# Google Workspace

> Integrate Google Workspace with Ironchip over SAML: create the application, set up the SSO profile in the Google admin console, and enable it for users.

URL: https://docs.ironchip.com/en/identidad/integraciones/saas/google-workspace/

Google Workspace integrates with Ironchip over the SAML protocol. The users you assign authenticate with the Ironchip second factor.

## Requirements

- Access to the Ironchip admin console.
- A user with permission to configure Google Workspace.

## Configure Ironchip

1. In the Ironchip admin console, go to **Applications**.

   [Image: Applications section of the Ironchip admin console]

2. Click **New application** and, on the **Custom application** card, click **Create application**.

   [Image: Custom application card with the Create application link]

3. Give it an identifying name, select the **SAML** type, and, if you want, add an image as the application logo. Don't close this tab.

   [Image: Custom application form with the SAML type]

4. Before you sign in to the Google admin console, download the Ironchip metadata file with **Download metadata file**.

   [Image: Download metadata file button in the Ironchip SAML service configuration]

## Configure Google Workspace

### Add the SAML profile

1. Sign in to the Google admin console and go to **Security** > **Authentication** > **SSO with third-party IdP**. Under **Third-party SSO profiles**, click **Add SAML profile**.

   [Image: Third-party SSO profiles in the Google admin console with the Add SAML profile button]

2. Open the metadata file you downloaded and fill in the **IDP details** fields with this data:
   - **IDP entity ID**: the `entityID` property of the `EntityDescriptor` XML tag.
   - **Sign-in page URL**: the `Location` property of the `SingleSignOnService` XML tag.
   - **Sign-out page URL**: the `Location` property of the `SingleLogoutService` XML tag.
   - **Verification certificate**: paste the content of the `X509Certificate` XML tag into the first field of [this tool](https://www.samltool.com/format_x509cert.php) and save the result in a new file with a `.crt` extension. The metadata contains two identical certificates: use either one. The tool adds the headers Google needs to detect the certificate as valid. Upload the file with **Upload certificate**.
3. Leave the remaining fields as default and save the changes.

   [Image: IDP details of the SAML profile with the entity ID, the sign-in and sign-out page URLs, and the Upload certificate button]

### Get the metadata URL for Ironchip

Ironchip asks for the URL of the service provider metadata. To get it, modify this code with the data from the Google SAML profile:

```xml
<?xml version="1.0" encoding="UTF-8"?>
<md:EntityDescriptor xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata" validUntil="2122-09-16T10:40:54Z" cacheDuration="PT604800S" entityID="google.com">
  <md:SPSSODescriptor AuthnRequestsSigned="false" WantAssertionsSigned="false" protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol">
    <md:NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress</md:NameIDFormat>
    <md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="https://www.google.com/a/<YOUR_DOMAIN>/acs" index="1" />
  </md:SPSSODescriptor>
</md:EntityDescriptor>
```

- Replace the content of `entityID` with the **Entity ID** shown under **SP details**.
- Replace the content of `Location` with the **ACS URL** shown under **SP details**.

[Image: Google SP details with the entity ID and the ACS URL]

When you have generated the file, upload it to a public internet address. Enter that URL, in raw format, in the **Metadata URL** field of the new application dialog in Ironchip.

### Enable SSO

1. In the Google admin console, go back to **Security** > **Authentication** > **SSO with third-party IdP**.
2. Click **Manage SSO profile assignments**.
3. On the left, configure the groups or individuals who authenticate with the Ironchip second factor.
4. Configure those same users in the SAML application you created in Ironchip.

## Verify the integration

1. Ask a user or group you assigned to sign in to a Google Workspace service.
2. Google redirects them to Ironchip to authenticate with the second factor.
3. When the user completes the authentication, they return to Google with their session started.

## Video

Video: [Integrating Google Workspace with Ironchip over SAML](https://play.hubspotvideo.com/v/7745202/id/145628858261)