> For the complete documentation index, see llms.txt.
Skip to main content

Check out Port for yourself ➜ 

Google Workspace

Follow this step-by-step guide to configure the integration between Port and Google Workspace.

Port-Google Workspace integration benefits​

  • Connect to the Port application via your Google Workspace Application.
  • Your Google Workspace teams will be automatically synced with Port upon a user sign-in.
  • Set granular permissions on Port according to your Google Workspace groups.

Create your Google Workspace application​

  1. In the Google Admin Console, in the sidebar menu, navigate to Apps -> Web and mobile apps:

    Google Admin Console Apps navigation with Web and mobile apps highlighted

  2. Click on Add app followed by Add custom SAML app:

    Google Admin Console Add app menu with Add custom SAML app highlighted

  3. Define the initial Port application settings:

    • App name: Insert a name of your choice for the Port app, like Port.

    • Add an App icon (optional):

      Port Logo (click to expand)
      Square multicolor Port icon for the Google Workspace SAML app

    • Press Continue.

      Google Workspace SAML app details with Port as the app name and an app icon upload control

  4. Take note of the following:

    • Your SSO URL.

    • Your Certificate.

      Google Workspace identity provider details with SSO URL, entity ID, certificate, and SHA-256 fingerprint

    Add this in your Custom SAML Self serve SSO Application.
    Press Continue.

  5. Configure your new application as shown below:

    Finding your connection name

    Your connection name follows the format company-<companyID>-SSO. You can find it in the Single Sign-On URL shown during the self-serve SSO setup flow. Look for the connection parameter in the URL.

  • ACS URL (also known as: Single Sign On URL) - https://auth.getport.io/login/callback?connection=company-<companyID>-SSO

  • Entity ID - urn:auth0:port-prod:company-<companyID>-SSO

    Press Continue.

    Google Workspace service provider details with Port ACS URL, entity ID, and primary email Name ID

  1. Create the following mappings (email_verified needs to be a constant for all users, with the value true):

    Google Directory attributes:

    • Primary email -> email
    • First name -> name
    • email_verified -> email_verified

    Google membership (optional): This mapping is only relevant if you wish to pass groups to Port.

    Configure group membership

    Google Workspace does not include group membership in the SAML response by default. In the Google Admin console, navigate to Apps -> Web and mobile apps -> Port -> SAML attribute mapping. Under Group membership (optional), select each Google Group you want to send to Port and set App attribute to groups.

    If you do not configure this section, Port cannot ingest the user's Google Groups during sign-in. For more information, see Google's group membership mapping documentation.

    • Google Groups(list) -> groups

    Press Finish.

    Google Workspace SAML mappings from primary email and first name to Port attributes, plus Google groups to groups

  2. Specify permissions to the application:

    After creating the app, you need to set up permissions for who has access to this application.

    Navigate to your your new application's page, and click User access:

    Port SAML app overview in Google Admin Console with the User access section highlighted

    Then choose from the left side menu, either to enable the app for Everyone, for Groups or for Organizational units.

    Make sure that for any of the options you would like to enable the app for, you check the ON checkbox:

    Google Workspace service status set to ON for the selected developers group

  3. Log in with using your new Google app:

    Google Workspace app launcher with the Port SAML app highlighted
Direct access via URL

After configuring the SSO connection, you can initiate the login flow directly via URL. Use the following URL based on your account region, replacing company-<companyID>-SSO with your actual connection name. You can find your connection name in the Single Sign-On URL shown during the self-serve SSO setup flow - look for the connection parameter in the URL.

https://auth.getport.io/authorize?response_type=token&client_id=96IeqL36Q0UIBxIfV1oqOkDWU6UslfDj&connection=company-<companyID>-SSO&redirect_uri=https%3A%2F%2Fapp.port.io