Subscribe to PortalGuard's Quarterly Newsletter for News & Updates on the Latest Release! Click to Subscribe

SAML Integration with G Suite (Google Apps)


Problem

You want to integrate G Suite (Google Apps) for Single Sign-On via your PortalGuard Identity Provider.

Solution

Create a new SAML Relying Party within the Identity Provider Configuration Editor and make the necessary changes within the G Suite (Google Apps) Admin Dashboard panel.

  1. Navigate to the PortalGuard server and open the Identity Provider Configuration Editor.
  2. Navigate to the SAML Websites tab and click on the 'Create' button to create a new Relying Party Configuration.
  3. Give the new Relying Party a 'Name' and 'Description' that makes sense for this application (i.e. G Suite, Google Apps or Prod Google Domain, etc.).
  4. Next to 'Identifiers' click on the 'Add' button.
    • You will need to add two (2) identifiers here:
      • google.com
      • google.com/a/<your.google.apps.domain>
        • Replace the final portion of this identifier with your G Suite (Google Apps) domain (i.e. google.com/a/portalguard.int)
  5. For the 'Assertion Consumer URL', use the following format:
    • https://www.google.com/a/<your.google.domain>/acs
      • Important Note: You MUST include the 'www.' portion of the URL, otherwise the integration will fail. 
      • As in step #4, ensure that you update the URL with the appropriate google domain (i.e. https://google.com/a/portalguard.int/acs)
  6. Your final result should resemble the following:
    • PortalGuard SSO - Google Apps - IdP General Tab
  7. Navigate to the Identity Claimstab.
  8. Ensure the correct 'Attribute Store' is selected.
    • This value will determine where user information is pulled from during SSO Authentication.
  9. Click the 'Create' button to add a new Identity Claim to this Relying Party configuration.
  10. In the new window, input 'EmailAsNameID' for the 'Name' field.
  11. Ensure the 'Send as NameID?' box IS CHECKED. 
  12. For the 'Schema Type' click on the 'Pre-defined Types...' button and choose the following entry from the drop-down:
    • urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress
  13. Leave 'Value Type' set  to 'String Field'.
  14. Update the 'Field Name' to 'mail' (without the quotation marks).
  15. Your end result should resemble the following:
    • PortalGuard SSO - EmailAsNameID Claim
  16. Click 'Save'.
  17. Click the 'Create' button to add a new Identity Claim to this Relying Party configuration.
  18. In the new window, input 'Email' for the 'Name' field.
  19. Ensure the 'Send as NameID?' box IS NOT CHECKED. 
  20. For the 'Schema Type' click on the 'Pre-defined Types...' button and choose the following entry from the drop-down:
    • http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress
  21. Leave the 'Value Type' set to 'String Field'.
  22. Update the 'Field Name' to 'mail' (without quotation marks).
  23. Your end result should resemble the following:
    • PortalGuard SSO - Standard Email Claim
  24. Important Note: The main differences between these two claims are as follows:
    • The first is marked as 'NameID' while the second is not.
    • The 'Schema Type' differs between the two claims. 
      • Both claims are required for SSO to Google Apps.
  25. Click 'Save'.
  26. Navigate to the IdP-Initiated tab.
    • Display Text:
      • This is the label of the tile that your users will see on the PortalGuard SSO Jump Page.
    • Help Text:
      • This is the information that will appear if users hover over the tile but do not click on it. 
    • Display Image:
      • Click on 'Choose Image' and browse to the thumbnail image that you would like to display on the PortalGuard SSO Jump Page.  If you prefer to add your own image instead of the provided thumbnail for G Suite (Google Apps), simply paste the new image into the C:\inetpub\PortalGuard\sso\img\ folder and select it here. 
  27. Navigate to the Response tab.
  28. Update the 'Default RelayState' with an entry using the following format:
    • http://mail.google.com/a/<your.google.domain>
      • Be sure to replace the final portion of this URL with your G Suite (Google Apps) domain (i.e. http://mail.google.com/a/portalguard.int)
      • This will be used for IdP-Initiated Single Sign-On to redirect users to Gmail when the tile is clicked on the PortalGuard SSO Jump Page.
  29. Your final result should resemble the following:
    • PortalGuard SSO - Google - Response Tab
  30. Click the main 'Save' button to save this configuration.
  31. From the main screen of the Identity Provider Configuration Editor, click the 'Apply to Identity Provider' button. 
  32. Click the 'Sync' button.
  33. Save a copy of the 'PG_IdP.cer' file from your PortalGuard server to the machine from which you will be making the administrative changes on the Google Domain. This file will be necessary to complete the integration. 
    • The default location for the 'PG_IdP.cer' file is C:\Program Files\PistolStar\PortalGuard\
  34. Navigate to the G Suite Admin Dashboard Panel.
    • i.e. https://www.google.com/a/cpanel/<your.google.domain>/Dashboard
  35. Click on the 'Security' link:
    • PortalGuard SSO - Google Apps - Admin Page Security
  36. Click on the 'Set up single sign-on (SSO)' link:
    • PortalGuard SSO - Google Apps - Admin Page SSO Link
  37. In the new section that appears, scroll down and click on the checkbox labeled 'Setup SSO with third party identity provider'.
  38. Next to 'Verification Certificate' click on the 'Upload Certificate' link and select the 'PG_IdP.cer' file that was copied over from the PortalGuard server in step #33 above.
  39. Update the remaining fields as noted here (replace YOUR.PORTALGUARD.SERVER in each URL with the base URL to your PortalGuard server/website):
    • Sign-in page URL:
      • https://YOUR.PORTALGUARD.SERVER/sso/go.ashx
    • Sign-out page URL:
      • https://YOUR.PORTALGUARD.SERVER/_layouts/PG/signout.aspx?ReturnURL=%2fsso%2fdefault.aspx
    • Change password URL:
      • https://YOUR.PORTALGUARD.SERVER/_layouts/PG/login.aspx?ReturnURL=%2fdefault.aspx&pgautopop=2
  40. Your final result should resemble the following:
    • PortalGuard SSO - Google Apps - Admin Page Third Party
  41. Click the 'Save' button to commit the changes. 
    • Google SSO is either On or Off.  If you click 'Save' with the 'Setup SSO with a third party identity provider' box checked, SSO will be 'On'.  If you click 'Save' with the same box unchecked, SSO will be 'Off'. 
  42. Test the login by attempting to login to a Google Service with an email address in the now integrated domain OR login to PortalGuard and click on the G Suite (Google Apps) link on the SSO Jump Page.

REV. 09/2018 | PortalGuard

  • 67
  • 28-Sep-2018
  • 865 Views