Skip to content

Provisioning

The Google Workspace connector supports provisioning, allowing you to create and manage accounts and entitlements in Google Workspace directly from SailPoint.

Prerequisite: Your system is configured for provisioning.

When SailPoint provisions new accounts to the source, it uses the attributes on the Create Account page as instructions or a template for what to include in the account. This page is also referred to as the provisioning policy.

When new access is granted on a source where a user does not already have an account, SailPoint automatically includes account creation in the provisioning. This applies whether provisioning is started from an access request or from an automated role or lifecycle state assignment.

For direct-connect sources, SailPoint automatically creates the account from this configuration. If the source is not configured as a direct-connect source, SailPoint creates and assigns a provisioning task to the source owner and includes the values for the source owner to use in manually creating the account.

Important

This section describes the default Create Account configuration. SailPoint recommends that you work with Services to define a provisioning configuration specific to your company's needs. Be sure to verify large changes to the provisioning policy before implementation. Failure to do so might cause provisioning to fail.

The Google Workspace connector supports all special characters in a password while provisioning.

Default Create Account Attributes

Attributes marked with an asterisk (*) are required.

Attribute Name Description
objectType Type of the account to be created. Default value: User. When creating a Domain, the object type must be domain. When creating a Service Account, the object type must be serviceAccount.
familyName* The user's last name.
givenName* The user's first name.
password* Password for the user account.
primaryEmail* Primary email address of the user.
domainName Name of the domain to create.
projectId The ID of the project that owns the service account.
serviceAccountId Account ID of the service account.
displayName Name for the service account.

Configuring Complex Provisioning Policy Attributes

The Google Workspace connector supports account provisioning with the following multi-valued complex attributes in JSON format:

Complex Attribute Example JSON Input
emails {"address":"test1@google.com","type":"other"}
organizations {"name":"Sailpoint","title":"SysAdmin", "type":"work", "customType":"","department":"DP Operations","location":"Pune"}
phones {"value":"9876123345","type":"mobile"}
relations {"value":"David","type":"brother"}
addresses {"type":"work","streetAddress":"123 James street","locality":"Domino Park","region":"Lake Side","primary":true,"countryCode":"US"}
externalIds {"value":"1234","type":"account"}
ims {"type":"home","protocol":"gtalk","im":"12345","primary":true}
locations {"area": "Mountain View", "buildingId": "D1", "deskCode": "Desk1", "floorName":"First Floor", "floorSection":"B", "type":"desk"}

If you need to set multiple values, separate each value in the JSON input with a comma. For example:

{"address":"user1@google.com","type":"home"}, {"address":"test1@google.com","type":"other"}

The Google Workspace connector supports the aliases multi-valued attribute. Aliases are the user's alias email addresses. The values can be a string or a list of email addresses. The connector also supports special characters in email addresses for entitlement operations.

Note

Ensure that complex attributes are multi-valued in the account schema and provisioning policy. Refer to REST Resource: users in the Google Workspace documentation for more information on JSON representation of complex attributes and values.

The Google Workspace API does not support adding or removing multiple aliases in a single call, so the connector needs a list of values to iterate over each one. The connector requires a Before Provisioning Rule to create a provisioning plan that ensures the alias values are in list format. The following provisioning plan example adds or removes multiple aliases:

{
    "ProvisioningPlan": {
        "AccountRequest": {
            "AttributeRequest": {
                "Value": {
                    "List": {
                        "String": [
                            "GoogleWorkspace1222@example.com",
                            "GoogleWorkspace12230@example.com"
                        ]
                    }
                },
                "name": "aliases",
                "op": "Set"
            },
            "application": "Google workspace",
            "nativeIdentity": "11234567890",
            "op": "Modify"
        },
        "nativeIdentity": "Test.google",
        "targetIntegration": "Google workspace"
    }
}

To add or remove a single alias, use the string format:

{
    "AttributeRequest": {
        "name": "aliases",
        "op": "Set",
        "value": "GoogleWorkspace1222@example.com"
    }
}

Documentation Feedback

Feedback is provided as an informational resource only and does not form part of SailPoint’s official product documentation. SailPoint does not warrant or make any guarantees about the feedback (including without limitation as to its accuracy, relevance, or reliability). All feedback is subject to the terms set forth at https://developer.sailpoint.com/discuss/tos.