Google Workspace SAML Integration Guide

Suggest an edit

Prerequisites

  • Super Administrator access to the Google Admin Console
  • A SplitSecure Identity Provider created and approved
  • The Security settings administrator privilege in Google Workspace
  • A separate browser or browser profile with SplitSecure configured (for testing)

Google Workspace Configuration

1 Navigate to SSO Settings

  1. Sign in to the Google Admin Console with an administrator account
  2. Navigate to Security → Authentication → SSO with third party IdP

2 Create a SAML SSO Profile

  1. In the Third-party SSO profiles section, click Add SAML profile
  2. Enter a profile name (e.g., “SplitSecure SAML”)
  3. For Autofill email, select the option Send email address in the URL as the LoginHint parameter

3 Configure IdP Details

Gather the following values from SplitSecure before proceeding:

  1. In SplitSecure, go to Secure Accounts → SAML2 Identity Providers
  2. Click Details on the desired identity provider
  3. Note the values below and download the certificate
Field Value Notes
IDP Entity ID com.splitsecure.saml2.provider.<your-provider-name> Found in SplitSecure at Secure Accounts → SAML2 Identity Providers → [Your IdP] → Details as “SAML IdP Entity ID”
Sign-in page URL https://app.splitsecure.com/saml2/sp/login SplitSecure SSO endpoint
Sign-out page URL https://app.splitsecure.com/saml2/sp/logout SplitSecure logout endpoint
Change password URL https://app.splitsecure.com/saml2/sp/password-change Where users go to reset their password
Certificate (Upload X.509 certificate) Download from SplitSecure: Secure Accounts → SAML2 Identity Providers → [Your IdP] → Details → Download Certificate
  1. Click Upload certificate to upload the X.509 certificate from SplitSecure
  2. Click Save

4 Copy Service Provider (SP) Details

After saving, Google displays the SP Details section. Copy and save the Entity ID value - you’ll need it for SplitSecure configuration.

5 Configure Domain-specific Service URLs

  1. Navigate to Security → Authentication → Single sign-on (SSO) with third-party identity providers (IDPs)
  2. Click Domain-specific Service URLs
  3. Select Require users to enter their username on Google’s sign-in page first

6 Assign the SSO Profile to Users

  1. Navigate to Security → Authentication → SSO with third party IdP
  2. Click Manage SSO profile assignments
  3. Click Get started (first time) or Manage assignments
  4. Select the organizational unit or group to assign
  5. Under SSO profile assignment, choose Another SSO profile
  6. Select your newly created SplitSecure SAML profile from the dropdown
  7. Choose the sign-in option Prompt for Google username, then redirect to IdP
  8. Click Save

SplitSecure Configuration

1 Create the Google Workspace Secure Account

  1. In SplitSecure, navigate to Secure Accounts → Create Account → Google Workspace
  2. Enter a name for your account
  3. Select the Identity Provider used in the Google Workspace configuration
  4. Enter the SP entity ID (ACS URL will be automatically filled) from Part 1, Step 4
  5. Click Create Account

Test Authentication

1 Test Authentication (SP-Initiated)

  1. Navigate to a Google Workspace service (e.g., mail.google.com)
  2. Enter a user email address from an organizational unit assigned to the SSO profile
  3. You should be redirected to SplitSecure for authentication
  4. Enter your email address when prompted
  5. Click Request Access
  6. Complete the authentication flow

Troubleshooting

Issue Possible Cause Solution
User not redirected to IdP SSO profile not assigned Verify the user’s organizational unit has the SSO profile assigned
SAML assertion invalid Certificate mismatch Re-download the certificate from SplitSecure and re-upload to Google
User receives “Account not found” Email mismatch Ensure the SAML assertion email matches the Google Workspace email exactly
SSO works for some users but not others Partial OU assignment Check that all intended organizational units/groups have the profile assigned
“Sign in with Google” shown instead of SSO Direct Google service access Ensure sign-in option is set to redirect to IdP

External Resources