In this guide, you will learn how to set up Google with WorkBright via SAML 2.0.
Note: If you are looking for provisioning users via SCIM, WorkBright does not yet support SCIM Provisioning via Google.
Configuring Google SAML
Choose Web and mobile apps
As an admin, log in to Google at https://admin.google.com, click Apps on the side-bar, and click Web and Mobile Apps
Choose Add custom SAML app
Click "Add app" and choose "Add custom SAML app" from the drop-down
1. Fill in App Details
Enter the App name and the Description. These can be whatever you prefer. You can also upload an App icon.
Here is an example filled in. Please make sure to use your own details.
2. Copy Google IdP Details to WorkBright
The next step includes all the URLs and codes you need to enter into the WorkBright app.
These values need to be put into the Admin -> Single Sign-on section of the Settings page at WorkBright.
Click the Settings tab at the top of your screen.
From the settings screen, navigate to the security section of the side bar and select Single Sign-on to view the configuration page.
NOTE: If you don't see the configuration options as seen in the screenshot below, reach out to [email protected] or fill in the form to request that the SSO Access feature be turned on for your account.
Once on the configuration page, copy and paste the values from your Google App page into the correct places on the WorkBright Single Sign-on form:
Choose Google from the WorkBright Identity Provider (IdP) dropdown
NOTE: if you do not see Google listed there, contact your Customer Success representative at WorkBright to enable Google SAML on your account
Google's SSO URL goes into the WorkBright SSO Target Url field
Google's Entity ID goes into the WorkBright IdP Entity ID field
Google's SHA-256 fingerprint goes into the WorkBright IdP Certification Fingerprint field
Copy the value http://www.w3.org/2000/09/xmldsig#sha256 and paste it into the WorkBright IdP Fingerprint Algorithm field
You can leave the WorkBright Authentication Context field blank
Click Submit at the bottom of the WorkBright form. You should see a green banner message:
3. Fill in Service Provider Details
Click the CONTINUE button at Google to advance to Step 3: Service provider details.
Copy and paste the values from the WorkBright Service Provider Settings (below the Configure SSO for SAML section) into the correct places at Google's form:
You only need the ACS URL and the Entity ID. The Start URL is optional.
The Name ID section can be left as-is. The Primary Email is the best way to communicate from Google to WorkBright during an SSO SAML session.
4. Attribute Mapping
Click the CONTINUE button at Google to advance to Step 4: Attribute mapping.
Note: WorkBright currently does not support additional attributes from the IdP at this time, so you can leave this page as-is and click the FINISH button to complete your configuration.
This will save your configuration and show you a summary screen, like this one:
5. Activate User Access
Click the "View details" link in the User access section to show access details and enable access for the users and groups you desire.
Turn on Service status for everyone or for certain groups/organizational units.
Be sure to click SAVE on the right when you are done.