Connecting Google Workspace to Landfall

Two independent connections, both configured from Landfall's Settings → Security screen: Google as your organization's sign-in provider (OIDC via Google Cloud), and Google as the source of truth for who's on your team — Google Workspace's provisioning is delivered through third-party SCIM apps installed from the Google Workspace Marketplace, since Workspace has no built-in generic outbound SCIM connector the way Okta or Entra ID do.

What you'll need

• A Google Cloud project linked to your Workspace domain (or the ability to create one).
• Google Workspace super admin access, to install a Marketplace app for SCIM.
• An admin seat on your Landfall organization.

Part 1 — Sign-in (OIDC)

1. Google Cloud Console → APIs & Services → OAuth consent screen

   Configure the consent screen for your organization (Internal, if you only want your own Workspace domain to sign in) before creating credentials.

2. APIs & Services → Credentials → Create Credentials → OAuth client ID

   Choose Web application. Open Landfall's Settings → Security → Single sign-on panel first for the exact redirect URI to add under Authorized redirect URIs:

   https://<your-landfall-domain>/o/<your-org-slug>/auth/sso/callback

   console.cloud.google.com/apis/credentials

   🖼Google Cloud Console's "Create OAuth client ID" form with the redirect URI field.

3. Copy the client ID and secret, paste them into Landfall

   Google's issuer is fixed: https://accounts.google.com. Fill in Landfall's panel with a display name (e.g. "Google Workspace"), that issuer, the client ID, and the client secret, then save.

4. Run a test sign-in, then activate

   Click Run a test sign-in, complete it as yourself with a Workspace account, then Activate for everyone.

Part 2 — User provisioning (SCIM)

Google Workspace does not ship a generic "point this at any SCIM base URL" screen the way Okta and Entra ID do. Reach Landfall's SCIM endpoint through a Marketplace SCIM bridge app (several are published specifically for connecting Workspace's directory to a third-party SCIM 2.0 endpoint), which relays Workspace's own directory sync to Landfall.

1. Enable SCIM in Landfall first

   In Landfall's Settings → Security → SCIM provisioning panel, click Enable SCIM. Copy the base URL and the one-time bearer token — every SCIM bridge app asks for exactly these two values.

2. Google Workspace Admin console → Apps → Google Workspace Marketplace apps

   Install a SCIM bridge app for your domain and authorize it to read your directory (users and groups) — the specific consent screen depends on which bridge app you choose.

3. Point the bridge app at Landfall

   In the bridge app's own configuration (not a Google admin console screen — this step happens inside the app you just installed), set the target SCIM base URL to the value from Landfall's panel, and set its bearer token field to Landfall's token. It will send Authorization: Bearer <token> on every request.

4. Choose which Workspace groups sync, and map one to a Landfall role (optional)

   Most bridge apps let you scope sync to specific Google Groups rather than the whole directory. To grant a specific role to a synced group, add a matching row in Landfall's SCIM panel (group name → role key); an unmapped group falls back to Landfall's default role, and nothing Google syncs can silently change a mapping you've set — only your own edits in this panel can.

Google Cloud Console / Workspace admin console steps last verified against Google's own documentation: 2026-09-11.