmQkdGxJjN\&q=85\&s=1b71e0564cf5ffc5029aa6dc6c3a8962)

The "Manage user attributes" icon.

4. Select **Add Custom Category**.
5. Name the custom category whatever you like. The example below uses **LaunchDarkly Attributes**.
6. Add the `role`, `customRole`, and `teamKey` fields:

![The "LaunchDarkly Attributes" screen.](https://mintcdn.com/launchdarkly/unfRSXbmQkdGxJjN/images/__third_party/google-ld-attributes.png?fit=max\&auto=format\&n=unfRSXbmQkdGxJjN\&q=85\&s=49a5ae75e65a00af717a5570e003c881)

The "LaunchDarkly Attributes" screen.

> [!TIP]
>
> **Allow multiple values for custom roles and team keys**
>
> Set the **Multiple values** field for `customRole` and `teamKey` to "Yes." Some account members may have more than one custom role or team, which requires multiple values.

## Add LaunchDarkly as a custom SAML application

Next, you must add LaunchDarkly to your Google Workspace apps.

To add LaunchDarkly:

1. Log into Google Workspace.
2. Navigate to **Apps**, then **SAML Apps**.
3. Click the plus button to **Add** an app.
4. Select **Setup my own Custom App** to configure LaunchDarkly. The setup workflow initiates.
5. In step 2 of the workflow, copy the information from the setup workflow. You'll need to add this into LaunchDarkly's **Security** tab under **Edit SAML Configuration**:

![The Google IdP information window.](https://mintcdn.com/launchdarkly/unfRSXbmQkdGxJjN/images/__third_party/google-idp-info.png?fit=max\&auto=format\&n=unfRSXbmQkdGxJjN\&q=85\&s=4954d2c24b49efa022835ee164c22ed4)

The Google IdP information window.

6. In step 3, enter the name of the app.
7. In step 4 of the workflow, provide the **Assertion consumer service URL**, **entity ID**, and **start URL** for your LaunchDarkly account:

![LaunchDarkly's service provider details.](https://mintcdn.com/launchdarkly/unfRSXbmQkdGxJjN/images/__third_party/google-ld-service-provider-details.png?fit=max\&auto=format\&n=unfRSXbmQkdGxJjN\&q=85\&s=60a391f0855bb27b9bb920694d0cd50b)

LaunchDarkly's service provider details.

To find them, click **Edit your SAML configuration** on the LaunchDarkly **Security** tab:

![LaunchDarkly's SAML Configuration panel.](https://mintcdn.com/launchdarkly/A4UXoRTW8ATNw4yq/images/auto/settings-security-saml-config.auto.png?fit=max\&auto=format\&n=A4UXoRTW8ATNw4yq\&q=85\&s=e669b3620e857aaa1ee7b55e2b24dc5a)

LaunchDarkly's SAML Configuration panel.

8. In step 5, map the LaunchDarkly attributes `firstName` and `lastName` to Google's "First Name" and "Last Name" basic information fields. Map the LaunchDarkly attributes `role`, `customRole`, and `teamKey` to Google's "LaunchDarkly Attributes" fields of the same name. These mappings are shown below:

![The Attribute Mappings screen.](https://mintcdn.com/launchdarkly/unfRSXbmQkdGxJjN/images/__third_party/google-attribute-mapping.png?fit=max\&auto=format\&n=unfRSXbmQkdGxJjN\&q=85\&s=d31a205f6de38fca2f7235021fd09f81)

The Attribute Mappings screen.

> [!CAUTION]
>
> **Names are case sensitive**
>
> In the screenshot above, the names in the left-hand columns map to those present in LaunchDarkly. You must name them exactly as shown, including exact casing (`role`, `customRole`, and `teamKey`), or configuration will fail.

You've successfully connected LaunchDarkly to Google Workspace.

## Assign roles, custom roles, and teams with Google Workspace

Now that the application is configured, you can assign roles and teams.

To assign roles and teams:

1. Log into Google Workspace.
2. Navigate to **Directory**, then **Users**.
3. Click on the Google Workspace user that you want to assign roles to and choose **Account** to bring up the user's account settings.
4. Click **Edit** beneath "Manage user attributes" to add the user's roles and teams to the corresponding attribute fields:

![The "Update User" screen.](https://mintcdn.com/launchdarkly/unfRSXbmQkdGxJjN/images/__third_party/google-update-user.png?fit=max\&auto=format\&n=unfRSXbmQkdGxJjN\&q=85\&s=b7894cc9e3016e25498e1bf1063bc605)

The "Update User" screen.

5. Click **Update User.**

The next time this user logs into LaunchDarkly through Google Workspace, their roles and teams will update. If this is a brand new LaunchDarkly account member, an account will be created automatically with the roles and teams you specified.

> [!NOTE]
>
> **Removing existing roles and teams**
>
> SAML ignores empty **role**, **customRole**, and **teamKey** fields. To clear all existing roles or teams, enter an empty string "" into the field.