When you create a Cerby workspace, you can configure Google as your identity provider (IdP) to provide single sign-on (SSO) authentication for the users of your corporate directory. This integration enables seamless authentication, as users securely log in to Cerby with one set of credentials.

This article describes how to configure your Google Workspace as the primary IdP to enable SSO using a custom security assertion markup language (SAML) app for Cerby.

Supported features

The following are the supported features of configuring SSO between Cerby and Google Workspace:

Control who has access to Cerby from Google Workspace.
Service provider-initiated authentication flow: This authentication flow occurs when users attempt to log in to the app from Cerby.

Requirements

The following are the requirements to configure SSO between Cerby and Google:

A Google Workspace tenant
A user account in Google Workspace with the Super Administrator role in your tenant
A user account in Cerby with the workspace Owner role
An invitation sent from Cerby Support via email to create a workspace
IMPORTANT: If you have not received an invitation, send an email to support@cerby.com with your request.

Configure SSO between Cerby and Google Workspace with SAML

To configure SSO between Cerby and Google Workspace with a custom SAML app, you must complete the following main steps:

Set up a workspace in Cerby
Add a custom SAML app in Google Workspace
Retrieve metadata information from Google Workspace and enter it in Cerby

NOTE: Depending on the use case, you may be redirected to the Google authentication portal if a session has not been established.

The following sections describe each main step.

1. Set up a new workspace in Cerby

To set up a new workspace in Cerby, complete the following steps:

Click the Create my workspace button from the invitation email you received from Cerby. The Welcome to Cerby page is displayed, as shown in Figure 1.

Figure 1. Welcome to Cerby page
Click the Continue with Google Workspace button. The Create your workspace page is displayed, as shown in Figure 2.

Figure 2. Create your workspace page
Enter the name of your workspace in the Workspace name field.
Click the Create workspace button. The Configure SSO through Google Workspace App page is displayed with instructions to configure the Cerby app in your Google Workspace tenant, as shown in Figure 3.

Figure 3. Configure SSO through Google Workspace App page

IMPORTANT: Keep the Configure SSO through Google Workspace App page open because it contains the required values that you must provide to Google and Cerby to complete the configuration.

The next step is 2. Add a custom SAML app in Google Workspace.

2. Add a custom SAML app in Google Workspace

To add a custom SAML app in Google Workspace, complete the following steps:

Log in to the Google Admin Console of your organization in a new browser tab.
Select the Web and mobile apps option from the Apps drop-down list in the left menu. The Web and mobile apps page is displayed.
Add a custom SAML app by completing the following steps:
1. Select the Add custom SAML app option from the Add app drop-down menu. The Add custom SAML app page is displayed with a wizard on the App details step, as shown in Figure 4.
  
  Figure 4. Add custom SAML app page in the Google Admin Console
2. Enter Cerby in the App name field.
3. Upload the Cerby logo in the App icon section by completing the following steps:
  1. Download to your computer the logo shown in Figure 5.
    
    Figure 5. Cerby logo
  2. Click the Camera () icon.
  3. Select the Cerby logo file from your computer.
Click the CONTINUE button. The Google Identity Provider details step of the wizard is displayed.
Click the DOWNLOAD METADATA button to download an XML file that contains all the information Cerby needs to configure the SAML connection.
IMPORTANT: Make sure you download the XML file, because you need it later.
Click the CONTINUE button. The Service provider details step of the wizard is displayed.
Copy the values from the browser tab you left open when completing step 1. Set up a new workspace in Cerby to paste them into their corresponding fields in the Google Admin Console, as shown in Figure 6:
- ACS URL
- Entity ID
  
  Figure 6. Required values in the Service provider details step
Enter https://app.cerby.com in the Start URL (optional) field.
Click the CONTINUE button. The Attribute mapping step of the wizard is displayed.
Map the required attributes from Table 1. Attribute mappings in Google Directory by completing the following steps:
1. Click the ADD MAPPING button. A new row is displayed with a drop-down menu and an empty field.
2. Select the corresponding option from the drop-down menu in the Google Directory attributes column.
3. Enter the corresponding value in the empty field of the App attributes column. Figure 7 shows how the page looks with all the mapping attributes.
  
  Figure 7. Attribute mappings in Google Directory
Click the FINISH button. The page closes, and the Cerby SAML app details page is displayed.
Turn on the Cerby SAML app for all users or specific organizations by following the instructions in the section Step 2: Turn on your SAML app of the official Google Workspace documentation.

The next step is 3. Retrieve metadata information from Google Workspace and enter it in Cerby.

3. Retrieve metadata information from Google Workspace and enter it in Cerby

To retrieve metadata information from Google Workspace and enter it in Cerby, complete the following steps from the Configure SSO through Google Workspace App page you left open:

Upload the XML file you downloaded previously in the Metadata XML file section.
Select the I have already assigned users or groups to the application option.
Click the Finish Configuration button. A success message is displayed.

Now you are done. You can proceed to log in to your Cerby workspace.

NOTE: The SAML-based integration leverages Google only for authentication. To assign permissions for Cerby, users must do so directly in Cerby.

IMPORTANT: This integration does not currently support IdP-initiated login from Google, so the tile in the Google Workspace dashboard created automatically after completing the configuration will not work. You can add a bookmark for all users and enrolled browsers pointing to your Cerby workspace. Just follow the instructions to add a bookmark in the official documentation Manage bookmarks. The bookmark URL is https://<workspace-name>.cerby.com, where you must include your workspace name; for example, if your workspace name is Cerby, the bookmark URL must be https://cerby.cerby.com.

Table 1. Attribute mappings in Google Directory

The following table shows the attribute mappings in Google Directory you must configure as part of step 2. Add a SAML-based custom app to your Google Workspace:

Google Directory attributes	App attributes
Name	`http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name`
Family Name	`http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname`
Email Address	`http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress`

Table 1. Attribute mappings in Google Directory

Troubleshooting: “Error: app_not_configured_for_user” message

When you complete the configuration described in this article and immediately try to access your Cerby workspace, you may encounter the “Error: app_not_configured_for_user” message, as shown in Figure 7.

Figure 7. “Error: app_not_configured_for_user” message in your web browser

This issue happens because changes in the Google Admin console take time to propagate across services and users. For more information, read the official documentation How changes propagate to Google services.

To solve the issue, refresh the page or log out and then log in to your Google account.