SSO Integration

Google Workspace SSO and Calendar Sync for Peoplifi

Sign in to Peoplifi with your Google Workspace account, auto-provision employees from your Google directory, and sync approved time-off to each employee's Google Calendar. Setup takes 5 minutes using OAuth — no SAML configuration required for basic SSO. For organizations that need SAML or stricter identity controls, we also support SAML 2.0 SSO via the Google Workspace SAML connector.

Try Peoplifi Free for 7 Days

How it works

  1. Admin connects Peoplifi to Google Workspace via OAuth consent
  2. Peoplifi reads the Workspace directory to match Peoplifi employees to Google accounts (by email)
  3. Employees click Sign in with Google on the Peoplifi login page — no password required
  4. When an employee's time-off request is approved, an all-day event is added to their Google Calendar with the configured visibility (free, busy, or public)
  5. Optional: new Google Workspace users can auto-provision as Peoplifi employees with a default role

Features

One-click SSO with Google Workspace via OAuth 2.0 / OpenID Connect
Auto-provisioning of new employees from the Google directory
Approved time-off synced to employee Google Calendars
Company directory import (name, email, department, title, manager)
Domain-restricted login (only @yourcompany.com accounts can sign in)
Per-group role mapping (Peoplifi admin role assigned by Google group membership)
Calendar visibility controls per leave type
SAML 2.0 fallback for organizations that require it

Setup Guide

  1. In Peoplifi, go to Settings → Integrations → Google Workspace
  2. Click Connect to Google and sign in as a Workspace super admin
  3. Approve the requested scopes (directory read, calendar write, profile)
  4. Choose whether to auto-provision new employees from your directory
  5. Enable Sign in with Google on the login screen
  6. Optionally map a Google group (e.g. peoplifi-admins@yourcompany.com) to the Peoplifi Admin role
  7. Optionally restrict login to your verified Google Workspace domain

Frequently Asked Questions

Is this SAML or OAuth?

OAuth 2.0 / OpenID Connect by default — simpler than SAML and works out of the box with Google Workspace. SAML 2.0 is also supported for organizations that require it.

Do we need to be on Google Workspace Business or higher?

No. Any paid Google Workspace plan works, including Business Starter. Free Gmail accounts are not supported.

Will we lose access if Google Workspace is down?

You can still sign in with your Peoplifi password as a fallback. Admins can also force password-only mode during Google outages from Settings → Security.

Can I restrict login to specific Google groups?

Yes. In Peoplifi → Settings → Security → SSO, you can restrict login to members of specific Google groups, denying access to anyone outside those groups.

Does this work with Cloud Identity Free?

Yes, Cloud Identity Free is supported, including the directory sync features.

How does this handle multi-domain Workspaces?

Peoplifi supports multi-domain Workspace setups where the organisation has a primary domain plus alias or secondary domains. Users from any verified domain in the Workspace can SSO into Peoplifi if assigned to the integration.

Can leave events appear in the team's shared calendar?

Yes. Configure a 'team calendar' in Workspace and grant Peoplifi write access. Approved leave will appear on both the employee's primary calendar and the team calendar, supporting team-wide visibility for planning purposes.

Deep dive: Google Workspace

Why Google Workspace SSO matters for US teams

Google Workspace is one of the dominant business productivity suites in the US — particularly common in tech, startups, professional services, and education. For HR-tech adoption, integrating with Workspace SSO provides several material benefits: employees sign in to Peoplifi using existing Workspace credentials (no separate Peoplifi password to manage); auto-provisioning creates Peoplifi accounts automatically when new hires are added to Workspace; deprovisioning suspends Peoplifi access immediately when employees are removed from Workspace; and group-based role mapping lets HR Admins manage Peoplifi permissions through familiar Google groups rather than separate role assignments. The result is reduced password-management friction for employees and tighter security posture for HR.

OAuth 2.0 architecture and security

The integration uses OAuth 2.0 / OpenID Connect, the industry standard for federated authentication. When an employee attempts to sign in to Peoplifi, the application redirects to Google for authentication; Google validates credentials and applies any configured Workspace-level security (2-Step Verification, context-aware access, IP allowlisting, device-trust); on success, Google returns a signed assertion to Peoplifi which validates and creates a session. The user never enters a Peoplifi-specific password. This architecture eliminates password-management overhead, reduces phishing exposure, and ensures access policy is centrally administered through Workspace's security framework. SAML 2.0 fallback is available for organisations preferring the SAML federation standard.

Calendar integration for visibility

Beyond SSO, the integration writes approved leave to employees' Google Calendars supporting team-wide visibility. Configuration options include (1) **Visibility level** — Free/Busy only, public details, or private. (2) **Calendar selection** — primary employee calendar, dedicated team calendar, both. (3) **Event-type configuration** — vacation, sick, personal, parental categorised separately. (4) **Recurring event handling** for ongoing arrangements. (5) **Federal-and-state holidays** — US public holidays and state-specific observances integrated into calendar event creation logic. The calendar visibility supports operational planning (managers can see team availability when scheduling) without requiring employees to manually duplicate leave requests in their calendars.

Auto-provisioning lifecycle automation

Workspace auto-provisioning creates and updates Peoplifi accounts based on Workspace user-lifecycle events. (1) **New hire** — added to Workspace appears in Peoplifi within minutes with name, email, manager, department mapped from Workspace data. (2) **Update** — Workspace profile changes flow to Peoplifi automatically. (3) **Suspension** — Workspace suspension immediately suspends Peoplifi access. (4) **Deletion** — Workspace deletion suspends Peoplifi (data retained per retention policy). For US workforces with frequent organisational changes, this lifecycle automation materially reduces HR-team administrative work and prevents the orphaned-account problem common at less-integrated stacks.

Group-based role mapping and SSO restrictions

Peoplifi supports mapping Google groups to Peoplifi roles. Common patterns: 'HR Admins' Google group → Peoplifi HR Admin role; 'Managers' group → Manager role; 'All Employees' group → standard Employee role. Multi-entity organisations can use entity-specific groups (e.g., 'Engineering-Employees' vs 'Sales-Employees') to apply different access rules. As employees move between groups in Workspace — promotions, department transfers — Peoplifi roles update automatically. SSO restrictions can also limit Peoplifi access to specific Google groups, denying SSO to anyone outside those groups even if they have a Workspace account.

Ready to connect Google Workspace to Peoplifi?

Start free 7-day trial