Google Workspace
Create the Sentisec custom SAML app in the Google Admin console and map the attributes Sentisec needs.
This is the Google Workspace half of the hosted SSO setup. Start at Single Sign-On — you need our service-provider details first.
Google Workspace federates over SAML 2.0. It does not offer a generic OIDC application for third-party sign-in, so SAML is the path.
Create the app
Google Admin → Apps → Web and mobile apps → Add app → Add custom SAML app. Name it Sentisec.
Download the metadata on the Google Identity Provider details screen, or copy the SSO URL, entity id, and certificate. Send us whichever you took — the metadata file is the fewest moving parts.
Service provider details. Set ACS URL and Entity ID to the values we sent you. Name ID format: EMAIL. Name ID: Basic Information → Primary email.
Attribute mapping. Map three:
| Google directory attribute | App attribute |
|---|---|
| Primary email | email |
| First name | firstName |
| Last name | lastName |
Add a Google Group mapping to a groups attribute only if you plan
to drive roles from groups.
User access. Turn the app ON for the organisational units or groups that should have it. It defaults to OFF for everyone, and a user in an OU where it is off gets an error rather than a sign-in.
Roles
Two roles exist: admin and member. Tell us which Google Group should map
to admin; everyone else resolves to member. A group named auditors
does not produce read-only access — see
Roles and permissions.
Verify
Sign in as a test user from the Google apps launcher. They should land in the Sentisec dashboard with the workspaces their membership grants.
Related
- Single Sign-On
- SCIM provisioning — Google Workspace supports SCIM
- Roles and permissions