Tutorial: How to Configure SAML with Google Workspace for VPN Authentication⁠

You need the following to get started:

• A Google Workspace.

• A deployed Access Server.

With Google Workspace, you must create a SAML integration application.

First, gather information about your Access Server as the service provider (SP).

1. Sign in to your Access Server Admin Web UI.

2. Select Authentication → SAML.

3. You'll need the following information:

   1. SP Identity.

   2. SP ACS.

Now that you have your SP information, you can create a new Google Workspace app and enter that information during app creation:

1. Sign in to your Google Workspace Admin Console.

2. From the hamburger menu, click Apps > Web and mobile apps.

3. Click Add app > Add custom SAML app.

4. Enter the app’s name, description, and icon, then click Continue.

5. Click DOWNLOAD METADATA under Option 1: Download IdP metadata.

6. Save the XML file to use in step 2 below and click Continue.

7. Use the SP information from Access Server to enter the following into the Google app:

   • ACS URL: Enter the Access Server SP ACS.

   • Entity ID: Enter the Access Server SP Identity.

   • Start URL: Enter ‘cws’ for the Client Web UI or ‘profile’ to provide users with a downloadable profile. (See "How to set up IdP-initiated flow" below for more details.)

   • Click Continue.

8. Configure attribute mapping (such as “Primary email” = “email”) on the next screen and click Finish.

You can now enable SAML as the global default authentication or for specific groups and users.

You can configure an IdP-initiated flow for signing into Access Server from Google Workspace with the following steps:

1. Sign in to the Google Workspace admin console.

2. Click Apps > Web and mobile apps, and click on your custom SAML app.

3. Click the arrow to expand Service provider details.

4. Add one of the following to Start URL:

   1. cws: This directs your users to the Client Web UI after sign-in.

   2. profile: This directs your users to a profile download after sign-in.

5. Click Save.

   • Users find the app available in their Google apps.

You can automate group assignments for access control rules using a post-authentication Python script.

Refer to the steps in this tutorial:

• Tutorial: How to Set Up SAML Group Mapping with a Post-Auth Script