# Google SSO without group mapping

**URL:** <https://forum.pritunl.com/t/google-sso-without-group-mapping/2148>\
**Category:** Pritunl VPN\
**Created:** [July 2, 2024, 9:54pm UTC](https://forum.pritunl.com/t/google-sso-without-group-mapping/2148 "2024-07-02T21:54:03Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![timansky](https://forum.pritunl.com/user_avatar/forum.pritunl.com/timansky/32/843_2.png) [@timansky](https://forum.pritunl.com/u/timansky)\
**Post date:** [July 2, 2024, 9:54pm UTC](https://forum.pritunl.com/t/google-sso-without-group-mapping/2148/1 "2024-07-02T21:54:03Z")

</div>

Hi  
What is correct way to apply google SSO but with out trying to map groups.  
I’ve enabled google. But for mapping i’m using custom script and do not want to map google to any another group.

app.sso\_google\_mode = “org”  
app.sso\_google\_key is set

---

<div class="post-metadata">

**Author:** ![zach](https://forum.pritunl.com/user_avatar/forum.pritunl.com/zach/32/1105_2.png) [@zach](https://forum.pritunl.com/u/zach)\
**Post date:** [July 3, 2024, 1:52pm UTC](https://forum.pritunl.com/t/google-sso-without-group-mapping/2148/2 "2024-07-03T13:52:54Z")

</div>

The groups mode can be used for more complex cases where multiple groups are needed. To do this delete all the organizations and create one organization. Set this organization as the default single sign-on organization in the top right settings then attach the organization to all servers. Then run the commands below with the quotes as shown. In each of the server settings add the groups that will be able to access that server. This can result in larger usage of IP address pools. Every user that is attached to a server will have a static IP assigned even if a group is not matched. The server virtual network subnet size should allow for this. For SAML attribute groups is used to set a comma separated list of groups.

```auto
sudo pritunl set app.sso_azure_mode '"groups"'
sudo pritunl set app.sso_authzero_mode '"groups"'
sudo pritunl set app.sso_google_mode '"groups"'

```

---

<div class="post-metadata">

**Author:** ![timansky](https://forum.pritunl.com/user_avatar/forum.pritunl.com/timansky/32/843_2.png) [@timansky](https://forum.pritunl.com/u/timansky)\
**Post date:** [July 3, 2024, 3:45pm UTC](https://forum.pritunl.com/t/google-sso-without-group-mapping/2148/3 "2024-07-03T15:45:35Z")

</div>

Yes we already have one organization and access to servers splitted by groups. As i understand correctly if i set **app.sso\_google\_mode '“groups”** server won’t be searching Google groups and tying to add them to a list that our plugin returns?

---

<div class="post-metadata">

**Author:** ![zach](https://forum.pritunl.com/user_avatar/forum.pritunl.com/zach/32/1105_2.png) [@zach](https://forum.pritunl.com/u/zach)\
**Post date:** [July 4, 2024, 2:34pm UTC](https://forum.pritunl.com/t/google-sso-without-group-mapping/2148/4 "2024-07-04T14:34:08Z")

</div>

The single sign-on groups will be copied to the user groups in Pritunl. The plugin handles will be provided with the groups and can return a modified list of groups.

---

<div class="post-metadata">

**Author:** ![timansky](https://forum.pritunl.com/user_avatar/forum.pritunl.com/timansky/32/843_2.png) [@timansky](https://forum.pritunl.com/u/timansky)\
**Post date:** [July 5, 2024, 6:52am UTC](https://forum.pritunl.com/t/google-sso-without-group-mapping/2148/5 "2024-07-05T06:52:20Z")

</div>

I understand this. Main problem is that **sso\_authenticate** group variable (sso\_group\_names) is addon group (it is empty on call). This group merges with the google groups later