Gcds Active Directory Sync Architecture

What Google Cloud Directory Sync (GCDS) and SAML Federation Are

Google Cloud Directory Sync (GCDS) is an on-premises synchronization tool that connects to an LDAP directory (such as Active Directory) to provision and synchronize users, groups, and organizational units into Cloud Identity or Google Workspace. GCDS performs one-way synchronization of identity metadata via the Google Directory API without reading or synchronizing user passwords.

How it Meets the Requirements

• No password synchronization: GCDS synchronizes user accounts, group memberships, and directory metadata, but does not synchronize passwords. Authentication is delegated back to on-premises Active Directory Federation Services (AD FS) or another SAML IdP via SAML 2.0 single sign-on, keeping credentials strictly on-premises.
• Resilience against SSO outages: Creating a dedicated administrator account in Cloud Identity exclusively for GCDS and placing it in an Organizational Unit (OU) that is exempt from single sign-on ensures administrators can re-authorize GCDS using standard Google credentials even during an external IdP or AD FS failure.
• Account isolation: Using a dedicated service account rather than a standard user account adheres to least-privilege principles and protects the provisioning pipeline from disruptions caused by individual employee lifecycle changes.

Key Advantages

• Credential security: Passwords never leave the corporate network; authentication occurs via secure SAML assertion exchanges.
• Automated lifecycle control: Creation, modification, and suspension in Active Directory automatically reflect in Cloud Identity.
• High availability: Excluding administrative provisioning accounts from SSO guarantees uninterrupted recovery and management access during federated identity downtime.
• Flexible schema mapping: Supports custom LDAP queries, attribute mappings, and OU filtering rules.

Why This Is Optimal

This architecture combines automated metadata synchronization via GCDS with delegated authentication via SAML SSO, perfectly satisfying corporate data governance, zero password leakage, and disaster recovery requirements.