Skip to main content

SAML Setup for Google Workspace SSO

To set up TrustLayer access via SSO in Google Workspace, perform the following steps

Configure the app in Google Workspace

  1. In the Google Admin console, go to Apps → Web and mobile apps.

  2. Click Add app → Add custom SAML app.

  3. Enter TrustLayer as the app name. Complete the remaining information with a description and an image to easily identify the app, then click Continue.

  4. On the Google Identity Provider details screen, copy the SSO URL and Entity ID, and download the Certificate — you will need these in TrustLayer.

  5. Fill in the Service provider details:

    • ACS URL → https://auth.trustlayer.io/__/auth/handler

    • Entity ID → trustlayer.io

    • Name ID format → EMAIL

    • Name ID → Basic Information > Primary email

  6. In SAML attribute mapping, map the Google Directory attributes to the app attributes as follows:

Google Directory attribute

App attribute

First name

firstName

Last name

lastName

  1. Finish the wizard, then turn the app ON for everyone (or for the organizational units that should have access) under User access.

Create the configuration in TrustLayer

  1. In TrustLayer, go to Settings → Single Sign-On (visible to workspace Owners) and click Create configuration.

  2. Select SAML 2.0 and fill in:

    • Entity ID → the Entity ID copied in step 4

    • Single sign-on URL → the SSO URL copied in step 4

    • Certificate → the contents of the certificate downloaded in step 4

    • Domains → the email domain(s) you want SAML login for (e.g. yourdomain.com)

  3. Save, then verify each domain by adding the DNS TXT record shown on the page (record name @) and clicking Verify. DNS changes can take up to 48 hours to propagate.

  4. Once at least one domain is verified, go to the Activation card on the same page and click Turn on single sign-on. Verifying a domain proves that you own it; it does not switch single sign-on on by itself.

From then on, all users with emails on your activated domains will be redirected to Google when they log in, and will be able to access TrustLayer if they have the app assigned. See Setting Up SSO (Single Sign-On) for how to add domains later or turn single sign-on off again.

Did this answer your question?