Cloud · Single sign-on · 04
Set up single sign-on with Google Workspace
Connect Google Workspace to Zym Labs over SAML, test it and turn it on.
This guide connects Google Workspace to your organization, so your team signs in to Zym Labs with their Google work account. You'll add Zym Labs as a custom SAML app in the Google Admin console, upload its metadata file to Cloud, test a sign-in and turn the connection on. It takes about 20 minutes.
You need to be an organization owner or admin in Cloud; an owner turns the connection on. In Google Workspace you need to be a super admin, or an admin who can manage apps.
Before you start
- A verified domain in your organization. See Verify a domain.
- Your own account at your identity provider on that domain, to test with.
- How single sign-on works, if you haven't read it: it explains what turning the connection on changes for your team.
Steps
Start the connection in Cloud
In your organization, open Single sign-on and choose Set up SSO (or New connection). Choose Google Workspace, and under Domain this connection signs in, choose your domain. Keep this page open.
Add a custom SAML app in Google
In the Google Admin console, open Apps › Web and mobile apps, then Add app › Add custom SAML app. Name it Zym Labs. On the next screen, download the IdP metadata: you'll upload it to Cloud. Continue.
Paste Zym Labs' values
Under Service provider details, paste the values Cloud shows: the Reply URL as the ACS URL, and https://idp.zymlabs.cloud/realms/zymlabs-cloud as the Entity ID. Set Name ID format to EMAIL, and map the attributes firstName and lastName.
Then turn the app ON for everyone, or for the right groups, under User access.
Upload the metadata to Cloud
In Cloud, choose I've done this, open the Upload XML tab and choose the metadata file you downloaded. Google Workspace gives a file, not a URL, so upload a new one whenever Google's certificate changes: Cloud warns you 30 days before it expires.
Check the attributes
Cloud fills in the attribute names for Email, First name and Last name. Change them only if your directory sends something different, then continue.
Test a sign-in
Choose Start test sign-in and sign in with your own work account in the window Cloud opens. When it works, Cloud shows Passed and what your provider sent for each attribute. To test with someone else's account, see Test a connection.
Turn it on
An owner chooses Activate connection. If you're an admin, choose Save as draft, and an owner can activate it later from Single sign-on. Passwords keep working until you require single sign-on.
What's next
- Require single sign-on: send everyone on your domain to Google.
- Troubleshoot single sign-on: when a test or a sign-in fails.