Docs / Identity / Google Workspace

Google Workspace integration

Use Google Workspace as OIDC identity authority, then map roles and sync directory data into gVner AI.

1. Register Google provider (OIDC)

In Google Cloud Console, create an OAuth client for your gVner AI deployment and collect the client ID.

POST /sso/providers { "tenant_id": "acme", "provider_id": "google-workspace", "provider_type": "oidc", "issuer": "https://accounts.google.com", "client_id": "<google_oauth_client_id>", "metadata_url": "https://accounts.google.com/.well-known/openid-configuration", "enabled": true, "test_secret": "<temporary_test_secret>" }

2. Map external groups to gVner AI roles

Create role

POST /identity/roles { "tenant_id": "acme", "role_id": "gw_admin", "allowed_capabilities": ["manage_tenant", "define_policy", "view_audit"] }

Map Google group

POST /identity/role-map { "tenant_id": "acme", "external_role": "gvner-admins@yourdomain.com", "role_id": "gw_admin" }

3. Issue governed SSO session

POST /sso/session { "tenant_id": "acme", "provider_id": "google-workspace", "subject": "user@yourdomain.com", "email": "user@yourdomain.com", "roles": ["gvner-admins@yourdomain.com"], "sso_token": "<temporary_test_secret>", "mfa_ok": true }
Returns 200 and sets GVNER_AI_SESSION cookie.
Session issuance is written to identity audit trail.

4. Sync directory data

Use your Google directory export/connector to upsert users and groups into gVner AI.

Upsert user

POST /scim/users { "tenant_id": "acme", "user_id": "user@yourdomain.com", "email": "user@yourdomain.com", "display_name": "Example User", "active": true, "groups": ["gvner-admins@yourdomain.com"] }

Upsert group

POST /scim/groups { "tenant_id": "acme", "group_id": "gvner-admins@yourdomain.com", "display_name": "gVner AI Admins", "members": ["user@yourdomain.com"] }

5. Validate in console

/console/identity/sso/ — provider appears and enabled.
/console/identity/scim/ — users/groups listed.
/console/identity/sessions/ — SSO sessions visible.
/console/identity/ledger/ — provider, session, and SCIM sync events in audit.