Skip to main content

Enable Google for SSO

Connect docs via MCP

Configure SAML 2.0 single sign-on so your users sign in to Atlan with their existing Google Workspace credentials. Setup moves metadata in both directions: you copy Atlan's service provider details into a new SAML app in Google Admin Center, collect Google's identity provider metadata during that process, then import it back into Atlan.

Start in Atlan, build and configure the app in Google Admin Center, then return to Atlan to finish. Group sync is optional and covered at the end.

Prerequisites​

Before you begin, make sure you have:

  • Admin access in Atlan. Only admins can configure SSO.
  • Super Administrator access in Google Workspace so you can create a SAML app and manage user access in Google Admin Center.
  • A decision on the default role new users receive on first sign-in (Admin, Member, or Guest). Set it in Set default role for SSO users. Most workspaces use Member.

Get Atlan's service provider details​

Before setting up the app in Google Admin Center, get the two values Atlan provides.

  1. In your Atlan workspace, click Settings from the left menu.

    If you are using the Old UI (Classic), from the left menu, click Admin.

  2. Click SSO.

  3. Click New, then select Google as the provider.

  4. Under Service provider metadata, copy both values: you'll paste them into Google Admin Center later:

    • ACS URL
    • Entity ID

Keep this tab open. You'll return here to finish setup.

Configure in Google Admin Center​

All the app setup happens in the Google Admin Console: create the app, collect the IdP metadata, configure SAML settings, and assign users.

Create SAML app​

In Google Admin Center:

  1. In the left menu, click Apps, then click Web and mobile apps.

  2. Click Add app, then click Add custom SAML app.

  3. Enter a name for the app (for example, Atlan), then click Continue.

Download identity provider metadata​

After clicking Continue, Google shows the Google Identity Provider details page. Download the metadata file here, before moving on:

  1. Click Download metadata to save the GoogleIDPMetadata.xml file to your computer.

  2. Click Continue.

Keep the file somewhere accessible: you'll upload it to Atlan in a later step.

Configure SAML settings​

With the metadata saved, continue through the rest of the app setup:

  1. Under Service provider details, enter the values you copied from Atlan:

    • ACS URL: paste Atlan's ACS URL.
    • Entity ID: paste Atlan's Entity ID.

  2. Click Continue.

  3. Under Attribute mapping, add the following mappings from Google Directory attributes to app attributes:

    • Primary email → email
    • First name → firstName
    • Last name → lastName

  4. (For group sync) Under Group membership (optional), configure the following so Google sends each user's group memberships to Atlan:

    • Search for a group: add each Google group you want to sync. You can add up to 75 groups.
    • App attribute: enter memberOf.

    This is required only if you plan to sync Google groups to Atlan groups.

  5. Click Finish.

Assertion signing

Google Workspace signs the SAML assertion by default when you create a custom SAML app. No additional signing configuration is needed.

Assign users​

Access to the SAML app is controlled by Google org units. From the app's page in Google Admin Center:

  1. Expand User access.

  2. Under Service status, select ON for everyone, or select specific org units to restrict access.

  3. Click Save.

Only users whose service status is ON can sign in to Atlan through Google SSO.

Restrict who gets auto-provisioned

Selecting specific org units here is how you control who gets auto-provisioned in Atlan. Any Google user whose service status is OFF for this app is rejected at sign-in: no Atlan account is created for them.

Connect Google to Atlan​

With the app configured in Google Admin Center, go back to Atlan to finish. Open your Atlan SSO settings (the Google provider you started earlier) and:

  1. Under Identity provider metadata, click Import from XML.

  2. Select the GoogleIDPMetadata.xml file you downloaded from Google.

  3. Click Save.

Your users can now sign in to Atlan with Google. By default, they can still sign in with a local Atlan account too: to require Google, enable Enforce SSO (see below).

Enforce SSO (optional)​

Once Google SSO works, you can disable local email-and-password sign-in so everyone authenticates through Google:

  1. In Atlan, go to Settings → SSO and open your Google provider.

  2. Enable Enforce SSO.

After enforcing SSO, have your Google administrator manage access from Google Admin Center rather than inviting users directly in Atlan. Users with access are provisioned automatically on their first sign-in.

Sync Google groups to Atlan groups (optional)​

Map Google groups to Atlan groups so users land in the right teams automatically on every sign-in.

Before you start:

  • Configure the group membership section with the memberOf app attribute in Google Admin Center when you create the SAML app. Group sync won't work without it.
  • Create the Atlan groups you want to map to first: you can only map to groups that already exist.

To set up the mapping in Atlan:

  1. In Atlan, go to Settings → SSO and open your Google provider.

  2. Switch to the Groups Mapping tab.

  3. For each Atlan group, under the SSO Groups column, type the name of the matching Google group (for example, Data Engineering), then click Save on that row.

Group membership syncs every time a user signs in. If you rename a group in Google, update the mapping in Atlan to match.

note

Google Admin Center supports a maximum of 75 groups in the group membership section of a SAML app. If your organization has more than 75 groups, prioritize the groups that need access control in Atlan.

Once you've configured group mapping, you can add the mapped groups to a persona or purpose to auto-assign permissions as users sign in.

For sync issues, see Troubleshooting SSO.

Need help?​

If users can't sign in or aren't landing in the right groups, see Troubleshooting SSO. Contact Atlan Support if the issue persists.

Next steps​

Now that users can sign in through Google, finish setting up access: