SAML SSO Setup with Google Workspace

• Google Workspace Super Admin privileges
• Safedevops Organization Admin access
• Access to your organization's domain DNS settings (if using custom domains)

• Organization Admin access in Safedevops
• Google Workspace Business or Enterprise account
• Verified domain in Google Workspace

Gather the following information before starting:

• Your Safedevops organization subdomain (e.g., yourcompany.safedevops.app)
• Your Google Workspace domain (e.g., yourcompany.com)
• List of users who should have access to Safedevops

SAML SSO configuration requires backend setup by our support team. Please contact us with the following information:

Our support team will provide you with:

• Safedevops SAML metadata XML file
• Entity ID (Identifier)
• Assertion Consumer Service (ACS) URL
• Single Logout URL (if applicable)

1. Sign in to the Google Workspace Admin Console
2. Navigate to Apps → Web and mobile apps
3. Click Add app → Add custom SAML app

Enter the following information:

• App name: Safedevops
• Description: Safedevops Enterprise DevOps Platform
• Upload app icon: (Optional - download from our brand assets)

Click Continue to proceed.

On the "Google Identity Provider details" screen:

1. Click Download Metadata to save the Google IdP metadata XML file
2. Note the SSO URL and Entity ID (you'll share these with Safedevops support)
3. Click Continue

Enter the Safedevops service provider information (provided by our support team):

• ACS URL: The URL where Google will send SAML assertions
• Entity ID: Unique identifier for Safedevops
• Start URL: Where users will be redirected after successful authentication
• Signed Response: ✓ Checked
• Name ID format: EMAIL
• Name ID: Basic Information > Primary email

Map Google Workspace user attributes to Safedevops user fields:

Control which users have access to Safedevops:

• For pilot testing: Select specific users or create a test group
• For organization-wide deployment: Assign to entire organization
• For department-specific access: Create and assign relevant organizational units

1. Review all settings for accuracy
2. Click Finish to complete the Google Workspace configuration
3. The app status should show as ON for assigned users

Before going live, perform these validation steps:

1. Send the Google IdP metadata XML to Safedevops support
2. Wait for confirmation that backend configuration is complete
3. Test with a single pilot user account

Test the SSO flow with a pilot user:

1. Navigate to https://safedevops.app (or your custom domain)
2. Click "Sign in with Google Workspace" or "SSO Login"
3. You should be redirected to Google for authentication
4. After successful Google login, you should be redirected back to Safedevops
5. Verify that user account is created automatically with correct information

Validate these additional scenarios:

• First-time login: New user account creation
• Returning user: Existing user authentication
• Session timeout: Re-authentication flow
• Logout: Proper session termination
• Access denial: Users not assigned to the app cannot access

Common Issues and Solutions

Issue: "SAML Response Validation Failed"

Possible Causes:

• Incorrect ACS URL configuration
• Mismatched Entity ID
• Certificate/metadata synchronization issues

Solution: Verify all URLs and identifiers match exactly between Google Workspace and Safedevops configuration.

Issue: "Access Denied" or "User Not Found"

Possible Causes:

• User not assigned to Safedevops app in Google Workspace
• Incorrect attribute mapping
• Email domain restrictions

Solution: Check user assignment in Google Admin Console and verify attribute mappings.

Issue: Redirect Loop or Infinite Redirects

Possible Causes:

• Incorrect Start URL configuration
• Session cookie issues
• Browser cache problems

Solution: Clear browser cache, verify Start URL, and check session configuration.

Debug Information to Collect

When contacting support, please provide:

• User email address experiencing the issue
• Timestamp of the failed login attempt
• Screenshots of any error messages
• Browser developer console errors (if any)
• Google Workspace SAML app configuration screenshots

Testing Tools

Use these tools to validate your SAML configuration:

• Google SAML Tracer: Browser extension to trace SAML flows
• SAML Response Decoder: Online tools to decode SAML responses
• Browser Developer Tools: Network tab to inspect HTTP requests

Best Practices

• Certificate Management: SAML certificates are automatically managed by Safedevops and renewed before expiration
• Response Signing: All SAML responses from Google are verified for authenticity
• Secure Transport: All SAML communications use HTTPS encryption
• Session Management: Sessions are securely managed with appropriate timeouts

Access Control

• Principle of Least Privilege: Only assign Safedevops access to users who need it
• Regular Access Review: Periodically review and update user assignments
• Group-Based Management: Use Google Groups for easier access management
• Audit Logging: Monitor access logs for unusual activity

Compliance

This SAML SSO implementation supports various compliance requirements:

• SOC 2: Centralized authentication and access controls
• GDPR: User data minimization and secure processing
• HIPAA: Secure authentication for healthcare organizations
• SOX: Audit trails and access controls for financial organizations

Getting Help

For assistance with SAML SSO configuration:

• Email: support@safedevops.app
• Subject Line: "SAML SSO Implementation Support"
• Documentation: Additional resources available in your organization's admin portal

Implementation Services

Safedevops offers professional implementation services for complex enterprise deployments:

• Custom attribute mapping
• Multi-domain configurations
• Advanced security configurations
• User training and change management
• Integration with other enterprise systems

Contact your account manager or enterprise@safedevops.app for more information.

Additional Resources

• User Management Guide
• Organization Settings
• Managing Permissions
• SAFe Roles and Permissions