# Google oAuth2 SSO / Role Mapper for Google GSuite Groups **URL:** \ **Category:** Getting advice\ **Created:** [February 26, 2020, 8:39am UTC](https://forum.keycloak.org/t/google-oauth2-sso-role-mapper-for-google-gsuite-groups/1402 "2020-02-26T08:39:21Z")\ **Posts on this page:** 9\ **Page:** 1
**Author:** ![rowi1de](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/rowi1de/32/334_2.png) [@rowi1de](https://forum.keycloak.org/u/rowi1de)\ **Post date:** [February 26, 2020, 8:39am UTC](https://forum.keycloak.org/t/google-oauth2-sso-role-mapper-for-google-gsuite-groups/1402/1 "2020-02-26T08:39:21Z")
I’m using Google SSO / OIDC / oAuth2 in Keycloak 7.0.1. The default claims are ``` [0me[32m08:31:31,360 DEBUG [org.keycloak.social.user_profile_dump] (default task-229) User Profile JSON Data for provider google: ``` { “sub”: “108120107908467602929”, “name”: “Robert”, “given\_name”: “Robert”, “family\_name”: “…”, “picture”: “[https://lh3.googleusercontent.com/](https://lh3.googleusercontent.com/)…”, “email”: “robert@…”, “email\_verified”: true, “locale”: “en-GB”, “hd”: "… } We are using GSuite Groups. I would like to use the Keycloak Attribute Importer to Map Groups from Google to Keycloak roles. I set the Default Scopes to “openid profile email [https://www.googleapis.com/auth/admin.directory.group.readonly](https://www.googleapis.com/auth/admin.directory.group.readonly)” The consent screen in google also contains that scope. The SSO Works using this setup, but the claims are the same in the response. Is it possible to get additional claims via Configuration? Seems like google would return it to use, when “include\_granted\_scopes=true” is Set. Just have to figure out how to do it in keycloak. ---
**Author:** ![rajith77](https://avatars.discourse-cdn.com/v4/letter/r/ce73a5/32.png) [@rajith77](https://forum.keycloak.org/u/rajith77)\ **Post date:** [July 14, 2020, 9:31pm UTC](https://forum.keycloak.org/t/google-oauth2-sso-role-mapper-for-google-gsuite-groups/1402/2 "2020-07-14T21:31:25Z")
Did you end up figuring this out? ---
**Author:** ![rowi1de](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/rowi1de/32/334_2.png) [@rowi1de](https://forum.keycloak.org/u/rowi1de)\ **Post date:** [July 15, 2020, 5:50am UTC](https://forum.keycloak.org/t/google-oauth2-sso-role-mapper-for-google-gsuite-groups/1402/3 "2020-07-15T05:50:23Z")
Our conclusion is: won’t work with OIDC Google SSO, will need to switch to SAML But it’s not implemented yet ---
**Author:** ![rajith77](https://avatars.discourse-cdn.com/v4/letter/r/ce73a5/32.png) [@rajith77](https://forum.keycloak.org/u/rajith77)\ **Post date:** [October 10, 2020, 3:08pm UTC](https://forum.keycloak.org/t/google-oauth2-sso-role-mapper-for-google-gsuite-groups/1402/4 "2020-10-10T15:08:24Z")
@rowi1de In case you are still interested, we managed to get this working with OIDC. This can’t be done via the UserInfo endpoint (even when the scope is provided) due to groups being part of the admin SDK. We solved this by creating a protocol mapper that fetches and adds it to the claims. The protocol mapper will need to use the admin SDK and set up a service account to make the required API call. ---
**Author:** ![rowi1de](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/rowi1de/32/334_2.png) [@rowi1de](https://forum.keycloak.org/u/rowi1de)\ **Post date:** [October 13, 2020, 5:57am UTC](https://forum.keycloak.org/t/google-oauth2-sso-role-mapper-for-google-gsuite-groups/1402/5 "2020-10-13T05:57:05Z")
@rajith77 thanks for asking. This would have been the alternative. I wonder why this is not available in Keycloak by default for google SSO. ---
**Author:** ![rajith77](https://avatars.discourse-cdn.com/v4/letter/r/ce73a5/32.png) [@rajith77](https://forum.keycloak.org/u/rajith77)\ **Post date:** [October 13, 2020, 6:01pm UTC](https://forum.keycloak.org/t/google-oauth2-sso-role-mapper-for-google-gsuite-groups/1402/6 "2020-10-13T18:01:01Z")
Fair point. I’m sure there must be other folks who are interested in the same. ---
**Author:** ![haohaolee](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/haohaolee/32/1724_2.png) [@haohaolee](https://forum.keycloak.org/u/haohaolee)\ **Post date:** [November 28, 2020, 10:24am UTC](https://forum.keycloak.org/t/google-oauth2-sso-role-mapper-for-google-gsuite-groups/1402/7 "2020-11-28T10:24:55Z")
Hi, I am interested i this as well, is there any sample code I can learn from to create a protocol mapper? Thanks ---
**Author:** ![aim0n](https://avatars.discourse-cdn.com/v4/letter/a/e5b9ba/32.png) [@aim0n](https://forum.keycloak.org/u/aim0n)\ **Post date:** [February 16, 2021, 6:15am UTC](https://forum.keycloak.org/t/google-oauth2-sso-role-mapper-for-google-gsuite-groups/1402/8 "2021-02-16T06:15:29Z")
Hello, @rajith77! We also want to get additional details from Google (set as our IDP in Keycloak), for example, the Department field. Will you be able to provide more details on the solution that you guys took? Thank you in advance! ---
**Author:** ![marcportabellaclotet](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/marcportabellaclotet/32/6744_2.png) [@marcportabellaclotet](https://forum.keycloak.org/u/marcportabellaclotet)\ **Post date:** [October 8, 2022, 9:36am UTC](https://forum.keycloak.org/t/google-oauth2-sso-role-mapper-for-google-gsuite-groups/1402/9 "2022-10-08T09:36:26Z")
It would be great if you could share more details about this custom mappper. We are facing the same issue, and we would be very greatefull if you can point us to the right direction. Would it be possible to share the mapper code? Thanks in advance @rajith77