Configuring Google Workspace SAML Login

Google Workspace can be a SAML identity provider (IdP) for Ubersmith. Your users can then log in to Ubersmith with their Google Workspace account.

To set up Google Workspace login, do these tasks:

1. Add a custom SAML app in the Google Admin console.
2. Add a SAML authentication module in Ubersmith.
3. Optional: Match Google Workspace groups to Ubersmith roles.

In this article, replace ubersmith.example.com with the domain name of your Ubersmith.

Add a custom SAML app in Google Workspace

In the Google Admin console, add a custom SAML app. For more information, refer to the Google Workspace help about custom SAML apps.

1. On the App details page, in App name, type Ubersmith. Optional: add an app icon. Click Continue.

2. On the Google Identity Provider details page, copy the SSO URL, the Entity ID, and the Certificate. You type these values in Ubersmith later. Click Continue.

3. On the Service provider details page, complete these fields:

   Field	Value
   ACS URL	https://ubersmith.example.com
   Entity ID	https://ubersmith.example.com
   Start URL	Leave empty.
   Signed response	Select it.
   Name ID format	EMAIL
   Name ID	Basic Information > Primary email

   Click Continue.

4. On the Attribute mapping page, add these attributes:

   Google Directory attribute	App attribute
   Basic Information > Primary email	EMAIL
   Basic Information > First name	FIRST
   Basic Information > Last name	LAST
   Employee Details > Department	DEPARTMENT

   Click Finish.

5. Turn on the app for your users. In the Google Admin console, open the app. In User access, set the service status to ON for the users or organizational units that use Ubersmith. Google Workspace adds a new custom SAML app with the status OFF.

Add the SAML authentication module in Ubersmith

1. Go to Settings > User Authentication.
2. In the Authentication Modules section, click Add New Authentication Module. The Add Authentication Module window opens.
3. On the Details tab, complete these fields:

• Enabled: YES.

• Module: SAML.

• Priority: the order in which Ubersmith uses the authentication modules. Ubersmith uses the lowest number first.

• Create User on Login: select it if Ubersmith must add a user the first time that a person logs in with Google Workspace. If you do not select it, the user must already exist in Ubersmith.

  

1. Click the Config tab, then complete the fields. See the table below.
2. Click Save.

Keep the default values for the other fields. Keep Enable SAML Module Strict mode set to YES.

If Ubersmith is behind a load balancer or a proxy, set Use "X-Forwarded-*" HTTP headers to YES. Then Ubersmith uses the public URL to check the SAML response.

How users log in

The Ubersmith login page shows a link with the IdP Display Name and the IdP Icon. When a user clicks the link, Google Workspace asks the user to log in. Then Google Workspace sends the user back to Ubersmith.

Ubersmith finds the user whose Login Name is the same as the primary email of the Google Workspace account. If no user has that login name:

• If Create User on Login is selected, Ubersmith adds the user. Ubersmith uses the first name, the last name, and the email from Google Workspace.
• If Create User on Login is not selected, Ubersmith shows "Invalid login or password."

Match Google Workspace departments to Ubersmith roles

The Permission Group Attribute Name sends the department of the user from Google Workspace. You can match each department to an Ubersmith role.

1. Go to Settings > User Authentication.
2. In the row of the SAML module, click edit access.
3. In the blank row, type the name of the department exactly as it is in Google Workspace.
4. Select the Role and the brand access.
5. Click Update.

For more information, refer to the article "Managing Authentication Modules".