SSO assertion requirements
As the administrator, you need the elements and attributes listed in the following tables for SAML 2.0 SSO assertions returned to the Google Assertion Consumer Service (ACS) after the identity provider (IdP) has authenticated the user.
Return assertions to the ACS
Troubleshoot problems
If you need to contact support, use a disposable test account because the HTTP Archive (HAR) capture contains the the username and password in clear text. Or, edit the file to delete sensitive interactions between the user and the IdP. Contact G Suite support.
The SAMLRequest sent to your IdP contains the relevant AssertionConsumerServiceURL. If your SAMLResponse is sent to another URL, there could be a configuration issue with your IdP.
Use elements and attributes
Name ID element
| Field | NameID element in the Subject element. |
|---|---|
| Description |
NameID identifies the subject which is the user's primary email address. It is case-sensitive. |
|
Required Value |
user@yourdomain.com |
| Example | <saml:Subject> |
Recipient attribute
| Field | Recipient attribute in the SubjectConfirmationData element |
|---|---|
| Description |
Recipient specifies additional data required for the subject. It is case-sensitive. Yourdomain.com is probably the primary domain of your G Suite or Cloud Identity account, even if the user being authenticated uses a secondary domain in the same G Suite or Cloud Identity account. |
|
Required Value |
https://www.google.com/a/yourdomain.com/acs or https://accounts.google.com/a/yourdomain.com/acs |
| Example | <saml:Subject> |
Audience element
| Field | Audience element in the AudienceRestriction parent element |
|---|---|
| Description |
Audience is the uniform resource identifier (URI) that identifies the intended audience that requires the value of ACS URI. Yourdomain.com is probably the primary domain of your G Suite or Cloud Identity account, even if the user being authenticated uses a secondary domain in the same G Suite or Cloud Identity account. This element value can’t be empty. |
|
Required Value |
https://www.google.com/a/yourdomain.com/acs or https://accounts.google.com/a/yourdomain.com/acs |
| Example |
|
Destination attribute
| Field | Destination attribute of the Response element |
|---|---|
| Description |
Destination is the URI of where the SAML assertion is being sent. It is an optional attribute, but if it is declared, it will need a value of the ACS URI. Yourdomain.com is probably the primary domain of your G Suite or Cloud Identity account, even if the user being authenticated uses a secondary domain in the same G Suite or Cloud Identity account. |
|
Required Value |
https://www.google.com/a/yourdomain.com/acs or https://accounts.google.com/a/yourdomain.com/acs |
| Example | <samlp:Response xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" |
