Ctrlk
For the complete documentation index, see llms.txt. This page is also available as Markdown.

Google Workspace (SAML)

Configure SSO with Google Workspace using SAML protocol.

This guide explains how to configure SSO integration between Trust and Google Workspace. After configuring Google, return to the Trust SSO Configuration Guide to complete the setup.

Before you begin: Access Trust and copy the Identifier and Reply URL fields as described in Step 2 of the SSO Configuration Guide.

Prerequisites

  • Administrator access to Google Workspace

  • Administrator access to Trust

  • Verified corporate email domain in Google Workspace

SAML Configuration

Create SAML Application in Google Workspace

  1. Access the Google Admin Console

  2. Navigate to Apps → Web and mobile apps

Google - Add Web app

  1. Click Add app → Add custom SAML app

Google - Add custom SAML app

  1. Configure the App name (e.g., "Trust - Caf")

  2. Optionally add an app icon and description

  3. Click Continue

Google - App Details

Download Google IdP Information

  1. On the Google Identity Provider details page

  2. Click Download Metadata to save the metadata XML file

Google - IdP Details

Note: Keep this metadata file safe. You'll need to either host it publicly or use Google's metadata endpoint URL in Trust.

3. Click Continue

Configure Service Provider Details

Configure the following fields:

Google Field
Value

ACS URL

Paste the Reply URL copied from Trust

Entity ID

Paste the Identifier copied from Trust

Start URL

Leave blank (optional)

Signed response

Leave unchecked

Name ID format

EMAIL

Name ID

Basic Information > Primary email

Google - Service Provider Details

Click Continue

Configure Attribute Mapping

Map Google user attributes to SAML attributes that Trust expects:

Click Add mapping for each attribute:

Google Directory attributes
App attributes

First name

given_name

Last name

family_name

Primary email

email

Google - Attribute Mapping

Note: The `name` attribute can use Primary email as a fallback, or you can create a custom mapping that combines first and last name if needed.

Configure Group Claim (Optional)

If you want to use custom group mapping:

  1. In Group membership

  2. Add Google groups

  3. In App attributes, enter groups

Google - Add Group Claim

Important: Google can send either group email addresses (e.g., `[email protected]`) or group names (e.g., `Admins`) in the groups claim, depending on your SAML app configuration. You will need to map the corresponding values in Trust.

Only groups that the user is a direct member of will be included. Nested group memberships may not be sent depending on your Google Workspace configuration.

4. Click Finish

Enable the Application for Users

  1. In the app details page, click User access

Google - User Access

  1. Select ON for everyone or choose specific organizational units

  2. Click Save

Host Metadata URL

  1. Download the metadata XML file from the Google Identity Provider details page

  2. Host it on a publicly accessible URL (e.g., your web server or cloud storage)

  3. Use that URL as the Metadata URL in Trust

    Important: The metadata URL must be publicly accessible for Trust to retrieve the configuration.

Configure in Trust

After configuring Google Workspace, return to the Trust SSO Configuration Guide and configure:

Trust Field
Value

Protocol

SAML

Metadata URL

Paste your hosted metadata file URL

Attribute Statements:

Trust Attribute
Claim Value

E-mail

email

Name

email (or custom attribute if configured)

Given Name

given_name

Family Name

family_name

Groups (optional)

groups

Next Steps

After configuring Google and Trust, complete the setup:

  1. Configure Properties and Scopes

  2. Configure Permission Groups

  3. Configure Attribute Statements

  4. Configure Domains

  5. Save and Test

Troubleshooting

Problem
Probable Cause
Solution

ACS URL error

URI does not match

Verify that the ACS URL in Google matches the Reply URL from Trust

User not authorized

App not enabled for user

Enable the app for all users or specific organizational units in User Access

Invalid SAML response

Attribute mapping incorrect

Verify attribute mappings in Google Admin Console

Certificate error

Certificate expired or invalid

Download new metadata from Google and re-host it

Metadata URL not accessible

Metadata file not publicly accessible

Ensure the metadata file is hosted on a publicly accessible URL

Domain restriction

User domain not verified

Verify the corporate domain in Google Workspace

Name ID error

Name ID format incorrect

Ensure Name ID format is set to EMAIL and mapped to Primary email

References

Last updated