Skip to main content
Deutsch (Deutschland) Español Français Hebrew (Israel) Italiano Português

Google Workspace (GSuite) SAML SSO

Heather Hazell
Updated

Use this guide to configure SAML SSO between Google Workspace and LinearB so your team can authenticate using corporate Google accounts.

Overview

What this guide covers

  • Creating a Custom SAML App in Google Workspace for LinearB
  • Configuring SAML settings (ACS URL, Entity ID, NameID)
  • Connecting Google → LinearB via SSO settings
  • Testing the SSO login flow
  • Enforcing SSO for your organization

Before you begin

  • Google Admin privileges
  • LinearB Admin role
  • LinearB SSO Settings page open (Settings → SSO)

1. Create the LinearB SAML app in Google Admin

  1. Go to admin.google.com → Apps.
  2. Select Web and mobile apps.
  3. Click Add App → Add Custom SAML App.
  4. Name the app LinearB and upload an icon (optional).
  5. Click Continue.

2. Download IdP metadata to use in LinearB

On the Google “Step 2: Google Identity Provider details” page:

  • Copy the SSO URL
  • Download the X.509 certificate

Keep Google Admin open — you’ll return after configuring LinearB.

3. Configure SAML settings for LinearB in Google

Use your LinearB values to configure Google’s SAML parameters.

Required settings

  • ACS URL (Single Sign-On URL): 
    Copy Single Sign-On URL from your LinearB SSO page.
  • Entity ID (Audience): 
    https://app.linearb.io/login
  • Name ID Format: EMAIL (default)
  • Name ID: Basic Information → Primary email
  1. Paste your LinearB ACS URL into the Google field.
  2. Enter the Entity ID exactly as shown above.
  3. Leave NameID as Primary Email.
  4. Click Continue.

4. Add Attribute Statements (optional)

Attribute mapping is optional and not required for LinearB access. If your company requires additional identity claims, map them here.

5. Enable the app for users

To allow users to log in:

  1. Navigate to the new LinearB SAML app.
  2. Click User Access.
  3. Choose the organizational units or groups.
  4. Set access to ON.

You may start with a pilot group to validate configuration.

6. Configure SSO in LinearB

Return to LinearB → Settings → SSO.

Fill in the following fields using Google IdP values:

  • Identity Provider Issuer → Google’s Entity ID
  • Identity Provider SSO URL → https://app.linearb.io/login
  • X.509 Certificate → paste entire certificate
  • Organization email domain → your domain (e.g. company.com)

Click Save and then enable the toggle for SAML Authentication.

Optional: Enforce SSO

To require login via Google SSO only:

Enable the checkbox: 
“Team members will only be able to access LinearB using your SSO provider.”

7. Test SSO

Test from Google Workspace:

  1. Open the Google App Launcher.
  2. Click the LinearB SAML app tile.
  3. You should be logged in automatically.

Test from LinearB login screen:

  1. Go to app.linearb.io.
  2. Click Sign in with SSO.
  3. Enter your email and follow the Google redirect.

Expected result: You are returned to LinearB and signed in successfully.

Troubleshooting

“Invalid Entity ID”

Ensure Google’s “Entity ID” is exactly https://app.linearb.io/login.

<

Certificate mismatch

Make sure the full X.509 certificate from Google is pasted into LinearB.

SSO loop / unexpected logout

Double-check the ACS URL in Google matches the LinearB “Single Sign-On URL”.

User unauthorized

Confirm:

  • They are assigned to the LinearB SAML app in Google, and
  • Their Google email matches the LinearB user email.

FAQs

Does LinearB require SCIM for Google?
No — SCIM is optional and primarily for Okta. Google SSO works without SCIM.

What roles do new SSO users get?
New users created through SSO start as Viewer by default.

Can we use multiple SAML providers?
No. Only one SSO configuration can be active per LinearB organization.

Need assistance?
Please contact support

Next steps:

Related articles