Configuring SAML SSO with Google

Configuring SAML SSO with Google

Google supports a SAML-based Single Sign-On service for its web-based application to configure your Identity Provider (IdP) server connection. In the information provided in the link above, the third-party identity provider is Identity Automation through RapidIdentity Federation.

The preliminary SAML authentication configuration steps require that both RapidIdentity Portal and RapidIdentity Federation IdP are internet accessible and are configured as described.

Follow these steps to configure G Suite for SAML. A G Suite Admin Console login is required to complete this configuration.

Note: Google may update their setup sequence without notification, therefore, the steps below may vary slightly.

Launch the Identity Provider Configuration Workspace

1. From the RapidIdentity Configuration Module, select Identity Providers from the Security menu.
2. The Identity Provider Configuration workspace will launch.
   
3. Click Download the certificate used by the Identity Provider (.pem)to download the certificate.
   1. Keep this browser window open as the Base URL and Logout URL are necessary during upcoming steps. At that time, the certificate will be uploaded to the G-Suite Admin portal.

Set up SSO in the G Suite Admin Console

1. In a different browser window, authenticate to G Suite Admin Console with an administrator account and click Security.
2. Click Set up single sign-on (SSO) with a third party IdP. 
   
3. For the Third-party Identity Provider section, enter the information as described below: Sign-in page URL and the Sign-out page URL.
   1. Enter the Sign-in page URL.
   2. Enter the Sign-out page URL.
      Note : The base URL for these values must be entered using the format "**/idp/profile/SAML2/Redirect/SSO"
   3. Click REPLACE CERTIFICATE to upload the certificate that was downloaded in Step 3.
   4. Click Save at the bottom of the page to save the configuration.
      
4. Click Download IDP Metadataand copy the information to the clipboard. The metadata ends with "."
5. Create a SAML 2.0 Federation Partner for G Suite
   1. In the RapidIdentity Configuration module, click Federation Partners from the Identity Providers section.
      
   2. Click the Add Federation Partner drop-down button and select SAML 2.0.
      
6. The Federation Partners>Community-SAML Relying Parties workspace will launch.
   
   Tip: The Community contains the basic configuration for commonly used SAML Relying Parties. Before manually adding a new SAML Relying Party, search the Community for the G-Suite entry. The Community will be updated on an ongoing basis with new SAML Relying Parties.
7. Click Create SAML Relying Party+. Enter the following information in the Federation Partners > Create SAML Relying Party window.
   1. The tables and respective screens below depict the values that are to be entered for each section, "General," and "SSO Settings," for the G Suite Relying Party registration in the Register SAML Relying Party window.

General

1. Click SSO Settings at the bottom of the General page to expand the SSO Settings options.
   

SSO Advanced Settings

Define the LDAP Attributes

SAML Service Providers typically define one or more attributes required from the Identity Provider to release to Google during SAML authentication about the authenticating user. These attributes are typically things like Email and Name, but could also be things like Group Membership.

1. From the Security menu, access the SAML 2.0 Federation Partner that was created earlier in this process. Click SAML Attributes at the bottom of the workspace to view or add attributes.
2. In this example, the Name ID will be the attribute used for authentication.
   1. A SAML assertion typically contains a single "Name ID" attribute and 0 or more other attributes about the authenticated user.
3. A Name ID attribute is typically the main identifier of the user and is associated with a particular "Name Format." The Name Format generally indicates the type of value to the Relying Party.
   1. For example, a value of "urn:oasis:names:tc:SAML:2.0:nameid-format:email" indicates that the Name ID attribute is an email address.
   2. A value of "urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified" indicates the value is of an "unspecified" type.
4. The Federation Partners > SAML Attributes workspace will load. Click the Name ID tab.
5. Enter Name ID for the LDAP Attribute, and select the Name Format Friendly Name from the drop-down list. In this example, the name format is an email address.
6. Click Save.
7. The Name ID attribute will now be populated in the workspace.
8. From the newly added Name ID Attribute, Click Edit.
   
9. The urn will be similar to this: "urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified." Ensure the SAML version and the format matches the information that is in the metadata from G Suite. In this case, the updated urn will be" urn:oasis:names:tc:SAML:2.0:nameid-format:email ." Click Save.
   

   
   

   Note: Editing attributes creates a link from the LDAP attributes to the “Name Format” defined by the service provider. Editing attribute mappings specifies which attributes to allow or deny for a specific service provider. It is often recommended to deny the [INTERNAL] SAML Transient ID as, in many cases, it conflicts with some service providers. [INTERNAL] attributes are the attributes defined by default by Rapid Identity to process SAML interactions between internal apps like the Portal and Connect.
   
10. A service reload is required.
    
11. Navigate to IDP Configuration.
12. Click Trigger Service Reload in the action bar buttons.
13. A confirmation message will appear briefly at the top of the workspace.
14. Navigate to the G Suite Admin console, Security section.
15. Select Set up single sign-on (SSO).
16. Enter the data fields that were entered in step 2a. These values will vary based on the setup.
    1. The Sign-in page URL is the IdP Base URL to sign in to your system and G Suite.
    2. The Sign-out page URL is the Logout URL for redirecting users to sign out.
    3. The Change password URL is the organization-specific URL to allow users to change their password.
17. Upload the IdP security certificate and ensure Use a domain-specific issuer is unchecked. Network masks are optional and organization-specific.
    
18. Create a G Suite App link in the RapidIdentity Portal's Admin Applications Module
19. Once the application is created, click the icon in the portal to initiate a valid IdP initiated SAML connection to your G-Suite tenant.
20. Access http://mail.google.com/a/{GOOGLE_DOMAIN}to be directed to a user's homepage.