From 6e84678be36f48413e9775305fe0cf26feefa85c Mon Sep 17 00:00:00 2001 From: Lazare-42 Date: Thu, 13 Aug 2026 22:25:47 +0200 Subject: [PATCH 1/2] docs(meet-sso): warn about first-login/SSO-scope ordering deadlock MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit An account already covered by the Legacy SSO profile cannot complete its first interactive login (Google routes it to the bot IdP), which deadlocks Step 3.2 — hit by a customer on the recommended dedicated- domain path. Add ordering warnings, the temporary-exclusion escape hatch, and document the incognito routing check with its expected error page. Co-Authored-By: Claude Fable 5 --- .../docs/api-v2/authenticated-bots/meet/setup.mdx | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/content/docs/api-v2/authenticated-bots/meet/setup.mdx b/content/docs/api-v2/authenticated-bots/meet/setup.mdx index 0ea0dca..42bd32a 100644 --- a/content/docs/api-v2/authenticated-bots/meet/setup.mdx +++ b/content/docs/api-v2/authenticated-bots/meet/setup.mdx @@ -172,6 +172,10 @@ Set **Select SSO profile** to **Legacy SSO profile**, then click **Override** (o Assign the profile to the bot group/OU **only**. Never assign it to a scope that contains real users, or they will be redirected through the bot IdP. Changes take a few minutes to take effect. + + +**Complete each bot account's first login *before* it enters this SSO scope** (see [Step 3](#step-3--prepare-the-workspace-users)). Once an account is covered by the profile, Google routes *every* sign-in — including the very first one — to the Meeting BaaS IdP, which only bots can complete. A human can then no longer finish the "Welcome to Workspace" flow. If you scoped a whole domain (the recommended dedicated-domain setup), assign the profile **after** preparing the users, or temporarily exclude an account while you complete its first login. + @@ -184,6 +188,14 @@ For **each** Google account the bots will sign in as: 2. Sign in to that account once interactively and complete the **"Welcome to Workspace"** flow. This first-time interactive login is required before the account can be used programmatically — skipping it causes the login to flip to `invalid` on first use. 3. Set the account language to **English (United States)** to ensure the sign-in and Meet UIs are in the expected state. + +**Do the interactive first login while the account is *not yet* covered by the Legacy SSO profile.** An account already in SSO scope cannot complete a password login — Google sends it to the bot IdP and you'll see the message *"This page is used by Meeting BaaS bots during automated SSO sign-in…"*. Escape hatch for an already-scoped account: temporarily move it to an OU without the profile (or remove it from the assigned group), complete the Welcome flow, then move it back. + + +### Verifying SSO routing (optional) + +To check that Google routes a bot account to Meeting BaaS: open an incognito window, go to `accounts.google.com`, and type the bot account's email. If routing works, you land on a Meeting BaaS page saying **"This page is used by Meeting BaaS bots during automated SSO sign-in… your SSO setup is working."** That error page **is** the success signal — the sign-in itself can only be completed by a bot, never by a human. + Create a **Google Group** (for example `bots@bots.acme.com`) and add the bot users as members. Putting this group on a calendar invite lets the assigned bot land in Meet's **verified queue** and bypass the waiting room. You'll reference this group as `email_group` in Step 4. From cc82dc2137aa5be61cea97404f9b563aa14ac796 Mon Sep 17 00:00:00 2001 From: Lazare-42 Date: Thu, 13 Aug 2026 22:38:10 +0200 Subject: [PATCH 2/2] docs(meet-sso): address CodeRabbit review on setup ordering - Defer the assignment action itself until after Step 3, not just warn - Dedicated whole-domain scope described as a choice, not recommended - Escape hatch split by assignment type (group vs OU), with effective- assignment check and propagation delay - Routing check documented as post-first-login, in-scope only Co-Authored-By: Claude Fable 5 --- .../api-v2/authenticated-bots/meet/setup.mdx | 17 ++++++++++++++--- 1 file changed, 14 insertions(+), 3 deletions(-) diff --git a/content/docs/api-v2/authenticated-bots/meet/setup.mdx b/content/docs/api-v2/authenticated-bots/meet/setup.mdx index 42bd32a..f77adcb 100644 --- a/content/docs/api-v2/authenticated-bots/meet/setup.mdx +++ b/content/docs/api-v2/authenticated-bots/meet/setup.mdx @@ -149,6 +149,10 @@ These `/v2/meet-sso/*` URLs are SAML endpoints that Google calls during sign-in ### Assign the profile to your bot group (or OU) only + +**Do this assignment last** — only after your bot accounts exist and have completed their first interactive login ([Step 3](#step-3--prepare-the-workspace-users)). Once an account is in the assigned scope, Google routes *every* sign-in — including the first one — to the Meeting BaaS IdP, which only bots can complete; a human can then no longer finish the "Welcome to Workspace" flow. Configure the profile now, prepare the users, then return here to assign. + + Open **Manage SSO profile assignments**. Under **Groups**, pick the group that contains your bot accounts (for example `bots@bots.acme.com`) — or choose the bot **organizational unit**. A new scope starts with **Select SSO profile: None**. -**Complete each bot account's first login *before* it enters this SSO scope** (see [Step 3](#step-3--prepare-the-workspace-users)). Once an account is covered by the profile, Google routes *every* sign-in — including the very first one — to the Meeting BaaS IdP, which only bots can complete. A human can then no longer finish the "Welcome to Workspace" flow. If you scoped a whole domain (the recommended dedicated-domain setup), assign the profile **after** preparing the users, or temporarily exclude an account while you complete its first login. +If you use a dedicated bot-only domain and scope the profile to the whole domain, every account on it — including ones you create later — is born inside SSO scope. For accounts added after this assignment, temporarily exclude them while you complete their first login (see the escape hatch in [Step 3](#step-3--prepare-the-workspace-users)). @@ -189,12 +193,19 @@ For **each** Google account the bots will sign in as: 3. Set the account language to **English (United States)** to ensure the sign-in and Meet UIs are in the expected state. -**Do the interactive first login while the account is *not yet* covered by the Legacy SSO profile.** An account already in SSO scope cannot complete a password login — Google sends it to the bot IdP and you'll see the message *"This page is used by Meeting BaaS bots during automated SSO sign-in…"*. Escape hatch for an already-scoped account: temporarily move it to an OU without the profile (or remove it from the assigned group), complete the Welcome flow, then move it back. +**Do the interactive first login while the account is *not yet* covered by the Legacy SSO profile.** An account already in SSO scope cannot complete a password login — Google sends it to the bot IdP and you'll see the message *"This page is used by Meeting BaaS bots during automated SSO sign-in…"*. + +Escape hatch for an already-scoped account, depending on how the profile is assigned: + +- **Group-assigned:** remove the account from the assigned group. Moving it to another OU is **not** enough — group membership keeps routing it to the IdP. +- **OU-assigned:** move the account to an OU the profile is not assigned to. + +Then confirm no effective SSO assignment remains on the account, wait a few minutes for the change to propagate, complete the Welcome flow with the password, and restore the account to its group/OU. ### Verifying SSO routing (optional) -To check that Google routes a bot account to Meeting BaaS: open an incognito window, go to `accounts.google.com`, and type the bot account's email. If routing works, you land on a Meeting BaaS page saying **"This page is used by Meeting BaaS bots during automated SSO sign-in… your SSO setup is working."** That error page **is** the success signal — the sign-in itself can only be completed by a bot, never by a human. +Once an account has completed its first login **and is (back) in SSO scope**, you can check that Google routes it to Meeting BaaS: open an incognito window, go to `accounts.google.com`, and type the bot account's email. If routing works, you land on a Meeting BaaS page saying **"This page is used by Meeting BaaS bots during automated SSO sign-in… your SSO setup is working."** That error page **is** the success signal — the sign-in itself can only be completed by a bot, never by a human. Create a **Google Group** (for example `bots@bots.acme.com`) and add the bot users as members. Putting this group on a calendar invite lets the assigned bot land in Meet's **verified queue** and bypass the waiting room. You'll reference this group as `email_group` in Step 4.