> ## Documentation Index
> Fetch the complete documentation index at: https://launchdarkly-preview.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Google Workspace

> This topic explains how to configure Google Workspace to support single sign-on (SSO) in LaunchDarkly.

> For the complete documentation index, see [llms.txt](/llms.txt). For the full documentation snapshot, see [llms-full.txt](/llms-full.txt).

## Overview

This topic explains how to configure Google Workspace to support single sign-on (SSO) in LaunchDarkly.

<Note title="Google OAuth is different from Google Workspace SSO">
  The procedures in this topic explain how to configure SSO for Google Workspace. To learn how to configure Google OAuth instead, read [Google OAuth](/home/account/oauth-google).

  If a member signs in to LaunchDarkly using Google OAuth, they cannot also sign in to the same account using Google Workspace SSO. Similarly, if you invite a member to join a LaunchDarkly account using Google Workspace SSO, they cannot also sign in using Google OAuth.
</Note>

## Prerequisites

To configure SSO for LaunchDarkly using Google Workspace, you must complete the following prerequisite:

* Configure SAML for authentication. For more information, read the [Google knowledge base](https://support.google.com/a/answer/6087519).

Use the table below to configure Google fields for LaunchDarkly:

<table class="fern-table">
  <tr>
    <th>
      Google field
    </th>

    <th>
      LaunchDarkly setting
    </th>
  </tr>

  <tr>
    <td>
      ACS URL
    </td>

    <td>
      Use LaunchDarkly's Assertion Consumer Service URL value.
    </td>
  </tr>

  <tr>
    <td>
      Entity ID
    </td>

    <td>
      Use LaunchDarkly's Entity ID value.
    </td>
  </tr>

  <tr>
    <td>
      Start URL
    </td>

    <td>
      Use LaunchDarkly's Start URL value.
    </td>
  </tr>

  <tr>
    <td>
      Signed Response
    </td>

    <td>
      Check this box.
    </td>
  </tr>

  <tr>
    <td>
      Name ID
    </td>

    <td>
      Select

      <code>Basic Information</code>

      and

      <code>Primary Email</code>

      .
    </td>
  </tr>

  <tr>
    <td>
      Name ID Format
    </td>

    <td>
      Select

      <code>EMAIL</code>

      .
    </td>
  </tr>

  <tr>
    <td>
      Attribute Mapping
    </td>

    <td>
      Enter <code>role</code> as the <code>application attribute</code>, and select the [custom user attribute](https://support.google.com/a/answer/6208725?hl=en) that corresponds to the
      desired role. You will map <code>customRole</code> and <code>teamKey</code> in a later step.
    </td>
  </tr>
</table>

## Configure SSO for Launch

Darkly with Google Workspace

Before you create the LaunchDarkly app in Google Workspace, you must create LaunchDarkly-specific fields for roles, custom roles, and teams.

To configure these fields:

1. Log into Google Workspace.
2. Navigate to your user directory by clicking **Directory** and then **Users**.
3. Click the **Manage user attributes** icon. A popup screen appears:

<Frame caption="The &#x22;Manage user attributes&#x22; icon.">
  ![The "Manage user attributes" icon.](https://files.buildwithfern.com/https://launchdarkly.docs.buildwithfern.com/docs/ae718738d98f745d51c5f46ee81b28cbf902b3d9d45fb780eab8851ce0756318/assets/images/__third_party/google-manage-user-attributes.png)
</Frame>

4. Select **Add Custom Category**.
5. Name the custom category whatever you like. The example below uses **LaunchDarkly Attributes**.
6. Add the `role`, `customRole`, and `teamKey` fields:

<Frame caption="The &#x22;LaunchDarkly Attributes&#x22; screen.">
  ![The "LaunchDarkly Attributes" screen.](https://files.buildwithfern.com/https://launchdarkly.docs.buildwithfern.com/docs/32b9852550182027bcde3a8f0967e9e1594174ef78a3958e2f5a29ba32baf050/assets/images/__third_party/google-ld-attributes.png)
</Frame>

<Tip title="Allow multiple values for custom roles and team keys">
  Set the **Multiple values** field for `customRole` and `teamKey` to "Yes." Some account members may have more than one custom role or team, which requires multiple values.
</Tip>

## Add Launch

Darkly as a custom SAML application

Next, you must add LaunchDarkly to your Google Workspace apps.

