SSO assertion requirements

As the administrator, you need the elements and attributes listed in the following tables for SAML 2.0 SSO assertions returned to the Google Assertion Consumer Service (ACS) after the identity provider (IdP) has authenticated the user.

Return assertions to the ACS

Troubleshoot problems

To troubleshoot issues with these assertions, use the network inspector. For instructions, see the G Suite toolbox HAR Analyzer page

If you need to contact support, use a disposable test account because the HTTP Archive (HAR) capture contains the the username and password in clear text. Or, edit the file to delete sensitive interactions between the user and the IdP. Contact G Suite support.

The SAMLRequest sent to your IdP contains the relevant AssertionConsumerServiceURL. If your SAMLResponse is sent to another URL, there could be a configuration issue with your IdP.

Use elements and attributes

Name ID element

Field NameID element in the Subject element.
 
Description

NameID identifies the subject which is the user's primary email address. 

It is case-sensitive.

Required

Value

user@yourdomain.com
 
Example <saml:Subject>
<saml:NameID
SPNameQualifier="google.com/a/yourdomain.com"
Format="urn:oasis:names:tc:SAML:2.0:nameid-format:email"
>user@yourdomain.com</saml:NameID>
<saml:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer">
<saml:SubjectConfirmationData NotOnOrAfter="2014-11-05T17:37:07Z"
Recipient="https://www.google.com/a/yourdomain.com/acs"
InResponseTo="midihfjkfkpcmbmfhjoehbokhbkeapbbinldpeen"
</saml:SubjectConfirmation>
</saml:Subject>

Recipient attribute

Field Recipient attribute in the SubjectConfirmationData element
 
Description

Recipient specifies additional data required for the subject. 

It is case-sensitive.

Yourdomain.com is probably the primary domain of your G Suite or Cloud Identity account, even if the user being authenticated uses a secondary domain in the same G Suite or Cloud Identity account.

Required

Value

https://www.google.com/a/yourdomain.com/acs

or

https://accounts.google.com/a/yourdomain.com/acs

Example <saml:Subject>
<saml:NameID SPNameQualifier="google.com/a/yourdomain.com"
Format="urn:oasis:names:tc:SAML:2.0:nameid-format:email"
>user@yourdomain.com</saml:NameID>
<saml:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer">
<saml:SubjectConfirmationData NotOnOrAfter="2014-11-05T17:37:07Z"
Recipient="https://www.google.com/a/yourdomain.com/acs"
InResponseTo="midihfjkfkpcmbmfhjoehbokhbkeapbbinldpeen"
</saml:SubjectConfirmation>
</saml:Subject>

Audience element

Field Audience element in the AudienceRestriction parent element
Description

Audience is the uniform resource identifier (URI) that identifies the intended audience that requires the value of ACS URI.

Yourdomain.com is probably the primary domain of your G Suite or Cloud Identity account, even if the user being authenticated uses a secondary domain in the same G Suite or Cloud Identity account.

This element value can’t be empty.

Required

Value

https://www.google.com/a/yourdomain.com/acs

or

https://accounts.google.com/a/yourdomain.com/acs

Example

<saml:Conditions
NotBefore="2014-11-05T17:31:37Z"
NotOnOrAfter="2014-11-05T17:37:07Z">
<saml:AudienceRestriction>
<saml:Audience>https://wwww.google.com/a/yourdomain.com/acs</saml:Audience>
</saml:AudienceRestriction>
</saml:Conditions>

Destination attribute

Field Destination attribute of the Response element
 
Description

Destination is the URI of where the SAML assertion is being sent.

It is an optional attribute, but if it is declared, it will need a value of the ACS URI.

Yourdomain.com is probably the primary domain of your G Suite or Cloud Identity account, even if the user being authenticated uses a secondary domain in the same G Suite or Cloud Identity account.

Required

Value

https://www.google.com/a/yourdomain.com/acs 

or

https://accounts.google.com/a/yourdomain.com/acs

Example <samlp:Response xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"
xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"
ID="_7840062d379d82598d87ca04c8622f436bb03aa1c7"
Version="2.0"
IssueInstant="2014-11-05T17:32:07Z"
Destination="https://www.google.com/a/yourdomain.com/acs"
InResponseTo="midihfjkfkpcmbmfhjoehbokhbkeapbbinldpeen">
Was this helpful?
How can we improve it?