Arctera™ Insight Management Console Help
- Getting started
- Archive Overview
- Working with Dashboard
- Managing Configurations
- About Provisioning
- About Managed Tags
- About Account Management
- Managing Archive Collectors
- About Exchange Online Archiving
- About Google Chat Archiving
- About Google Workspace Archiving
- About SCIM Archiving
- About Import Collector
- About Insight Capture Services Archiving
- About Audio-Video Archiving
- About Audio-Video Archiving using NTR-X Collectors
- About Dubber Speik SMS Archiving
- About Dubber Speik Recordings Archiving
- About Text-Delimited Archiving
- About XSLT-XML Archiving
- About JSON Archiving
- About iMessage Archiving
- About LinkedIn Archiving
- About Signal Archiving
- About Verint Archiving
- About WeChat Archiving
- About WhatsApp Archiving
- Managing Roles and Permissions
- Managing Policies
- Managing Authentication
- Managing Retention Policies
- Managing Email Continuity Services
- Managing Reports and Notifications
- Classification
- Managing Data Import
- AD FS Configuration Guide
Configuring Google Workspace for SAML and SSO authentication to your custom SAML app
You must have the super administrator role/privileges to configure Google Workspace for SAML and SSO authentication to your custom SAML app. Upon successful configuration, the SSO sends a SAML request to the Google Workspace as an Identity Provider (IdP) and then sends a SAML response to the SSO confirming the user identity.
Note:
This section provides a quick references for configuring Google Workspace for SAML and SSO authentication. However, for precise configuration procedure, refer to Google Workspace Admin Help documentation: Set up you own custom SAML application.
To configure Google Workspace for SAML and SSO authentication to your custom SAML app
- Log in to the Google Admin console as a super administrator.
- Select Apps > Web and mobile apps.
- Click Add App and select Add custom SAML app as shown in the sample image below, and perform the following steps:
On the App details page, specify a unique app name, description, and app icon, and then click Continue.
Uploading an app icon is optional. If you do not upload the icon, Google Workspace creates a new icon using the first two letters of your app name. This information is shared with the custom SAML app users. (This icon will be shown on the App settings page and in the Web and mobile apps list.)
On the Google Identity Provider details page, use one of the following options to get the required setup information. These crucial parameters are needed to configure the SSO Integration and verify connectivity between Google Workspace and the custom SAML app.
Option 1: Download the IDP metadata file.
Option 2: Copy the SSO URL, Entity ID, and SAML 2.0 Certificate. Save this information securely to use while setting up a service provider.
On the Service provider details page, enter the following details:
ACS URL: Enter the URL that should receive the SAML response after authentication. It must begin with https://.
Entity ID: Enter the Entity ID copied from the previous step.
Start URL: (Optional) Enter the URL to which the SAML app should redirect users after successful login/authentication to the app.
Signed Response: (Optional) Select if the service provider requires the entire SAML authentication response to be signed. Do not select this option if the service provider requires only the assertion within the response to be signed.
Name ID format: Define the naming format supported by Google Workspace. Select the Email format from the drop-down list.
Name ID: Select Basic Information > Primary email.
On the Attribute mapping page, click Add Mapping and use the Username, Primary email. First name, and Last name Google Directory attributes and App attributes as shown in the sample image below.
- Click Finish.
- Select Apps > Web and mobile apps, and open your custom SAML app.
- Ensure that the parameters configured for the app are appearing correctly.
- On the User Access pane, click View details, and do the following:
Select the required users, groups, or organizational units (OUs) to which you want to enable the service. By default, no users, groups, or organizational units have permission to access the app.
In the Service status section, click ON for everyone, and then click Save to activate the service for all selected users.
- On the User Access pane, in the left pane, click Test SAML login.
The SAML app should open in a separate tab. If it does not open, check the error messages, update your Identity Provider and Service Provider settings as needed, and then test the SAML login again.
Usually, the change takes place quickly but sometimes it may take up to 24 hours.