Passer au contenu principal

Connect Google Workspace with SAML

This guide explains how to use Casdoor as the SAML identity provider (IdP) for single sign-on (SSO) to Google Workspace.

Learning outcomes​

  • Create a certificate for the SAML responses.
  • Configure a Casdoor application for Google Workspace.
  • Add Casdoor as a third-party IdP in Google Workspace.
  • Sign in to Google through Casdoor.

What you need​

  • A Google Workspace domain with administrator access
  • An application in Casdoor

Create a certificate in Casdoor​

  1. In the Casdoor admin console, add an X.509 certificate with the RSA algorithm. See Certificates.

  2. Download the certificate.

    Certificate edit page in Casdoor

Configure the Casdoor application​

  1. Open the edit page of the application.

  2. In Cert, select the certificate, and add your Google domain, for example google.com, to Redirect URLs.

    Certificate and Redirect URLs of the application

  3. Set SAML reply URL to https://www.google.com/a/<your-domain>/acs. For the ACS URL, see SSO assertion requirements in the Google Workspace help.

    SAML reply URL for Google Workspace

  4. Copy the URL of the sign-in page of the application.

    Sign-in page URL of the application

  5. Save the application.

Add Casdoor as an IdP in Google Workspace​

  1. In the Google Workspace Admin console, go to Security > Overview and find SSO with third-party IdP.

  2. Click Add SSO profile and turn on Set up SSO with third-party identity provider.

  3. Paste the URL of the Casdoor sign-in page into Sign-in page URL and into Sign-out page URL.

  4. Upload the certificate that you downloaded from Casdoor, and save.

    SSO profile in the Google Workspace Admin console

Verify the result​

  1. In Google Workspace, create a user, for example with the username test.

    New user in Google Workspace

  2. In Casdoor, create a user with the same username in the organization of the application, and set the email address of the user.

    New user in Casdoor

  3. Open a Google application, such as google.com, and sign in with the email address of the user. Google redirects you to Casdoor.

  4. Sign in to Casdoor. Casdoor sends you back to Google, signed in.

    Recording of the sign-in to Google through Casdoor

See also​