> ## Documentation Index
> Fetch the complete documentation index at: https://doc.quippy-lab.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Google Workspace

> Configure Google Workspace as your Quippy identity provider via SAML 2.0.

Google Workspace SSO is SAML-only for third-party apps — Google's OIDC
implementation is tied to their Workspace sign-in surface rather than an
arbitrary relying party. Use SAML 2.0.

Before you start, grab your **SAML ACS URL** and **SAML Entity ID** from the
**Endpoints for your IdP** card on the Quippy admin portal.

## 1. In Google Workspace

1. Open the [Google Admin console](https://admin.google.com).
2. **Apps → Web and mobile apps → Add app → Add custom SAML app**.
3. Name the app "Quippy". Upload a logo if you like. Continue.
4. **Google Identity Provider details** — click **Download metadata** (you'll
   paste this XML into Quippy) or copy the three fields individually:
   * **SSO URL**
   * **Entity ID**
   * **Certificate** (download the PEM)
5. **Service provider details**:
   * **ACS URL** — the **SAML ACS URL** from Quippy.
   * **Entity ID** — the **SAML Entity ID** from Quippy.
   * **Name ID format** — `EMAIL`.
   * **Name ID** — `Basic Information > Primary email`.
6. **Attribute mapping** — optional, but add any group attributes you plan to
   map to roles (see `Group → role mapping` in the Quippy SSO page).
7. Turn the app **ON for everyone** (or for the relevant OUs).

<Frame>Google Admin console — Add custom SAML app → Service provider details.</Frame>

## 2. In Quippy

In the admin portal's SSO page, pick **SAML 2.0**, then paste:

| Quippy field            | Value from Google                           |
| ----------------------- | ------------------------------------------- |
| **IdP Entry Point**     | **SSO URL** from Google's IdP details       |
| **IdP Entity ID**       | **Entity ID** from Google's IdP details     |
| **Signing Certificate** | The PEM certificate Google let you download |
| **Signature Algorithm** | `SHA-256`                                   |

<Tabs>
  <Tab title="SAML 2.0 (the supported path)">
    Use the mapping above. This is what Google Workspace supports for
    third-party apps.
  </Tab>

  <Tab title="OIDC (not supported here)">
    Google's OIDC endpoints are intended for "Sign in with Google" on consumer
    apps, not for Workspace-managed SSO with group claims. Use SAML instead.
  </Tab>
</Tabs>

## 3. Test connection

Click **Test connection**. Quippy fetches the **IdP Entry Point** and checks
the response looks like SAML metadata (contains `EntityDescriptor` or
`IDPSSODescriptor`).

Once green, enable SSO. [Keep a backup admin](/sso/setup#step-5) until your
first SSO sign-in succeeds.

## Common gotchas

<AccordionGroup>
  <Accordion title="App not turned ON for the user's OU">
    Even with SAML configured, users whose Org Unit doesn't have the app
    enabled will fail sign-in. Toggle the app ON for the relevant OUs.
  </Accordion>

  <Accordion title="Wrong Name ID format">
    Name ID should be `EMAIL` → **Basic Information > Primary email**. If it's
    set to something like "Unique ID", user provisioning in Quippy can fail
    because we match on email.
  </Accordion>

  <Accordion title="Certificate has CRLF line endings">
    Copy the certificate as plain text, PEM-formatted. Editors on Windows
    sometimes introduce `\r\n` line endings that break cert parsing.
  </Accordion>
</AccordionGroup>