How to Setup Google SSO (Single Sign-On) Integration
Configure Google SSO in a few simple steps using this setup guide. miniOrange SAML Single Sign-On (SSO) allows secure Single Sign-On access to your Google Account & other specific On-Premise / Cloud apps using a single set of existing login credentials.
Google SSO solution also provides an option to integrate with multiple third-party Identity Providers which support SAML and OAuth sort of standard protocols. IDP here means (Okta, Auth0, Ping, Onelogin, etc) or Active Directory (AD) where your existing users are managed. Google SSO for Cloud Identity, eliminating passwords by redirecting users to an external identity provider (IdP) for authentication, enhancing user experience with existing credentials.
With miniOrange Google SSO, you can:
Enable your users to automatically login to Google
Have centralized and easy access control of the users
Connect easily with any external identity source like Azure AD, ADFS, Cognito, etc
Get Free Installation Help
miniOrange offers free help through a consultation call with our System Engineers to Install or Setup Google SSO solution in your environment with 30-day free trial.
For this, you need to just send us an email at idpsupport@xecurify.com to book a slot and we'll help you in no time.
Supported SSO Features
miniOrange Google SSO integration supports the following features:
SP Initiated SSO Login: Users can access their Google account via a URL or bookmark. They will automatically be redirected to the miniOrange portal for login. Once they've signed on, they'll be automatically redirected and logged into Google.
IdP Initiated SSO Login: Users need to login to the miniOrange first , and then click on the Google icon on the applications dashboard to access Google.(If you have set up any more Identity Sources, you will log in to that platform).
JIT Provisioning: Enables the automatic creation of user accounts in Google when a person logs in for the first time via Desktop SSO, IDP, or Active Directory (AD) authentication.
Single Logout: With this feature, you will be automatically logged out of all the applications that are connected with Identity provider (IdP) when you log out from Google org or any other app.
Mandate users to Login using SSO: Single Sign-on can make it mandatory for all users to log in using SSO. This will prevent any person from login using any other source and bypassing the login system. No person will be able to have direct login making it a streamline and secure process.
IP Restriction for Google Apps (G Suite)
IP based access control in cloud computing, allows you to enforce an IP restriction policy that enables the IT admin to restrict user access to business data in G Suite only through one or more specified IP addresses. This ensures that no business data is accessed in an unsecured, public, or unregistered IP address. Preventing data theft is a big concern, so IP restriction for G Suite helps you out with that concern.
Restrict a single user, a subset of users or an entire organization to IP restriction policy
Policy-based restriction for providing strong granular control to the business
Customize mapping of users over one or more IP addresses
No firewall settings or local installation are required for this feature
Easy to set up IP restriction policies
Connect with External Source of Users
miniOrange provides user authentication from various external sources, which can be Directories (like ADFS, Microsoft Active Directory, OpenLDAP, AWS etc), Identity Providers (like Microsoft Entra ID, Okta, AWS), and many more. You can configure your existing directory/user store or add users in miniOrange.
Video Setup Guide
Prerequisites
Please make sure you’re not logged in to gmail with a user account. Admin account verification can only be done if you’re logged in to Google Workspace via an Admin Account.
Google Workspace Business Starter or any higher plan is required to support SSO.
Follow the step-by-step guide given below to configure Google Single Sign-On (SSO)
In Choose Application, select SAML/WS-FED from the application type dropdown.
Search for Google Apps in the list, if you don't find Google Apps in the list then, search for custom and you can set up your application in Custom SAML App.
Enter your Domain name that you uses with the Google Workspace.
Enter the Single Logout URL as https://mail.google.com/a/out/tld/?logout.
From the Provisioning tab, enter the Domain Administrator in Google Apps (G Suite) Administrator field and click on "Verify Google Apps Administrator" to verify if the domain entered is of administrator (this is an optional field).
Click on Save.
In Applications, search for the configured app.
From the Actions menu (three dots) next to your app, click Edit.
Get IdP Metadata Details to upload to Google Apps:
Go to Apps >> under Applications.
Search for your app and click on the three dot in Actions menu against your app.
Click on Metadata to get metadata details, which will be required later. Click on Show SSO Link to see the IDP initiated SSO link for Google Apps.
Here you will see 2 options, if you are setting up miniOrange as IDP copy the metadata details related to miniOrange, if you required to be authenticated via external IDP's (OKTA, AZURE AD, ADFS, ONELOGIN, GOOGLE APPS) you can get metadata from the 2nd Section as shown below.
