Configuring SAML-Based SSO with Google

RapidIdentity Platform Documentation
Solution
Application
Content Type
Technical Documentation
Utilities & Services
ft:locale
en-US

Google supports a SAML-based single sign-on (SSO) service for its web-based application that you can configure in your RapidIdentity portal. These configuration settings are an example and may vary for individual configurations.

Requirements
  • G Suite Admin Console login credentials
  • Access to your RapidIdentity administrator portal
  1. Navigate to your RapidIdentity administrator portal.
  2. From the module selector, choose Configuration.
  3. Select Security > Identity Providers and download the identity provider certificate (.pem).

    Keep this browser window open. You will need the Base URL and Logout URL for later steps.

  4. Log in to the Google Admin Console.
  5. Navigate to Menu > Security > Authentication > SSO with third party IdP.
  6. Click Set up single sign-on (SSO) with a third party IdP.
  7. Configure the third-party Identity Provider settings:
    SettingValue
    Sign-in Page URLhttps://YOUR-RAPIDIDENTITY-TENET/idp/profile/SAML2/Redirect/SSO
    Sign-out Page URLhttps://YOUR-RAPIDIDENTITY-TENET/idp/logout
    Use domain-specific issuerOFF
    Change Password URLhttps://YOUR-RAPIDIDENTITY-TENET
  8. Upload the RapidIdentity certificate and save the configuration.
  9. Configure domain specific URLs to automatically redirect users to the third-party IdP.
  10. Return to your RapidIdentity administrator portal and select Security > Identity Providers > Federation Partners.
  11. Click Add Federation Partner > SAML 2.0, then click Create SAML Relying Party.
  12. In the General section, set the Name and Description to Google Apps and add the following metadata (replace YOURDOMAINHERE with your Google domain):
    <EntityDescriptor entityID="google.com" xmlns="urn:oasis:names:tc:SAML:2.0:metadata">
    <SPSSODescriptor protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol">
        <NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified</NameIDFormat>
        <AssertionConsumerService index="1" Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
            Location="[EntityID]/acs" />
    </SPSSODescriptor>
</EntityDescriptor>
  13. In the SSO Settings section, configure the settings according to your requirements.
  14. In the Attribute Mapping section, click Add New Attribute + and configure the required attributes.
  15. Click Create, then click Save.
  16. Select Security > IDP Configuration.
  17. Click Trigger Service Reload.
  18. Click Trigger Web Reload.

RapidIdentity and Google are now integrated, allowing users to authenticate to Google with their RapidIdentity credentials.