> ## Documentation Index
> Fetch the complete documentation index at: https://docs.cloud.cdata.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Google Workspace SSO Troubleshooting

> Common questions and issues when configuring Google Workspace as your SSO provider for Connect AI, with suggested solutions.

<Note>
  Connect AI uses Auth0 as its managed identity broker. You configure the SAML app, attribute mappings, and access in the Google Admin console; steps that refer to the Auth0 tenant, the connection's certificate, or Rules and Actions are configured by CData on the broker side. If one applies to your issue, contact [CData Support](https://www.cdata.com/support/submit.aspx).
</Note>

## Common Errors

<AccordionGroup>
  <Accordion title="No email or NameID is found in the assertion.">
    * In Google, set the Name ID to the user's Primary email.
    * Review the attribute mappings so that email and given\_name are sent and named as the broker expects.
  </Accordion>

  <Accordion title="The certificate is rejected or invalid.">
    Make sure Google's X.509 certificate was copied in full, including the header and footer lines:

    ```
    -----BEGIN CERTIFICATE-----
    The body of the certificate
    -----END CERTIFICATE-----
    ```

    Uploading Google's metadata XML instead, when that option is offered, avoids copy-and-paste mistakes. Because the certificate is held on the broker side, contact [CData Support](https://www.cdata.com/support/submit.aspx) if it needs to be replaced.
  </Accordion>

  <Accordion title="Users cannot open the app.">
    In the Google Admin console, confirm the SAML app is turned on for the users or organizational units that need access.
  </Accordion>

  <Accordion title="The redirect fails after sign-in.">
    * Confirm the ACS URL set in Google matches the callback URL exactly. It follows this pattern, where the tenant and connection name are the values CData provides when SSO is enabled: `https://<AUTH0-TENANT>.auth0.com/login/callback?connection=<CONNECTION_NAME>`
    * Check that the Entity ID in Google matches the value the broker expects.

    If you do not have the exact values, contact [CData Support](https://www.cdata.com/support/submit.aspx).
  </Accordion>
</AccordionGroup>

To enable SSO for your account or for additional help, contact [CData Support](https://www.cdata.com/support/submit.aspx).