Google Workspace integration
Sign in to Maskflare with Google Workspace
- Single sign-on with OpenID Connect, for people at an email domain you have verified with a DNS TXT record
- Enforce single sign-on: removes the Maskflare passwords of everyone at that domain, except one break-glass owner you choose
- SAML 2.0 is also available, with the limit described in the notes
- Directory sync (Admin SDK) for groups, departments and job titles: built, console screen not released
If your team uses Google Workspace, people can sign in to the Maskflare console with the account they use all day, under your Google sign-in and two-step verification policies.
Single sign-on works today. Using Workspace groups and departments to scope policy exceptions needs directory sync, which reads them from the Admin SDK. The sync is built in the platform, but the console screen to connect it is not released yet, so it is described below as a limit rather than as a step.
What it does
- Single sign-on with OpenID Connect, for people at an email domain you have verified with a DNS TXT record
- Enforce single sign-on: removes the Maskflare passwords of everyone at that domain, except one break-glass owner you choose
- SAML 2.0 is also available, with the limit described in the notes
- Directory sync (Admin SDK) for groups, departments and job titles: built, console screen not released
Set up Google Workspace with Maskflare
Google Workspace signs people in to the Maskflare console with OpenID Connect. Groups and departments come from directory sync, which is not self-service yet.
Single sign-on
- In the Maskflare console, open Settings, then Single sign-on. Under 1. Verify your domains, enter your email domain and select Add domain, create the DNS TXT record the console shows, then select Verify.
- In the Google Cloud console, create an OAuth client of type Web application (see Google's OpenID Connect guide below). Add the Redirect URI / ACS URL shown under 2. Connect your identity provider in Maskflare as an authorized redirect URI.
- Set the OAuth app's audience to Internal, so only accounts in your Workspace organization can sign in. Copy the Client ID and the Client secret.
- In Maskflare, set Protocol to OpenID Connect. Enter a Name on the sign-in page, choose the Domain, and enter the Discovery URL https://accounts.google.com/.well-known/openid-configuration, the Client ID and the Client secret.
- Select Send people of this domain to the identity provider, then Save identity provider.
- Sign in as a test user. Then, under 3. Enforce single sign-on, choose a Break-glass owner and select Enforce single sign-on. This deletes the Maskflare passwords of everyone at the domain except that owner's.
What data is shared
- At sign-in, Google sends Maskflare the person's email address, first name and last name (the email, given_name and family_name claims), requested with the openid, email and profile scopes.
- Directory sync, when connected, reads each user's email, display name, department, job title, manager's email and active flag, plus group names and memberships. It is read-only: nothing is written to your directory.
- Maskflare sends Google nothing about AI traffic.
- Prompts, files, detected values and traffic metadata are never part of this connection.
Good to know
- SAML 2.0 limit: the console asks for a Metadata URL, and the Google Admin console gives the SAML identity provider metadata as a file to download. To use SAML you would have to host that file at a URL Maskflare can reach. OpenID Connect avoids this.
- Directory sync for Google Workspace uses the Admin SDK with a service account that has domain-wide delegation, the administrator it acts as, and your customer ID. It reads every 15 minutes. The console screen to connect it is not released yet, so it isn't self-service today; ask us about availability.
- Policy exceptions scoped to a directory group or department rely on SCIM or directory sync to know who belongs where. With Google Workspace that means directory sync, so those exceptions are not available to you until it is.
- Maskflare's SCIM endpoint accepts SCIM 2.0 from any client that can push it. Check whether your Google Workspace edition can act as a SCIM client for custom apps before planning around it.
Vendor documentation
Frequently asked questions
Can we use Google Workspace groups for roles?
Not self-service yet. Role mapping from groups uses SCIM, and Google Workspace groups would come from directory sync, whose console screen is not released. Single sign-on works today.
Does it work with SAML?
The console supports SAML 2.0, but it takes a metadata URL and Google provides a downloadable file, so OpenID Connect is the simpler route for Google Workspace.
Who can sign in?
People at the email domain you verified. Set the Google OAuth app's audience to Internal so only accounts in your Workspace organization can use it.
What happens to passwords when we enforce SSO?
The Maskflare passwords of everyone at the domain are deleted, except the break-glass owner's. Turning enforcement off does not restore them.
Other identity integrations
See it on your own data
Try Maskflare free.
Bring your hardest prompts.
28-day free trial or 10,000 requests, whichever comes first. Point one app at the gateway or enroll a few laptops,
and watch what gets masked. Or talk to us first.
- SOC 2 Type II: In progress
- ISO 27001: In progress
- EU hosting by default · on-premises available
- Prompts and files never stored
- Never used to train AI models
- GDPR · nDSG · DPA available
- Trust center →