Q3 — Custom Google attribute for username matching (AWS_Username)

[ChrisPates]

Our users have a custom Google Workspace attribute (customSchemas.Single_Sign-On.AWS_Username) that holds their AWS username. For external-domain users this differs from their primary email. What is the exact ssosync flag or config parameter to tell ssosync to use this custom attribute for username matching instead of primary email?

We've seen references to --user-match and AWS_SSO_USER_MATCH in the docs but want to confirm the exact syntax for a custom schema attribute.

[ChrisPates]

Currently, you can't. So a couple of things to unpack:

• external users are explicitly ignored during replication because authentication via SAML is not possible for an external user. If you have this working in Google Workspace I'd be interested in how that is setup because I can certainly imagine scenarios where this would be desirable.
• ssosync only understands the core schema for the user/group/membership objects currently
• ssosync only populates a bare minimum set of attributes even from the core schema. There is a PFR for a attribute mapping capability but no work has really been done.