Set up SSO with Google Workspace

Create the SAML app in Google Workspace

Create a custom SAML app for Qualflare in the Google Admin console, as Google's guide Set up your own custom SAML app describes. Qualflare shows the values the app needs only after step 2, so come back to this app in step 3.

Custom SAML apps sign with RSA-SHA256 and have no algorithm setting, so there is nothing to change. Qualflare accepts RSA-SHA256, RSA-SHA384 or RSA-SHA512 over SHA-2 digests.

Upload the Google Workspace metadata to Qualflare

Download the app's SAML metadata as an XML file. In Qualflare, open Single Sign-On in the workspace sidebar, under Administration, upload the file (.xml, up to 1 MB) and click Save connection. The connection starts disabled. See Connect your identity provider.

Copy Qualflare's values into Google Workspace

Under Service provider details, copy Entity ID (Audience URI) and ACS URL (Reply URL) with their copy buttons. Paste them into the Google app as the audience URI and the reply URL, unchanged: Qualflare refuses a sign-in posted to a changed ACS URL, even one with a trailing slash added.

Send the user's email

Have Google send a persistent, email address or unspecified Name ID. Qualflare refuses a transient one.

Qualflare looks in the attribute you enter in Email attribute on the Single Sign-On page, then in an email-address Name ID, then in the first of these attributes that Google sends:

http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress
urn:oid:0.9.2342.19200300.100.1.3
email
mail
emailAddress

Map groups to roles (optional)

Have Google send the user's groups in an attribute, and enter that attribute's name in Group attribute. Add Role rules: the first matching rule wins, and anyone else gets the Default role. Click Save mapping. See Map attributes and roles.

Verify your domain and test

Verify your email domain on Verified Domains. Turn on Connection enabled and click Turn on connection. Then run a test sign-in from a private browser window: enter an email address at the verified domain on the sign-in page and select Continue. Require SSO stays off until a test sign-in succeeds.