Keep SAML Login URL and click on the Download Certificate button to download certificate which you will require in Step 2.
Upload the certificate by clicking Upload Certificate (from Step 1).
Click Save.
After saving, copy the ACS URL. You will need this when configuring Google Apps in miniOrange.
Your Google SSO SAML integration is complete.
2.1. Assign SSO profile to organizational units or groups:
If you want some of your users to sign in to Google directly, you can move those users into an organizational unit (OU) or group. Then, manage SSO settings for the OU or group so that those users are authenticated by Google rather than using your third-party IdP. Follow the following steps:
If you want all your (non-super admin) users to sign in using a third-party IdP : You don't need to manage.
If you want some of your users to sign in to Google directly : Click Manage SSO profile assignments and continue to the next step.
If you are assigning the SSO profile for the first time, then click Get started. Otherwise, click Manage.
Note: Get started is only available if you’ve already enabled your third-party SSO profile.
Select the organizational unit or group for which you’re assigning the SSO profile from the left . Note: If the SSO profile assignment for an OU or group differs from your domain-wide profile assignment, an override warning appears when you select that OU or group. You can’t assign the SSO profile on a per-user basis. The Users view let you check the setting for a specific user.
Choose Organization's third Party SSO Profile if you want your users in the OU or group to sign in to Google services using the IdP designated in your domain’s third-party SSO profile.
Choose None if you want your users in the OU or group to sign in directly with Google.
Choose Another SSO profile in case you already have another Identity Provider configured and would like to use it for user authentication.
Then click Save.
2.2. To turn SSO off for all users:
If you want to turn off the third-party authentication for all your users without changing the SSO profile assignment for OUs or groups, you can disable the third-party SSO profile:
Uncheck Set up SSO with third-party identity provider.
Click Save.
3. Test SSO Configuration
Test SSO login to your Google Apps account with miniOrange IdP:
Using SP Initiated Login
Go to your Google Apps URL, here you will be either asked to enter the username or click on the SSO link which will redirect you to miniOrange IdP Sign On Page.
Enter your miniOrange login credential and click on Login. You will be automatically logged in to your Google Apps account.
Using IDP Initiated Login
Login to miniOrange IdP using your credentials.
On the Dashboard, click on Google Apps application which you have added, to verify SSO configuration.
How to identify errors in SAML assertions sent by your IDP?
Use the SAML Assertion Validator to troubleshoot single sign-on (SSO) login problems and identify errors in SAML assertions sent by your identity provider. Click on this link know more about the error identification in SAML Assertions.
For Chrome / Edge or Chromium-based browsers: Install the SAML tracer extension from Chrome Webstore.
Steps to Capture logs:
Make sure the SAML Tracer window is opened before you start the SSO flow. (You can open it by clicking the SAML Tracer icon in your extensions list in the browser toolbar.)
Run the SSO flow to reproduce the issue. You will see SAML Tracer getting populated with all the URLs.
Hit Pause on SAML Tracer, once the issue is reproduced to avoid extra logs.
You will have something similar to the below pic in the SAML tracer.
Steps to export logs:
To export logs, click the export option on the top of the SAML Tracer. (Refer to screenshot below).
You will be prompted with the Export SAML trace preferences window, select the None field, and then click on the Export option. (This option will allow keeping values in the original state which is required to further investigate the issue.)
Click Export. This will download a JSON file on your system.
Send the log file to the developer you are in touch with or at idpsupport@xecurify.com. Also, please attach an error screenshot. This would help us debug the issue.
If you are still not able to get the logs, feel free to let us know.
Choose an SSO Protocol: SAML or OAuth/OpenID Connect, which Google supports for Single Sign-On.
Register Your Application: Create a project in the Google Cloud Console and configure OAuth consent and credentials to get the necessary client ID and secret.
Configure Identity Provider Settings: Set up Google as the Identity Provider (IDP) by configuring your app to trust Google for authentication.
Implement Authentication Flow: Integrate the chosen SSO protocol in your application’s login flow, redirecting users to Google's authentication page and handling the returned tokens/assertions.
Test and Deploy: Test the Google SSO login thoroughly with user accounts to ensure seamless access, then deploy to your production environment.
Can I use Google SSO login with multiple domains or alias emails?
Yes, Google SSO supports aliases and multiple domains for organizations using Google Workspace, making centralized credential management easier for complex team structures.
