Google Workspace SSO Integration Guide

1. Access Google Admin Console

   1. Open the Google Admin Console: https://admin.google.com/.

   2. Log in using your administrator account.

2. Navigate to SSO Configuration

   From the Admin Console:

   1. Go to Security

   2. Select Authentication

   3. Click on SSO with third-party IdP

3. Enable SSO and Create OIDC Profile

   1. Enable SSO with third-party Identity Provider

   2. Create a new OIDC SSO Profile

      Configuration Details:

      • SSO Profile Name: ObserveID SSO
      • Client ID: (Provided by ObserveID team)
      • Client Secret: (Provided by ObserveID team)
      • Issuer URL: https://<CNAME>-login.observeid.com

4. Capture Redirect URI

   After creating the OIDC profile, Google will generate a Redirect URI.

   Example: https://accounts.google.com/oidcrp/<random-value>/cd

5. Share Configuration with ObserveID Team

   1. Provide the following details to the ObserveID team:

      • Redirect URI (generated by Google Workspace)

      This information is required to complete the integration from the ObserveID side.

6. Assign SSO Profile

   1. Go to Manage SSO profile assignments

   2. Assign the created OIDC profile to:

      Organizational Units (OU), or Specific users or groups

7. Enable Domain-Specific Redirection

   1. Navigate to Domain-specific Service URLs

   2. Enable: Automatically redirect users to the third-party IdP

   3. Select the created SSO profile (ObserveID SSO)

8. Validation

   Test the configuration using a domain-specific URL: https://mail.google.com/a/<your-domain>

   Expected behavior:

   • The user is redirected to ObserveID login page.
   • After successful authentication, the user is redirected back and logged into Google Workspace.