Oxelone Docs

Search docs and API

Find a guide, a section of one, or an API operation by its name.

Open console (opens in a new tab)

Administration Google Workspace

Single sign-on with Google Workspace

This page connects Google Workspace to Oxelone over SAML 2.0. It uses the values on Single sign-on, so read that page first for who can do this and what each setting means. You need the Owner role in Oxelone and a super administrator account in Google Workspace.

Set it up

  1. In Oxelone, open Settings › Access › Single sign-on and set Protocol to SAML 2.0. Leave the page open. It shows the ACS URL and the Entity ID.

  2. In the Google Admin console, go to Apps › Web and mobile apps, choose Add App › Add custom SAML app, and name the app.

  3. On the Google Identity Provider details page, choose Download Metadata (the IDP metadata) and open the file.

  4. Back in Oxelone, paste the file's contents into IdP metadata.

  5. In Google, continue to the Service Provider Details page and map the console's values to Google's fields:

    OxeloneGoogle Workspace
    ACS URLACS URL
    Entity IDEntity ID

  6. Leave Name ID on its default, the primary email address. Oxelone identifies people by email address. Choose Finish.

  7. Turn the app on. Under Apps › Web and mobile apps, select the app, choose User access, and set On for everyone, or set Service status to On per unit. Choose Save.

  8. In Oxelone, add your Email domains, choose Test connection, switch on Sign in with SSO and choose Save.

Sign in once from Oxelone's sign-in page, with Continue with SSO, before you turn on Require SSO. Google's Test SAML login starts from Google's side. Oxelone refuses a response it did not ask for, so use it only to check that Google can sign the person in, not to test Oxelone.

When it goes wrong

  • The IdP metadata isn't valid SAML metadata. The text pasted is not Google's metadata. Download it again and paste all of it.
  • The IdP's signing certificate has expired. Download current metadata from Google and paste it.
  • Your identity provider's answer couldn't be verified. Try again, or ask your administrator. (on the sign-in page) The ACS URL or Entity ID in Google does not match the console's exactly.
  • You're not a member of this workspace yet. Ask an owner to invite you. (on the sign-in page) The person can use the app in Google but Create members on first sign-in is off in Oxelone.

The other messages are listed on Single sign-on.

With the API

Not available with an API key.

Google's own documentation