Provisioning Login ID from Google Workspace

Overview

FUYL.io supports mapping attributes from Google Workspace to a Login ID, including nested values, as long as they are not part of an array. This guide is intended to be used as a companion to the documentation already present while provisioning within FUYL.io, but further describes how to access and use a nested attribute as the users' Login ID.

Steps to Map a Nested Attribute in Google Workspace

1. Identify the full attribute path

Here is an example of a user from a Google Workspace account in both visual (GUI) and object form (some attributes are truncated for brevity):

{
  "id": "123456789012345678901",
  "name": {
    "fullName": "John Doe",
    "givenName": "John",
    "familyName": "Doe"
  },
  "emails": [
    {
      "address": "john.doe@example.com",
      "primary": true
    },
    {
      "address": "user.alias1@example.com"
    }
  ],
  "phones": [
    {
      "type": "work",
      "value": "+1234567890"
    }
  ],
  "customerId": "ID_Example",
  "primaryEmail": "john.doe@example.com",
  "customSchemas": {
    "ExternalIDs": {
      "FUYL_Login_ID": "123456781"
    }
  }
}

In this instance the attribute required for Login ID authentication with FUYL is called FUYL_Login_ID, a custom attribute added to users in this directory. FUYL.io uses $ to represent the root of the user object, then the rest of the path to FUYL_Login_ID is traversed by nested layer;

$.customSchemas.ExternalIDs.FUYL_Login_ID

Note that attributes within arrays (e.g. $.emails[0].address) cannot be used as the position of elements in an array is not guaranteed during provisioning.

2. Use this path in FUYL.io

1. Sign in to FUYL.io as an administrator
2. Go to Settings > Users > Provisioning (Configure) and follow instructions to link with Google Workspace
3. When prompted for Login ID attribute mapping, use the path as determined above:
   
4. Complete the provisioning configuration as required.

Testing

After mapping your Login ID field, wait for the next automatic sync cycle from Google Workspace (typically every 40–60 minutes), or trigger a manual sync in the provisioning interface.

If after 2 hours users are unable to authenticate using their Login ID, contact support for assistance with verifying schema data and mapping syntax.

<- Back to Planning your Identity and Authentication