Skip to main content
owlie
Sign Up Free

Configure Google Workspace SAML SSO

Who this is for​

Google Workspace and Owlie administrators creating a custom SAML application for one Owlie tenant.

Goal​

Configure Google as the tenant's SAML identity provider and validate SP-initiated sign-in.

Prereqs​

  • Google Workspace super administrator access
  • The SAML SSO overview
  • A test user with a primary email in an Owlie allowed domain

Success criteria​

The Owlie login page redirects the assigned user to Google and receives a valid assertion at the tenant-specific ACS URL.

Create the Google custom SAML app​

  1. In Owlie, open Tenant Settings → Authentication → Login methods and copy the ACS URL and SP entity ID.
  2. In Google Admin console, open Apps → Web and mobile apps, select Add app, then Add custom SAML app.
  3. Name the app for its Owlie tenant and download or copy Google's IdP metadata details.
  4. Set ACS URL to Owlie's ACS URL and Entity ID to Owlie's SP entity ID.
  5. Set Name ID to Primary email and choose the email-address format when offered.
  6. Add optional first-name, last-name, and display-name mappings only if required.
  7. Turn service access on for the test user or a pilot organizational unit/group.

Configure Owlie​

  1. In Owlie's SAML 2.0 panel, enable SAML SSO, set a Display label, and add Allowed domains.
  2. Choose Metadata URL when Google supplies a direct HTTPS metadata URL. Otherwise choose Manual entry and enter Google's IdP entity ID, IdP SSO URL, and PEM Signing certificate from the downloaded metadata.
  3. When using a metadata URL, select Fetch metadata. In Confirm SAML metadata trust, compare current and incoming entity ID and SSO host, and verify every certificate's SHA-256 fingerprint, subject, and expiry. Owlie deliberately does not verify metadata signatures in v1.
  4. Select Confirm and save trust. Owlie re-fetches and refuses to save if the trust changed after preview. Configure email trust and JIT, then select Save changes for any remaining edits. For manual entry, review the typed trust values before Save changes.
  5. Test from https://<tenant>.<root-domain>/auth/login in a private window. Do not use Google's app tile: Owlie v1 supports SP-initiated sign-in only.

Default configuration​

  • Use Google primary email as NameID and leave optional profile mappings empty.

When to change it​

  • Add explicit mappings if Google sends custom schema attributes.
  • Add the replacement certificate before Google's current certificate expires. During overlap, Owlie skips an unusable old certificate while a valid sibling remains usable.

Impact and risks​

  • Enabling the app for a broad organizational unit exposes the sign-in option broadly; Owlie's allowed-domain and JIT controls remain the admission boundary.

Example​

Enable the custom app for a pilot group, allow example.com, and test one primary-email account before expanding Google service status.

Troubleshooting​

  • Google app tile fails: start at the Owlie login page; IdP-initiated SSO is not supported.
  • Certificate error: export the current Google IdP certificate as PEM and add it in Owlie.
  • User rejected: confirm Google service access, primary email, allowed domain, and JIT settings. If SAML links were reset while asserted-email trust is disabled, Owlie refuses automatic linking; reset also cannot merge a duplicate identity.

Assumptions & Questions​

  • Google Admin console paths and metadata download labels can change. Confirm them against the live console and verify whether your domain exposes a direct metadata URL or only a download.

Next steps​