# Google OIDC Attribute Mapping

**URL:** <https://devforum.okta.com/t/google-oidc-attribute-mapping/14210>\
**Category:** Questions\
**Created:** [May 12, 2021, 6:37pm UTC](https://devforum.okta.com/t/google-oidc-attribute-mapping/14210 "2021-05-12T18:37:51Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![jholmes-thoro](https://avatars.discourse-cdn.com/v4/letter/j/b19c9b/32.png) [@jholmes-thoro](https://devforum.okta.com/u/jholmes-thoro)\
**Post date:** [May 12, 2021, 6:37pm UTC](https://devforum.okta.com/t/google-oidc-attribute-mapping/14210/1 "2021-05-12T18:37:51Z")

</div>

I’ve created an IDP for Google using the following scopes:

openid  
profile  
email  
[https://www.googleapis.com/auth/admin.directory.group](https://www.googleapis.com/auth/admin.directory.group)

And expected to be able to map the attribute from the `admin.directory.group` to a field for the General Profile but when I go to add a custom attribute it does not show as an option. Am I missing something?

---

<div class="post-metadata">

**Author:** ![warren](https://avatars.discourse-cdn.com/v4/letter/w/97f17d/32.png) [@warren](https://devforum.okta.com/u/warren)\
**Post date:** [May 12, 2021, 8:33pm UTC](https://devforum.okta.com/t/google-oidc-attribute-mapping/14210/2 "2021-05-12T20:33:28Z")

</div>

On the Identity Providers page, if you click on Configure → Edit Profile and Mappings did you create a custom attribute to map to the claim returned by that scope? I believe the “External name” needs to match the name of the claim in the id token.

---

<div class="post-metadata">

**Author:** ![jholmes-thoro](https://avatars.discourse-cdn.com/v4/letter/j/b19c9b/32.png) [@jholmes-thoro](https://devforum.okta.com/u/jholmes-thoro)\
**Post date:** [May 12, 2021, 10:11pm UTC](https://devforum.okta.com/t/google-oidc-attribute-mapping/14210/3 "2021-05-12T22:11:04Z")

</div>

![image](https://global.discourse-cdn.com/oktadev/original/2X/b/bc8ded8df81f5cdda16e8ed88757477cc918a8b2.png)  
I think this is the issue I’m experiencing. I don’t see it as an option or is this the wrong area?

---

<div class="post-metadata">

**Author:** ![warren](https://avatars.discourse-cdn.com/v4/letter/w/97f17d/32.png) [@warren](https://devforum.okta.com/u/warren)\
**Post date:** [May 12, 2021, 11:10pm UTC](https://devforum.okta.com/t/google-oidc-attribute-mapping/14210/4 "2021-05-12T23:10:13Z")

</div>

Looks like when you use the Google social identity provider you’re stuck with a limited list of attributes.

You can try setting up a generic OIDC identity provider which will allow you to add custom attributes.  
[https://developer.okta.com/docs/guides/add-an-external-idp/openidconnect/configure-idp-in-okta/](https://developer.okta.com/docs/guides/add-an-external-idp/openidconnect/configure-idp-in-okta/)

---

<div class="post-metadata">

**Author:** ![jholmes-thoro](https://avatars.discourse-cdn.com/v4/letter/j/b19c9b/32.png) [@jholmes-thoro](https://devforum.okta.com/u/jholmes-thoro)\
**Post date:** [May 14, 2021, 2:54pm UTC](https://devforum.okta.com/t/google-oidc-attribute-mapping/14210/5 "2021-05-14T14:54:47Z")

</div>

Thanks, this gives me the flexibility that I was looking for so now it looks like I need to start digging into a way to map values to the `userinfo` endpoint from Google into the Okta User Profile. Specifically I’m looking into trying to get Roles and Groups. If anyone has information I would appreciate it.

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/oktadev/original/1X/589c4c5f80de422d01f47cee7185a7fb8227835c.png) [@system](https://devforum.okta.com/u/system)\
**Post date:** [May 17, 2021, 1:09pm UTC](https://devforum.okta.com/t/google-oidc-attribute-mapping/14210/6 "2021-05-17T13:09:08Z")

</div>

This topic was automatically closed 24 hours after the last reply. New replies are no longer allowed.