Integrating Google Workspace with UniFi Fabrics

UniFi Fabrics allow you to centrally manage people and permissions by integrating with Google Workspace as an Identity Provider (IdP). This enables secure, SAML-based authentication and automated user lifecycle management across UniFi services such as WiFi, VPN, and Door Access via the Identity Endpoint app.

For a list of other supported Identity Providers, see Binding an Identity Provider (IdP) To A UniFi Fabric.

Requirement

• A Fabric with Consolidated People Management enabled. For more information, see Getting Started with UniFi Fabrics.
• A supported Google Workspace Subscription: Frontline Standard, Business Plus, Enterprise Standard, Enterprise Plus, Education Fundamentals, Education Standard, Education Plus,  or Enterprise Essentials Plus. 
  • See Compare Google Workspace Editions to learn more.

Set Up Google SAML and Sync Users

1. Go to Site Manager.
2. Select a Fabric.
3. Navigate to Settings > Identity.
4. Enable Consolidated People Management and wait for the Identity Sync Service to set up.
5. Select Microsoft Entra from the list of IdPs to bind.
6. Click Proceed.
7. Sign in to your Google Admin console.
8. Navigate to Apps > Web and mobile Apps > Add app > Add custom SAML app.

3.  Provide the requested app details, and click Continue.

4. Click DOWNLOAD METADATA and click Continue.

5. Paste the ACS URL and Entity ID from UniFi into your Google Admin. 
6. Click FINISH.
7. Go back to UniFi and upload the Google IdP Metadata file and click Apply Changes.
8. Go to Google Admin > Apps > LDAP. If you do not see the LDAP tab, use the search bar to look for LDAP, and open it. 
9. Click Add Client and enter the app name.
10. Grant all Access Permissions: 
    • Tick Entire domain options in Verify user credentials and Read user information fields.
    • Enable Read group information.

11. Click Add LDAP Client.
12. Download the certificate and unzip it. Click CONTINUE TO CLIENT DETAILS.

13. Navigate back to UniFi and upload the certificate and key file.
14. Enter the primary domain, which can be found in Google Admin Console > Account > Domains > Manage domains.

15. Go to Google Admin > Apps > LDAP.
16. Ensure that the Service status is ON.
    
17. Select the client you just created, and click Authentication.
    
18. Click Generate New Credentials.
    
19. Navigate back to UniFi and paste the Username and Password.
20. Select users to be synced and click Next.
21. (Optional) Configure Identity Endpoint Services to streamline how people interact with UniFi services such as WiFi, VPN, and Access Control.