Set up SSO using 3rd party IdPs
Set up Single Sign-On (SSO) for G Suite accounts using third party identity providers
The SAML-based Federated SSO article describes the SAML instance where Google is the identity provider (IdP). This group of articles describes the SAML instance where Google is the service provider (SP) and uses 3rd party identity providers.
To set up Google service provider SAML with 3rd party IdPs, step through the process by following the blue links or the arrows above:
- Service provider SSO set up
- SAML key and verification certificate creation and upload
- SSO sign in
- Network Mapping results
SSO for G Suite support
SSO is available for G Suite Basic, G Suite Business, and G Suite for Education. It enables users to access all of their enterprise cloud applications—including administrators signing in to the Admin console—by signing in one time for all services. If a user tries to sign in to the Admin console or another Google service when SSO is set up, they are redirected to the SSO sign-in page.
We provide a Security Assertion Markup Language (SAML)-based SSO API that you can use to integrate into your Lightweight Directory Access Protocol (LDAP), or other SSO system. LDAP is a networking protocol for querying and modifying directory services running over TCP/IP.
SSO is also available on Chrome devices. For details, see Configure SAML Single Sign-On for Chrome Devices.
Clients such as Gmail for iOS, Drive for iOS, Chrome Browser Sync, Android setup, etc. use Google authentication. If you try to sign in with any of these clients, you are prompted for your full G Suite account email address (including username and domain) and you go directly to the application after you sign in. Google does not redirect you to the SSO sign-in page, regardless of the network mask.
With iOS applications, when the SSO Sign-in page URL starts with "google." (or some variation), the Google iOS app is redirected to Safari. This causes the SSO process to fail. The full list of forbidden prefixes is:
You'll need to change any SSO Sign-in page URLs with these prefixes.
How does the password change URL affect password changes?
If you specify a URL in the Change password URL option, all users, other than super administrators, who try to change their password at https://myaccount.google.com/ will be directed to the URL you specify. This setting applies even if you do not enable SSO. Also, network masks do not apply.
When the Change password URL option is set and you've selected the checkbox Setup SSO with third party identity provider, the Require a change of password in the next sign in checkbox to force a user to change their password when they next sign in is disabled.