User and group management
The Google Workspace Provisioner synchronizes users and groups from your datastore to Google Workspace. The following describes the behavior of each provisioning capability.
You can configure the following capabilities and specify which users to provision when you get to the Creating a connection part of the setup process. |
Synchronizing existing users
PingFederate synchronizes users based on the Email
attribute in Google Workspace. If a user already exists in your datastore and Google Workspace, mapping this attribute correctly links the two records together.
For example:
-
In Google Workspace, Janet’s
Email
isjsmith@domain.com
. -
In your datastore, Janet’s
mail
isjsmith@domain.com
. -
On the Attribute Mapping tab of your provisioning connection configuration, map the
Email
attribute tomail
. -
When the provisioning connector runs, the datastore user is provisioned with a
Email
ofjsmith@domain.com
. That matches Janet’s existingEmail
in Google Workspace, so her information in the datastore is synchronized to her Google Workspace account.
User provisioning
PingFederate provisions users when any of the following happens:
-
A user is added to the datastore group or filter that is targeted by the provisioning connector.
-
A user with
disabled
status is added to the datastore group or filter that is targeted by the provisioning connector, and the Provision disabled users provisioning option is enabled. This feature is not available in all provisioning connector versions.
You can define which users PingFederate targets for provisioning on the Source Location tab of your provisioning connection configuration.
User updates
PingFederate updates users when a user attribute changes in your datastore.
You can define which attributes PingFederate monitors for changes on the Attribute Mapping tab of your provisioning connection configuration.
User deprovisioning
PingFederate deprovisions users when any of the following happens:
-
A user is deleted from the user store.
-
A user is disabled in the user store.
-
A user is removed from the datastore group or filter that is targeted by the provisioning connector.
The Remove User Action setting in the connection configuration determines whether the deprovisioning action disables or deletes the user.
Synchronizing existing groups
PingFederate synchronizes groups from the datastore to the target service based on the group name.
For example:
-
In Google Workspace, there is a group is named
Accounting
. -
In your datastore, there is a group with a
CN
ofAccounting
. -
When the provisioning connector runs, the two groups are synchronized.
Group provisioning
PingFederate provisions groups when a group is added to the datastore filter that is targeted by the provisioning connector.
You can define which groups PingFederate targets for provisioning and monitors for changes on the Source Location tab in your provisioning connection configuration.