Ctrlk
Useful links
For the complete documentation index, see llms.txt. This page is also available as Markdown.

Google Workspace (SAML)

Configure SSO with Google Workspace using SAML protocol.

This guide explains how to configure SSO integration between Organizations and Google Workspace. After configuring Google, return to the Organizations SSO Configuration Guide to complete the setup.

Before you begin: Open Authentication → SSO in Organizations and copy the Entity ID and ACS URL as described in Step 2 of the SSO Configuration Guide.

Prerequisites

  • Administrator access to Google Workspace

  • Super Admin access to Organizations

  • Verified corporate email domain in Google Workspace

SAML Configuration

Create SAML Application in Google Workspace

  1. Access the Google Admin Console

  2. Navigate to Apps → Web and mobile apps

Google - Add Web app

  1. Click Add app → Add custom SAML app

Google - Add custom SAML app

  1. Configure the App name (e.g., "Certta")

  2. Optionally add an app icon and description

  3. Click Continue

Google - App Details

Download Google IdP Information

  1. On the Google Identity Provider details page

  2. Click Download Metadata to save the metadata XML file

Google - IdP Details

Note: Keep this metadata file safe. You'll need to either host it publicly or use Google's metadata endpoint URL in Organizations.

  1. Click Continue

Configure Service Provider Details

Configure the following fields:

Google Field
Value

ACS URL

Paste the ACS URL copied from Organizations

Entity ID

Paste the Entity ID copied from Organizations

Start URL

Leave blank (optional)

Signed response

Leave unchecked

Name ID format

EMAIL

Name ID

Basic Information > Primary email

Google - Service Provider Details

Click Continue

Configure Attribute Mapping

Map Google user attributes to SAML attributes that Organizations expects:

Click Add mapping for each attribute:

Google Directory attributes
App attributes

First name

given_name

Last name

family_name

Primary email

email

Google - Attribute Mapping

Note: The name attribute can use Primary email as a fallback, or you can create a custom mapping that combines first and last name if needed.

Configure Group Claim (Optional)

If you use Group assignment rules based on IdP groups:

  1. In Group membership

  2. Add Google groups

  3. In App attributes, enter groups

Google - Add Group Claim

Important: Google can send either group email addresses (for example, [email protected]) or group names (for example, Admins) in the groups claim, depending on your SAML app configuration. Map the corresponding values in Group assignment rules.

Only groups that the user is a direct member of are included. Nested group memberships may not be sent depending on your Google Workspace configuration.

  1. Click Finish

Enable the Application for Users

  1. In the app details page, click User access

Google - User Access

  1. Select ON for everyone or choose specific organizational units

  2. Click Save

Host Metadata URL

  1. Download the metadata XML file from the Google Identity Provider details page

  2. Host it on a publicly accessible URL (e.g., your web server or cloud storage)

  3. Use that URL as the Metadata URL in Organizations

Important: The metadata URL must be publicly accessible for Organizations to retrieve the configuration.

Configure in Organizations

After configuring Google Workspace, return to the Organizations SSO Configuration Guide and configure:

Organizations field
Value

Protocol

SAML 2.0

Metadata XML URL

Paste your hosted metadata file URL

On the Attribute mapping tab:

Organizations attribute
Claim value

Email

email

Full name

email (or custom attribute if configured)

First name

given_name

Last name

family_name

Groups (optional)

groups

Next Steps

After configuring Google Workspace, return to the Organizations SSO Configuration Guide to:

  1. Configure attribute mapping

  2. Configure group assignment rules

  3. Save and test

Troubleshooting

Problem
Probable Cause
Solution

ACS URL error

URI does not match

Verify that the ACS URL in Google matches the ACS URL from Organizations

User not authorized

App not enabled for user

Enable the app for all users or specific organizational units in User Access

Invalid SAML response

Attribute mapping incorrect

Verify attribute mappings in Google Admin Console

Certificate error

Certificate expired or invalid

Download new metadata from Google and re-host it

Metadata URL not accessible

Metadata file not publicly accessible

Ensure the metadata file is hosted on a publicly accessible URL

Domain restriction

User domain not verified

Verify the corporate domain in Google Workspace

Name ID error

Name ID format incorrect

Ensure Name ID format is set to EMAIL and mapped to Primary email

References

Last updated