# Integrating Arc XP with Google Workspaces

Source: https://docs.arcxp.com/en/products/arc-xp-administration/permissions/integrating-arc-xp-with-google-workspaces.html

This page explains how to integrate Arc XP with Google Workspace (formerly G Suite) using SAML authentication.

> **Note:**
> 
> This documentation describes a third-party tool. The steps may change over time. Always refer to the tool’s official documentation for the latest instructions.

Google Workspace does now allow passing group affiliations through SAML. Instead, you must create custom text fields and manually enter group information. This process is detailed in Step 3.

## How the integration works

This integration establishes a SAML relationship between Arc XP’s Identity Provider (Okta) and your Google Workspace. When a user attempts to log in to Arc XP:

1. Okta redirects the login request to Google Workspace.
2. The user logs in using their Google Workspace credentials.
3. Google Workspace redirects the user back to Okta.
4. Okta verifies authentication parameters and redirects the user to Arc XP.

## Prerequisites

You must:

- Have admin access to your company’s Google Workspace.
- Have knowledge of how to configure and use Google Workspace.
- Know how the login flow works for your users.
- Know the groups to pass into Arc XP for Permissions (You can update these later.)

## Step 1: Create the Google Workspace SAML app

1. Log in to the Google Workspace Admin panel.
2. Open the **Apps panel**.
3. Select **SAML Apps**.
4. Click **Add App** to create a new app.
5. Name the app **Arc Publishing**, and click **Continue**.
6. Download the **IDP Metadata** and the **certificate**.
7. Save these fields and send them to [Arc XP Customer Support](https://support.arcpublishing.com/).
8. Wait for Arc XP to proceed to the next step.

## Step 2: Configure the app and properties

1. Arc XP sends you two required configuration values:

  - Arc XP Customer Support URL
  - Entity ID
2. Insert these values in the appropriate fields, and click **Continue**.
3. Configure the required attributes:

  - `email` (required)
  - `userName` (required)
  - either `firstName` and `lastName` or `displayName` (we recommend `displayName`)
4. Click **Finish** to complete the setup.

## Step 3: Configure group attributes

Because Google Workspace does not pass group affiliations through SAML, you must manually configure group attributes as follows:

### Create a custom attribute

1. Navigate to the **User** section in Google Workspace.
2. Under the **More** drop-down menu, select **Manage Custom Attributes**.
3. Click **Add Custom Attribute**.
4. Set up the attribute with the following properties:

  - **Category** \- enter a name for the category
  - **Attribute Name** \- enter `groups`
  - **Type** \- choose `text`
  - **Mutiple Values** \- enable this option

### Map the custom attribute to the SAML app

1. Open the **SAML app** in Google Workspace.
2. Select **SAML Attribute Mapping**.
3. Add a new attribute mapping for `groups`.
4. Enter the appropriate group names as text values.

After you set and map the custom attribute, users can authenticate through Google Workspace, and Arc XP recognizes their assigned groups for permissions.