SAML with Google Workspace

This guide walks through configuring Google Workspace as the identity provider for a Kindo SAML connection. It assumes you have a SAML connection set up in SSOReady — typically through the self-serve setup link described in Single Sign-On (SSO) Setup — and shows where each value in Google comes from and where it goes.

Note

SAML single sign-on via Google differs from “Sign in with Google,” which uses the OAuth protocol. This guide covers SAML only.

Create a custom SAML app in Google

A Google Workspace administrator creates the app from the admin console.

1. Starting from the Google Workspace admin console at admin.google.com, navigate to Apps > Web and mobile apps in the left navigation bar.

   

2. On the Apps > Web and mobile apps page, click Add app > Add custom SAML app in the tabs right under the header.

   

3. On the Add custom SAML app page, assign the application an App name. The name matters solely for display purposes — Kindo, or your own name for the Kindo deployment, works well. Then hit the blue CONTINUE button in the lower right.

   

Enter Google details in SSOReady

The next page shows the details about the new app that SSOReady needs. Copy each of these from Google into SSOReady.

Note

The previous page enumerated a few steps directly below its header. It’s normal for those to have disappeared — you’re likely still on the right track. Scroll up on this page to display the steps again.

1. Scroll down to the field marked SSO URL. SSOReady calls this the Redirect URL, on the Identity Provider Configuration card for your SAML connection. Copy the URL from Google and paste it into SSOReady.

   

2. Directly under the SSO URL sits Google’s Entity ID field. Copy it and paste it into SSOReady as the IDP Entity ID, adjacent to the Redirect URL input from the previous step.

   

3. Navigate to the next field, marked Certificate. Toward its top right corner is a download icon; pressing it downloads a .pem file whose name starts with Google and ends in SAML2_0. Upload this file to SSOReady as the Certificate.

   

4. SSOReady now has everything it needs. Scroll down and press the blue CONTINUE button in the bottom right of the page.

Enter SSOReady details in Google

Now tell Google about SSOReady. Both required values come from the Service Provider Configuration card for your SAML connection in SSOReady.

1. Google asks for an ACS URL. SSOReady calls this the Assertion Consumer Service (ACS) URL; it ends in /acs. Copy it from SSOReady and paste it into Google’s ACS URL field.

   

2. Directly below, Google asks for an Entity ID. SSOReady calls this the SP Entity ID; it looks exactly like the ACS URL, only without the /acs ending. Copy it from SSOReady and paste it into Google’s Entity ID field.

   

3. Click the blue CONTINUE button in the lower right corner.

   

4. On the Attribute mapping page that follows, map these Google directory attributes to app attributes with these exact names, so the SAML assertion carries what Kindo expects. SSOReady does not rewrite incorrect incoming SAML attributes on your behalf; without a correctly mapped email attribute, login and JIT (Just-In-Time) provisioning fail. Then hit FINISH.

   Google directory attribute	App attribute
   Primary email	email
   First name	firstName
   Last name	lastName

Once you’ve completed this step, the Google configuration is done. Confirm the connection appears in SSOReady’s connection list as described in Single Sign-On (SSO) Setup.

Caution

Users cannot sign in until a Google Workspace administrator turns the app on for them: on the app’s page in the admin console, set User access to ON for the relevant organizational units or groups.