--- title: "Passport Configuration with Google Workspace" slug: "passport-configuration-with-google-workspace" updated: 2025-07-24T19:06:54Z published: 2025-07-24T19:06:54Z canonical: "support.kandji.io/passport-configuration-with-google-workspace" --- > ## Documentation Index > Fetch the complete documentation index at: https://support.kandji.io/kb/llms.txt > Use this file to discover all available pages before exploring further. # Passport Configuration with Google Workspace ### Before you Begin - Your organization's Google Workspace instance needs to support Secure Lightweight Directory Access Protocol (LDAP). Google has a list of supported licenses for the LDAP service [here](https://support.google.com/a/answer/9100761). - You need access to your organization's super administrator account. - If your web browser automatically uncompresses .zip files, temporarily change that setting and download the file again, or compress the uncompressed folder before you upload it to your Passport library item. ### Create a Secure LDAP Client and Download the Certificate Passport uses Secure LDAP to communicate with Google to confirm login credentials and gather basic user and group information. When you create a new Secure LDAP client in Google Workspace, you'll download a certificate to secure communications and turn the service on. 1. In a web browser, use your organization's super administrator account to sign in to your organization's Google Admin console at [admin.google.com](https://admin.google.com). 2. In the left sidebar, click **Apps**. 3. In the Apps section, click **LDAP** (if LDAP does not appear, it's possible that your organization has the Business Starter or Business Standard editions of Google Workspace, which does not offer Secure LDAP service). 4. If you don't yet have any LDAP clients configured, then click **Add LDAP Client**. If you already have one or LDAP clients configured, then in the upper-right corner, click **Add Client**. ![](https://cdn.document360.io/0844b095-d720-4a7b-bb17-ec97d9bc6e41/Images/Documentation/pb6sstg87fea68dh5cq3bajlsoe9erhb4w.jpg) 5. In the **LDAP client name** field, enter a name like **Kandji Passport**. 6. In the **Description** field, enter a description like **Kandji Passport for keeping Mac passwords in sync with Google passwords**. 7. Click **Continue**. ![](https://cdn.document360.io/0844b095-d720-4a7b-bb17-ec97d9bc6e41/Images/Documentation/ioohqwf1h9riv0nzptus_-9ug3bg1glffq.jpg) 8. In the **Verify user credentials** section, select either **Entire domain**, or if you want to limit Passport to certain accounts, select **Selected organization units, groups, and excluded groups**. 9. In the **Read user information** section, configure the same settings as you did in the previous step. 10. Confirm that the checkbox for **System Attributes** is selected so that Passport can read the default user attributes. 11. Leave the two remaining checkboxes deselected; Passport will not use custom user attributes. ![](https://cdn.document360.io/0844b095-d720-4a7b-bb17-ec97d9bc6e41/Images/Documentation/iuflyee27dgfxwarerleucwwzbwpgzlsvq.jpg) 12. In the **Read group information** section, turn the slider to **On** so you can configure Passport to use a user's Google Workspace group information to dynamically convert their local Mac account between standard and administrator privileges when they log in. You can turn this option on later if you don't turn it on now. 13. Review your configuration, then click **Add LDAP Client**. ![](https://cdn.document360.io/0844b095-d720-4a7b-bb17-ec97d9bc6e41/Images/Documentation/hljvqmrmeevh9xyezdyod2ehqjl8lje1cq.jpg) 14. Click the **Download certificate** link. 15. Click **Continue to Client Details**. ![](https://cdn.document360.io/0844b095-d720-4a7b-bb17-ec97d9bc6e41/Images/Documentation/e_f1cmjotx6yf7kz4exclwun1ebngxvnqa.jpg) 16. In the upper-right corner, click **Off** or the **disclosure triangle** to get to the screen where you can turn on the service. ![](https://cdn.document360.io/0844b095-d720-4a7b-bb17-ec97d9bc6e41/Images/Documentation/xbglsgz-ochwavwjdjwek9xeh9gucoiwqq.jpg) 17. In the **Service status** field, select **On for everyone**. 18. Click **Save**. ![](https://cdn.document360.io/0844b095-d720-4a7b-bb17-ec97d9bc6e41/Images/Documentation/9njk_nitkzgv9jy24v9pyntkwzh1aseftg.jpg) ### Re-download Your Secure LDAP Certificate (optional) After you configure the LDAP client in the previous section, you can always download the certificate that's used to secure the LDAP communication between Passport and Google. There are many other options, including renaming a certificate, generating additional certificates, and deleting a certificate. 1. In a web browser, use your organization's super administrator account to sign in to your organization's Google Admin console at [admin.google.com](https://admin.google.com). 2. In the left sidebar, click **Apps**. 3. In the Apps section, click **LDAP**. 4. In the list of LDAP clients, select the LDAP client you created for use with Passport. 5. Click anywhere in the Authentication section. ![](https://cdn.document360.io/0844b095-d720-4a7b-bb17-ec97d9bc6e41/Images/Documentation/5xeovduiqhj2gvvsgq_5emlrt_6ylv3dww.jpg) 6. In the Certificates section, click the Download button. ![](https://cdn.document360.io/0844b095-d720-4a7b-bb17-ec97d9bc6e41/Images/Documentation/acbi0ycuhy5cjztycqhaqoockmbykrnarq.jpg) - You can leave the Access credentials section blank; Passport doesn't use them in addition to the certificate. ### User account provisioning via Passport > [!NOTE] > If you use **Specify per identity provider group** option in the Passport Library Item, use the Google group email in the **Identity provider group** field. 1. In Google Admin, navigate to the group you want to use. 2. Copy the email prefix, which is everything before the @ symbol, from **Group email**.![](https://cdn.document360.io/0844b095-d720-4a7b-bb17-ec97d9bc6e41/Images/Documentation/Kandji-Support-KB-0844AM.png) 3. In the Kandji Passport Library Item, in the **User provisioning** section, paste the email prefix from the previous section into the **Identity provider group** field. ![](https://cdn.document360.io/0844b095-d720-4a7b-bb17-ec97d9bc6e41/Images/Documentation/Kandji-Support-KB-0956AM@.png) 4. Repeat the previous steps for each additional Google group email you want to use. 5. In the Passport Library Item, click **Save**. ### Library Item Configuration Provide the certificate that you downloaded from Google Workspace. 1. In the **Settings** section, in the **Authentication configuration** section, click **Identity provider** and select **Google Workspace**. ![](https://cdn.document360.io/0844b095-d720-4a7b-bb17-ec97d9bc6e41/Images/Documentation/sqjwjbmpnd4ghovu4vyp-7qpovzin_2wmg.png) 2. In the **Upload certificate from Google Workspace** field, click the link to upload the certificate you downloaded from Google. 3. In the **Choose Files to Upload** window, navigate to the folder that contains your compressed certificate file and select the compressed certificate file. 4. Click **Upload**. 5. If you see the **Validating file** message, wait a few moments for the validation to complete. 6. Confirm that the compressed certificate file is displayed. ![](https://cdn.document360.io/0844b095-d720-4a7b-bb17-ec97d9bc6e41/Images/Documentation/oadgduyyjp5hqu7qv9m_1vgvh_v3lz7vbq.png)