# Google SAML SSO

### Introduction

Google SAML provides secure identity management and single sign-on to applications that you can add to your Google Workspace account. From Google Workspace, you and your users can log in and then access applications such as Paradime without having to log in to each application.

Organizations can use Google SAML 2.0 to connect Paradime to their Google Workspace instance. This page describes how to configure the Google SAML connection for Paradime.

### Creating a Google SAML Application

1. To connect your Google Workspace as an identity provider, you must create a SAML application. In your Google Admin Console, navigate to the Apps section.\
   Go to **Apps > Web and mobile apps**, and select **Add App > Add custom SAML app**.

   <div data-with-frame="true"><figure><img src="https://2337193041-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHET0AD04uHMgdeLAjptq%2Fuploads%2F3dj04eECi3qklrAgJIiO%2Fgsamlsso-apps-homepage.png?alt=media&#x26;token=5ca80992-7b26-42b5-a671-06831296ce35" alt=""><figcaption><p><em>Apps Home</em></p></figcaption></figure></div>

2. Enter your **App integration name** as Paradime.\
   Add the Paradime Logo for the Application. You can download the Paradime logo here [Paradime Logo](https://paradime.notion.site/Icon-purple-90c6f9527e1e4195b95a6f4595e6f15c).

   <div data-with-frame="true"><figure><img src="https://2337193041-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHET0AD04uHMgdeLAjptq%2Fuploads%2FD7tizpT6NdtILfzlq5kQ%2Fgsamlsso-app-details.png?alt=media&#x26;token=5ee3a8c2-8516-4bc3-bdc4-e9278295ed6d" alt=""><figcaption><p><em>App Details</em></p></figcaption></figure></div>

   Select **Continue**.

3. In the **Google Identity Provider details** page, note the following information:

   * **SSO URL**
   * **Entity ID**
   * **Certificate** (download this file)

   You will need to share these details with Paradime Support. Select **Continue**.

   <div data-with-frame="true"><figure><img src="https://2337193041-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHET0AD04uHMgdeLAjptq%2Fuploads%2FmXfHU4MrJv5aJUGJTeU1%2Fgsamlsso-note-idp-details.png?alt=media&#x26;token=9e8be5d3-e15c-4f3d-bbaf-3b088894a6e4" alt=""><figcaption><p><em>IdP Details</em></p></figcaption></figure></div>

4. In the **Service Provider Details** section, enter the following details:

   * **ACS URL**: Enter the URL below based on the region where your Paradime account is hosted

     <table><thead><tr><th width="120.22265625">Region</th><th>ACS URL</th></tr></thead><tbody><tr><td>EU 🇪🇺</td><td><code>https://account.paradime.io/login/saml/callback</code></td></tr><tr><td>US 🇺🇸</td><td><code>https://account.us.paradime.io/login/saml/callback</code></td></tr></tbody></table>

   * **Entity ID**: `urn:account:paradime-io:samlp-<organization-name>` (Get the `<organization-name>` from Paradime Support)

   * **Name ID format**: Select **EMAIL**

   Select **Continue**.

   <div data-with-frame="true"><figure><img src="https://2337193041-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHET0AD04uHMgdeLAjptq%2Fuploads%2FMgiTesQugItfvHROAwit%2Fimage.png?alt=media&#x26;token=04ce3119-98a0-4251-956a-2eb083354aca" alt=""><figcaption></figcaption></figure></div>

5. In the **Attribute Mapping** section, configure the required attribute mappings.\
   Select **Finish**.

| Google Directory Attributes | App Attributes |
| --------------------------- | -------------- |
| First name                  | `given_name`   |
| Last name                   | `family_name`  |
| Primary email               | `email`        |

<div data-with-frame="true"><figure><img src="https://2337193041-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHET0AD04uHMgdeLAjptq%2Fuploads%2FDX8e5ESclv6VXqEfk7ce%2Fgsamlsso-attribute-mapping.png?alt=media&#x26;token=da188377-f494-4af0-9a63-714dcb2af7e9" alt=""><figcaption><p><em>Attribute Mapping</em></p></figcaption></figure></div>

6. After creating the application, enable it for users in your organization.\
   Click on **User Access** and update the **Service Status** to **ON** for all users or relevant groups within your organization.

   <div data-with-frame="true"><figure><img src="https://2337193041-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHET0AD04uHMgdeLAjptq%2Fuploads%2FpDx33ZENv6cawaKmxDzR%2Fgsamlsso-user-access-2.png?alt=media&#x26;token=7d261189-64a3-41f6-8897-c01e1b432936" alt=""><figcaption><p><em>User Access</em></p></figcaption></figure></div>

{% hint style="danger" %}
&#x20;Make sure you add the user groups who need access to Paradime in the **User Access** section and verify the Service Status is set to ON.
{% endhint %}

### Configuring Paradime to enable Google SAML SSO

Once the Google SAML Application is configured, reach out to the Paradime team at <support@paradime.io> and share the following information via a password manager like 1Password, Dashlane and similar:

* **Entity ID** (from step 4 in the previous section)
* **IdP metadata:** (In your Google Application, in the left panel click on "Download Metadata" and from option 1: download the metadata xml file.
* **Certificate file** (In your Google Application, in the left panel click on "Download Metadata" and from option 2: download the certificate file.

Paradime team will then create the SSO client and enable SSO on your company name. Wait for approximately 30 minutes for Google to apply the changes.

Once confirmed, during login, users in your company will see a **Continue with Google SAML** option.

{% hint style="success" %}
If you already have an existing Social login setup, then using the Google SAML option, Paradime will automatically link your accounts and you can then use Google SAML SSO for all future logins.&#x20;
{% endhint %}