SAML 2.0 - GCP

Google's configuration requires a SAML Application (for login) and a Service Account with domain-wide delegation (for user provisioning).

Part A: SAML Authentication (Login)

1. Go to the Google Admin Console (admin.google.com).

2. Go to Apps > Web and mobile apps.

3. Click Add app > Add custom SAML app.

4. Download metadata: On the "Google Identity Provider details" screen, click "Download Metadata".

   • Upload this file (e.g. google-metadata.xml) to an accessible path on your server (e.g. /opt/anjana/config/saml/).

5. Configure SP data (your application):

   • Entity ID: identificador-unico-para-saml (unique and must match the yml).

   • ACS URL: https://dev.anjanadata.org/gateway/saml2/sso/devgcp (the key devgcp matches the one used in the yml below).

6. Activate the application: Turn on "User access" for the users or groups that need access.

Part B: User Provisioning (user list)

1. Go to the Google Cloud Console (console.cloud.google.com).

2. Go to IAM & Admin > Service Accounts and create a new account.

3. Generate a JSON key for this service account.

   • jsonPath / jsonContent: Upload this JSON file to your server (file:/...) or paste its content into the yml.

4. Copy the "Unique ID" (Client ID) of the service account.

Domain-wide delegation

1. Go back to the Google Admin Console (admin.google.com).

2. Go to Security > Access and data control > API controls.

3. Click "Manage Domain Wide Delegation".

4. Add a new delegation:

   • Client ID: Paste the "Unique ID" of your service account.

   • OAuth Scopes: Paste this list (comma-separated): https://www.googleapis.com/auth/admin.directory.user.readonly,https://www.googleapis.com/auth/admin.directory.group.readonly,https://www.googleapis.com/auth/admin.directory.group.member.readonly

Final data for the yml

• delegatedUser: Email of a Google Super Administrator account (e.g. admin@su-dominio.com).

• groupnames: Emails/identifiers of Google groups with users who have access (e.g. usuarios-anjana@su-dominio.com).

• application-name: Application name for audits in Google Workspace

Example application-default.yml file

This example details the SAML-specific properties for GCP. The properties common to all providers are found in SAML 2.0 (Deprecated)

security:
  provisioning:
    providers:
      google:
        # The key 'devgcp' must be IDENTICAL to the key used in 'saml2'
        devgcp:
          # Email of a Google Super Administrator account
          delegated-user: <delegatedUser>
          # Application name for audits in Google Workspace
          application-name: <appName>
          # Emails/identifiers of Google groups with users who have access
          groupNames:
            - <group1>
            - <group2>
          # JSON with the required authentication content, can be obtained directly from GCP
          json-content: |
            {
              <content>
            }
          # Path where the JSON with the authentication content is located, can be used instead of json-content
          json-path: /opt/AAAAA-aaabbbccc.json # absolute path --> /xxxxxx.json