Create a Google Workspace SAML App

Google Workspace allows you to create a dedicated SAML App to handle authentication. If you want to, you can follow Google’s instructions directly.

Create a custom SAML app#

1. Log in to the Google Admin Portal using your super administrator account.
2. Under the Menu, select Apps then Web and mobile apps.
3. Click Add App and select the Add custom SAML app option from the dropdown.
4. On the App details page, enter the name of your app. We recommend something memorable, like "[website name] SAML authentication".
5. Click Continue.
6. On the Google Identity Provider details page, download or copy the following information:
   • IDP metadata
   • Certificate
   • SSO URL
7. Click Continue.

For this guide, we want our users to be able to log in to our staging website: staging.example.com. Replace this example URL with the domain you want to authenticate.

8. On the Service Provider Details page, enter the following details:
   • https://staging.example.com/login/consume in the ACS URL text field.
   • cloudcannon.com/ in the Entity ID text field.
   • (Optional.) https://staging.example.com/ in the Start URL field. This URL is where Google will redirect users to once they have logged in.
9. Check the Signed response box.
10. In the Name ID format dropdown, select the EMAIL option.
11. In the Name ID dropdown, select the Basic Information > Primary email option.
12. Click Continue.
13. On the Attribute mapping page, click the Finish button.

Turn on the SAML app#

1. Under the Menu, select Apps then Web and mobile apps.
2. Select the SAML App you just created, and click User access.
3. Click the On for everyone option, then Save.

Once you’ve saved your settings, it can take a few minutes for your changes to take effect.