To add LaunchDarkly:

1. Log into Google Workspace.
2. Navigate to **Apps**, then **SAML Apps**.
3. Click the plus button to **Add** an app.
4. Select **Setup my own Custom App** to configure LaunchDarkly. The setup workflow initiates.
5. In step 2 of the workflow, copy the information from the setup workflow. You'll need to add this into LaunchDarkly's **Security** tab under **Edit SAML Configuration**:

<Frame caption="The Google IdP information window.">
  ![The Google IdP information window.](https://files.buildwithfern.com/https://launchdarkly.docs.buildwithfern.com/docs/4fba88da32bd345f9985e68f00dc13f90d0720c9538233788aecf964df9b247b/assets/images/__third_party/google-idp-info.png)
</Frame>

6. In step 3, enter the name of the app.
7. In step 4 of the workflow, provide the **Assertion consumer service URL**, **entity ID**, and **start URL** for your LaunchDarkly account:

<Frame caption="LaunchDarkly's service provider details.">
  ![LaunchDarkly's service provider details.](https://files.buildwithfern.com/https://launchdarkly.docs.buildwithfern.com/docs/fcd31cbf3f756c28e9a807142b42ff66ec8d0460c82b986624f047a4e11715ca/assets/images/__third_party/google-ld-service-provider-details.png)
</Frame>

To find them, click **Edit your SAML configuration** on the LaunchDarkly **Security** tab:

<Frame caption="LaunchDarkly's SAML Configuration panel.">
  ![LaunchDarkly's SAML Configuration panel.](https://files.buildwithfern.com/https://launchdarkly.docs.buildwithfern.com/docs/19e44f01015e3aac5e72f5610db6342a723b9163ba33eb38d69b88720146fa6d/assets/images/auto/settings-security-saml-config.auto.png)
</Frame>

8. In step 5, map the LaunchDarkly attributes `firstName` and `lastName` to Google’s "First Name" and "Last Name" basic information fields. Map the LaunchDarkly attributes `role`, `customRole`, and `teamKey` to Google's "LaunchDarkly Attributes" fields of the same name. These mappings are shown below:

<Frame caption="The Attribute Mappings screen.">
  ![The Attribute Mappings screen.](https://files.buildwithfern.com/https://launchdarkly.docs.buildwithfern.com/docs/7eaec17396c6d51e1b681a3e4a47474f7cfb486f11e4aff8dfe079af0ecf78e7/assets/images/__third_party/google-attribute-mapping.png)
</Frame>

<Note title="Names are case sensitive">
  In the screenshot above, the names in the left-hand columns map to those present in LaunchDarkly. You must name them exactly as shown, including exact casing (`role`, `customRole`, and `teamKey`), or configuration will fail.
</Note>

You've successfully connected LaunchDarkly to Google Workspace.

## Assign roles, custom roles, and teams with Google Workspace

Now that the application is configured, you can assign roles and teams.

To assign roles and teams:

1. Log into Google Workspace.
2. Navigate to **Directory**, then **Users**.
3. Click on the Google Workspace user that you want to assign roles to and choose **Account** to bring up the user's account settings.
4. Click **Edit** beneath "Manage user attributes" to add the user’s roles and teams to the corresponding attribute fields:

<Frame caption="The &#x22;Update User&#x22; screen.">
  ![The "Update User" screen.](https://files.buildwithfern.com/https://launchdarkly.docs.buildwithfern.com/docs/3ede8254074a4e5718d4279359f940f0684fdc7d82281e64cce8423b7f8b8502/assets/images/__third_party/google-update-user.png)
</Frame>

5. Click **Update User.**

The next time this user logs into LaunchDarkly through Google Workspace, their roles and teams will update. If this is a brand new LaunchDarkly account member, an account will be created automatically with the roles and teams you specified.

<Note title="Removing existing roles and teams">
  SAML ignores empty **role**, **customRole**, and **teamKey** fields. To clear all existing roles or teams, enter an empty string "" into the field.
</Note>