Setup Guide - Google Workspace (GSuite) SAML SSO

What this guide covers

• Creating a Custom SAML App in Google Workspace for LinearB
• Configuring SAML settings (ACS URL, Entity ID, NameID)
• Connecting Google → LinearB via SSO settings
• Testing the SSO login flow
• Enforcing SSO for your organization

Before you begin

• Google Admin privileges
• LinearB Admin role
• LinearB SSO Settings page open (Settings → Authentication / SSO)

1. Go to admin.google.com → Apps.
2. Select Web and mobile apps.
3. Click Add App → Add Custom SAML App.
4. Name the app LinearB and upload an icon (optional).
5. Click Continue.

On the Google “Step 2: Google Identity Provider details” page:

• Copy the SSO URL
• Copy the Entity ID
• Download the X.509 certificate

Keep Google Admin open — you’ll return after configuring LinearB.

Use your LinearB values to configure Google’s SAML parameters.

Required settings

• ACS URL (Single Sign-On URL):
  Copy Single Sign-On URL from your LinearB SSO page.
• Entity ID (Audience):
  https://app.linearb.io/login
• Name ID Format: EMAIL (default)
• Name ID: Basic Information → Primary email

Example screenshot

1. Paste your LinearB ACS URL into the Google field.
2. Enter the Entity ID exactly as shown above.
3. Leave NameID as Primary Email.
4. Click Continue.

Attribute mapping is optional and not required for LinearB access. If your company requires additional identity claims, map them here.

To allow users to log in:

1. Navigate to the new LinearB SAML app.
2. Click User Access.
3. Choose the organizational units or groups.
4. Set access to ON.

You may start with a pilot group to validate configuration.

Return to LinearB → Settings → Authentication / SSO.

Fill in the following fields using Google IdP values:

• Identity Provider Issuer → Google’s Entity ID
• Identity Provider SSO URL → Google’s SSO URL
• X.509 Certificate → paste entire certificate
• Organization email domain → your domain (e.g. company.com)

Click Save and then enable the toggle for SAML Authentication.

Optional: Enforce SSO

To require login via Google SSO only:

Enable the checkbox:
“Team members will only be able to access LinearB using your SSO provider.”

Test from Google Workspace:

1. Open the Google App Launcher.
2. Click the LinearB SAML app tile.
3. You should be logged in automatically.

Test from LinearB login screen:

1. Go to app.linearb.io.
2. Click Sign in with SSO.
3. Enter your email and follow the Google redirect.

Expected result: You are returned to LinearB and signed in successfully.

Common issues

• “Invalid Entity ID” Ensure Google’s “Entity ID” is exactly https://app.linearb.io/login.
• Certificate mismatch Make sure the full X.509 certificate from Google is pasted into LinearB.
• SSO loop / unexpected logout Double-check the ACS URL in Google matches the LinearB “Single Sign-On URL”.
• User unauthorized Confirm:
  • They are assigned to the LinearB SAML app in Google, and
  • Their Google email matches the LinearB user email.

Still stuck? contact support

Does LinearB require SCIM for Google?
No — SCIM is optional and primarily for Okta. Google SSO works without SCIM.

What roles do new SSO users get?
New users created through SSO start as Viewer by default.

Can we use multiple SAML providers?
No. Only one SSO configuration can be active per LinearB organization.