Configuring SAML-Based Single Sign-On with Google Workspace

Technical Articles
Solution
Application
Content Type
Technical Documentation
Utilities & Services
ft:locale
en-US

This article includes step-by-step instructions for configuring SAML-based single sign-on (SSO) settings in Google Workspace. For end users, you can integrate with Google Workspace to enable SAML-based SSO for Automated Device Enrollment (with an Enrollment Customization SSO authentication pane), Device Enrollment (also known as "user-initiated enrollment"), and Jamf Self Service for macOS.

Note:

While SAML-based SSO for administrators remains supported, Jamf recommends OIDC-based SSO through Jamf Account as a preferred authentication solution. OIDC-based SSO through Jamf Account offers seamless login across Jamf products and access to platform capabilities like blueprints and compliance benchmarks. End-user authentication for enrollment and Self Service can continue using SAML after transitioning administrator authentication to OIDC. For details on implementing OIDC-based SSO, see SSO with OIDC Through Jamf Account in the Jamf Pro Documentation.

Keep the following in mind when configuring SSO in Google Workspace:

  • Some setting names were changed in Jamf Pro 10.13.0. If you are using an earlier version of Jamf Pro, the setting names will not match the updated names in this article. For a list of name changes, see the 10.13.0 version of the Jamf Pro Release Notes.

  • Setting up SSO may require simultaneous configuration between Google Workspace and Jamf Pro to ensure some settings are mapped correctly. Additional settings or steps may also be required. See the Single Sign-On section of the Jamf Pro Documentation for Jamf Pro-specific requirements and instructions.

Requirements

  • Jamf Pro user accounts or groups that have matching users or groups in Google Workspace

  • Administrative privileges to Jamf Pro and Google Workspace

  1. Sign in to Google Workspace using your administrator account.
  2. Navigate to the Admin console Home page and go to Apps > Web and mobile apps.
  3. Click Add apps.
  4. Click Add custom SAML app.
  5. In the App details window, enter Jamf Pro as your application name.
    1. (Optional) Add an application description.
    2. (Optional) Click the camera icon to upload an app icon file.
  6. Click CONTINUE.
  7. In the Google IdP Information settings, download the IDP metadata file in Option 1 and click CONTINUE.

  8. Configure the Service provider details window like the following:
    • ASC URL —Match the following format, ensuring that SSO is capitalized: https://instancename.jamfcloud.com/saml/SSO
    • Entity ID —Match the following format: https://instancename.jamfcloud.com/saml/metadata
    • Start URL —Specify where Google should redirect users after successful authentication, such as https://instancename.jamfcloud.com
    • Signed Response —

      Select the Signed Response checkbox.

    • Name ID —

      Select Basic Information and Primary Email.

    • Name ID Format —Select Email.
  9. Click CONTINUE.
  10. If you will be mapping users by groups in Jamf Pro, enter http://schemas.xmlsoap.org/claims/Group in the App attribute field.
  11. Click FINISH.
  12. To enable SSO for the SAML app, navigate to the Google Workspace Admin console homepage.
    1. Go to Apps > Web and mobile apps.
    2. Select the Jamf Pro SAML app.
    3. At the top-right of the SAML app, click User access and select the following:
      • On for everyone to enable SSO for all users
      • Off for everyone to disable SSO for all users
      • On for some organizations to enable SSO only for some users
      Note:

      Configuring Single Sign-On with Google Workspace does not support group membership mappings for third-party SAML apps. It is possible to create an Attribute Mapping for a user attribute, such as Department. If you will be mapping users by groups, enter http://schemas.xmlsoap.org/claims/Group in the Application Attribute field.

Google Workspace is now configured for SSO and can be enabled in Jamf Pro.

For instructions on enabling SSO in Jamf Pro, see the Enabling Single Sign-On in Jamf Pro procedure in the Single Sign-On section of the Jamf Pro Documentation.

Important:

Jamf Pro users or end users using enrolled devices may encounter login errors if the Token Expiration Time Override setting is enabled in Jamf Pro. To prevent these errors, you may want to disable the Token Expiration Time Override setting. This will stop Jamf Pro from verifying the token's lifetime, which is controlled by and verified by your IdP. Alternatively, you can ensure that the token expiration time set in Jamf Pro exceeds the expiration time configured by your IdP. However, issues may still occur if the token expiration time dynamically changes.