Google Workspace

Google Workspace integrates with Ironchip over the SAML protocol. The users you assign authenticate with the Ironchip second factor.

Requirements

• Access to the Ironchip admin console.
• A user with permission to configure Google Workspace.

Configure Ironchip

1. In the Ironchip admin console, go to Applications.

   

2. Click New application and, on the Custom application card, click Create application.

   

3. Give it an identifying name, select the SAML type, and, if you want, add an image as the application logo. Don’t close this tab.

   

4. Before you sign in to the Google admin console, download the Ironchip metadata file with Download metadata file.

   

Configure Google Workspace

Add the SAML profile

1. Sign in to the Google admin console and go to Security > Authentication > SSO with third-party IdP. Under Third-party SSO profiles, click Add SAML profile.

   

2. Open the metadata file you downloaded and fill in the IDP details fields with this data:

   • IDP entity ID: the entityID property of the EntityDescriptor XML tag.
   • Sign-in page URL: the Location property of the SingleSignOnService XML tag.
   • Sign-out page URL: the Location property of the SingleLogoutService XML tag.
   • Verification certificate: paste the content of the X509Certificate XML tag into the first field of this tool and save the result in a new file with a .crt extension. The metadata contains two identical certificates: use either one. The tool adds the headers Google needs to detect the certificate as valid. Upload the file with Upload certificate.

3. Leave the remaining fields as default and save the changes.

   

Get the metadata URL for Ironchip

Ironchip asks for the URL of the service provider metadata. To get it, modify this code with the data from the Google SAML profile:

<?xml version="1.0" encoding="UTF-8"?>
<md:EntityDescriptor xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata" validUntil="2122-09-16T10:40:54Z" cacheDuration="PT604800S" entityID="google.com">
  <md:SPSSODescriptor AuthnRequestsSigned="false" WantAssertionsSigned="false" protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol">
    <md:NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress</md:NameIDFormat>
    <md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="https://www.google.com/a/<YOUR_DOMAIN>/acs" index="1" />
  </md:SPSSODescriptor>
</md:EntityDescriptor>

• Replace the content of entityID with the Entity ID shown under SP details.
• Replace the content of Location with the ACS URL shown under SP details.

When you have generated the file, upload it to a public internet address. Enter that URL, in raw format, in the Metadata URL field of the new application dialog in Ironchip.

Enable SSO

1. In the Google admin console, go back to Security > Authentication > SSO with third-party IdP.
2. Click Manage SSO profile assignments.
3. On the left, configure the groups or individuals who authenticate with the Ironchip second factor.
4. Configure those same users in the SAML application you created in Ironchip.

Verify the integration

1. Ask a user or group you assigned to sign in to a Google Workspace service.
2. Google redirects them to Ironchip to authenticate with the second factor.
3. When the user completes the authentication, they return to Google with their session started.

Video

Integrating Google Workspace with Ironchip over SAMLPlay video