SAML SSO with Google Workspace

#1

This article will walk through the steps to configure SSO using SAML with Google in Infosec Accounts.

Note: An active SSO configuration in Infosec Accounts does not necessarily mean that this authentication method will be active for everyone in Infosec IQ. To learn how these two relate to each other, see our other article Authentication in Infosec IQ.

Table of Contents

Initiating your application in Infosec Accounts

  1. Navigate to Infosec Accounts and click on Organization in the top right corner of the page.
  2. In the Single sign-on section, select Setup.
    image
    image.png1189×164 5.54 KB
  3. Do not adjust any of the settings and click Save in the bottom of this menu. This will expose the SP Assertion Consumer Service URL and SP Entity ID URLs for your organization. You will need these URLs to perform the below configuration steps.

Building a SAML application in Google

  1. Log in to the Google Admin Portal
  2. Expand Apps on the navigation menu, and select Web and mobile apps
    image
  3. Select Add app at the top of the page, and select Add custom SAML app
    image
  4. Enter an name for the application (eg Infosec IQ), and description and app icon if you’d like to. Click Continue at the bottom of the screen.
  5. Click Download Metadata and remember where you save it. Click Continue at the bottom of the page.
  6. There are handful of fields to fill out on this page.
    • ACS URL: Enter the SP Assertion Consumer Service URL you retrieved from Infosec Accounts.
    • Entity ID: Enter the SP Entity ID you retrieved from Infosec Accounts.
    • Start URL: Leave this field blank.
    • Signed response: Leave this option UNchecked.
    • Name ID format: Select EMAIL from the dropdown.
    • Name ID: Leave this as is- “Basic Information > Primary Email”
  7. Click Continue at the bottom of the page.
    image
    image.png1061×775 32.6 KB
  8. On this page, click Add Mapping. Select Primary email under ‘Google Directory attributes’ and type email under ‘App attributes’ Click Finish at the bottom of the page.
    image
    image.png1108×635 27.9 KB

Return to Table of Contents

Completing setup in Infosec Accounts

  1. Navigate back to Infosec Accounts and click on Organization in the top right corner of the page.
  2. In the Single sign-on section, where you had retrieved the links in the first section, click Actions then Edit.
    image
    image.png1210×360 17.2 KB
  3. (Optional) If you’d like to allow IDP initiated SSO, turn on the Allow IDP initiated SSO? button. Leaving the Default redirect field blank will automatically populate the correct link once saved.
  4. Under the section labeled IdP metadata, select XML and click the button at the bottom of this section that says Upload XML file. Navigate to and select the XML file you saved while setting up the app in Google.
    image
    image.png548×876 19.9 KB
  5. Click the Save button at the bottom of this section.

Return to Table of Contents

Testing and enabling in Infosec Accounts

  1. If you’re following from the steps above, you should already be on the correct page. If not, navigate back to Infosec Accounts and click on Organization in the top right corner of the page.
  2. Your app should now be ready to test. Click the Actions button on your inactive configuration. Click Test. This will attempt to authenticate using your Google SAML application and return detailed results.
  3. If you run in to trouble, review your configuration and this article to make sure everything looks as it should. If you’re still running into trouble, open up a ticket with our support team to get help solving the problem.
  4. If everything is working okay, click Actions then Edit on your inactive configuration.
  5. Under the Status section, click the radio button next to Activate this config.

Your SAML configuration is now active.

Note: An active SSO configuration in Infosec Accounts does not necessarily mean that this authentication method will be active for everyone in Infosec IQ. To learn how these two relate to each other, see our other article Authentication in Infosec IQ.