How to Configure SAML SSO for Third-Party Apps in Google Workspace

The Security of Single Sign-On (SSO)

In a modern corporate environment, employees are required to log into dozens of different web applications every day: Salesforce for CRM, Slack for communication, Zendesk for ticketing, and Jira for project management. If every employee creates a separate, weak password for each of these tools, your attack surface is massive. When an employee is terminated, IT must manually disable their account in 20 different portals.

The solution is Single Sign-On (SSO) using the SAML 2.0 protocol. By configuring Google Workspace as your central Identity Provider (IdP), employees simply click a “Log in with Google” button on third-party apps. They use their highly secure, 2FA-protected Google credentials to access everything. When an employee leaves, disabling their Google account instantly revokes their access to all third-party software.

Step 1: Locate the App in Google Workspace

Before you begin, ensure you have Super Administrator privileges in Google Workspace, and Admin privileges in the third-party application you are attempting to integrate.

1. Log into the Google Workspace Admin Console.
2. Navigate to Apps > Web and mobile apps.
3. Click the Add app dropdown menu at the top and select Search for apps.
4. Google maintains a massive catalog of pre-configured SAML applications. Search for your app (e.g., “Salesforce”) and select it from the list.
5. Note: If your app is not listed, you can select “Add custom SAML app” and manually map the XML metadata, but this is a significantly more complex process.

Step 2: Copy the IdP Metadata

The first screen of the setup wizard will present you with Google’s Identity Provider (IdP) information. This is the cryptographic data that proves Google is who it says it is.

1. You will see two critical URLs: the SSO URL and the Entity ID. Copy both of these to a notepad.
2. You will also see a Certificate section. Click the Download button to save the .pem or .cer public key file to your desktop.
3. Click Continue in the Google Admin Console.

Step 3: Configure the Third-Party Service Provider

Leave the Google Admin Console open in one tab, and open a new tab to log into the third-party application (e.g., Salesforce).

1. Navigate to the security or authentication settings within the third-party app. Look for a section titled Single Sign-On or SAML Configuration.
2. The app will ask for the Identity Provider SSO URL. Paste the URL you copied from Google.
3. The app will ask for the Entity ID (sometimes called the Issuer). Paste the Entity ID you copied from Google.
4. The app will ask you to upload the X.509 Certificate. Upload the `.pem` file you downloaded earlier.
5. Save the settings in the third-party app.

Crucially, the third-party app will now generate its own metadata (an ACS URL and its own Entity ID). Copy these values.

Step 4: Finalize the Google Configuration

Return to the Google Workspace tab.

1. On the Service Provider details page, paste the ACS URL and Entity ID you just retrieved from the third-party app.
2. Ensure the Name ID format is set correctly (usually EMAIL).
3. Click Continue.
4. Map any required user attributes. For example, the third-party app might require Google to send the user’s First Name and Last Name along with the authentication token. Map “Basic Information > First Name” to the app’s required variable name.
5. Click Finish.

Step 5: Enable the Application

By default, newly created SAML apps are turned off for everyone.

1. On the app’s summary page in Google Workspace, click the User access section.
2. Select the specific Organizational Unit (OU) that requires access to this tool, or select the entire organization.
3. Change the Service Status to ON for everyone.
4. Click Save.

Users can now navigate to the third-party app, click the SSO login button, and seamlessly authenticate using their Google credentials.