Google SSO
Access Type: Organization Settings - Editor
Premium Feature: SSO
Single Sign-On (SSO) is an authentication process that allows users to access multiple applications or systems with one set of login credentials. In this article, we will cover how to configure SSO using the SAML 2.0 standard protocol with Google.
Retrieve SSO SAML identifiers
To start, your organization needs to retrieve the SSO SAML identifiers from the Didomi console to continue setup in your identity provider.
Click My organization and selecting Single Sign-on from the drop-down menu.
Use the provided fields in the Get your SSO SAML identifiers step to record the following:
Configured issuer
Your organization's identity provider's unique identifier within the Didomi console.
Login URL
Where user will be redirected after successful login on the identity provider.
Click Continue when finished.
Create Didomi console app in Google
Before configuring SSO your organization will need to add a Didomi console app in your Google account. While signed into your Google Admin console from a super administrator account:
Navigate to Apps > Web and mobile apps.
Click Add app.
Select Add custom SAML app.
In app name, enter a name for your new application that is recognizable as being for the Didomi console (e.g. Didomi Console). This is where your organization will configure the SSO SAML.
Click Continue.
Retrieve Didomi console app metadata from Google
The Google Identity Provider details page will provide your organization with the following information the Didomi needs to configure SSO. Record the values for the following fields (collectively Didomi refers to these values as metadata):
SSO URL
X.509 certificate
Click Continue when finished.
Add Didomi SSO SAML identifiers and attributes
From the Service Provider Details window, input the Didomi SSO SAML identifiers in the appropriate provided fields:
Assertion Consumer Service (ACS) URL
Login URL
Entity ID
Configured issuer
Additionally, set the following configuration for the following fields:
Name ID format
Name ID value
Basic information > Primary email
Under Attribute mapping, click Add another mapping to map additional attributes.
From Google Director attributes, select Primary Email
For App attributes: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress
Click Finish.
Add Google metadata
With the metadata from Google copied, navigate back to the SSO configuration within the Didomi console and input those values in the provided fields for the Setup SSO settings step.
X509 certificate
X.509 certificate
Login URL
SSO URL
Click Continue when finished.
Test and complete SSO configuration
Didomi will verify the identity provider metadata. When successful, utilize the Domain(s) field to add email domains to which the SAML authentication will be restricted (i.e. only users whose emails have this domain will be allowed to login with SSO SAML).
For security, the domain added to the Domain(s) field must match the email domain of the user performing the configuration (e.g. didomi.io can only be added if the user adding it is signed into the Didomi console using an @didomi.io email address.
To add more than one domain, please contact the Didomi support team via chat or email at [email protected].
Click Save settings. Once enabled, it may take up to 24 hours for the configuration to be in effect.
Enable Didomi console app SAML app in Google
Once the SSO configuration is complete and tested, your organization can manage access to the Didomi console by performing the following:
Navigate to Apps > Web and mobile apps.
Select the Didomi console app
Click User access.
Follow Google instructions on managing access.
Last updated