WorkOSDocs
/
Sign in

Connect G Suite SAML

Learn how to configure a connection to G Suite via SAML

Introduction

Each SSO Identity Provider requires specific information to create and configure a new Connection. Often, the information required to create a Connection will differ by Identity Provider.

To create a G Suite SAML Connection, you'll need four pieces of information: an ACS URL, an Identity Provider Entity ID, an Identity Provider SSO URL, and an X.509 Certificate.

WorkOS Provides

WorkOS provides the ACS URL. It's readily available in your Connection's Settings in the Developer Dashboard.

The ACS URL is the location an Identity Provider redirects its authentication response to. In Google's case, it needs to be set by the Enterprise when configuring your application in their G Suite admin dashboard.

Specifically, the ACS URL will need to be set as the "ACS URL" and "Entity ID" in the "Service Provider Details" step of the Google "Enable SSO for a SAML Application" wizard:

Configuring G Suite SAML

And then, you provide the Identity Provider Issuer (Entity ID), Identity Provider SSO URL, as well as the X.509 Certificate.

Normally, this information will come from your Enterprise customer's IT Management team when they set up your application's SAML 2.0 configuration in their G Suite admin dashboard. But, should that not be the case during your setup, here's how to obtain them.

1
Log in

Log in to the G Suite admin dashboard, select "Apps" from the option list, and then select "SAML Apps" from the following list.

Next, select "Setup my own custom app" from the bottom of the "Enable SSO for SAML Application" menu.

2
Obtain Identify Provider Details

Copy and paste the "SSO URL" and "Entity ID" values into the corresponding Connection fields in your WorkOS Developer Dashboard. Then select "Download" to obtain the X.509 Certificate, and save it to your preferred directory.

3
Enter Your App's Information

Enter a name, description, and logo for your application, then select “Next”.

4
Enter Service Provider Details

Copy and the "ACS URL" from your WorkOS Developer Dashboard and paste it into the "ACS URL" and "Entity ID" fields in the Google SAML "Service Provider Details" modal. Select "Next."

5
Configure Attribute Mapping

Provide the following Attribute Mappings and select “Finish”:

G Suite SAML does not provide the option to map a user's id attribute claim.

6
Upload Certificate

Finally, upload the X.509 Certificate in your WorkOS Connection Settings. Your Connection will then be verified and good to go!