# Set up SSO with Google Workspace

Source: https://docs.qualflare.com/docs/administration/sso/google-workspace · Last updated: 2026-11-02

Connect Google Workspace to a Qualflare Enterprise workspace with a custom SAML app: exchange metadata, send the email, map groups to roles and test sign-in.

To set up single sign-on with Google Workspace for a Qualflare Enterprise workspace, create a custom SAML app in the Google Admin console, upload its metadata to Qualflare's **Single Sign-On** page, copy Qualflare's Entity ID and ACS URL into it, and run a test sign-in.

## Before you begin

Available on: Enterprise.

Requires the Owner role in the workspace.

* Admin access to the Google Admin console.
* An email domain you can add a DNS TXT record to. See [Verified Domains](https://docs.qualflare.com/docs/administration/verified-domains).
* Saving any change asks **Confirm it’s you** when you last signed in or confirmed more than 5 minutes ago.

## Connect Google Workspace

### Step 1: Create the SAML app in Google Workspace

Create a custom SAML app for Qualflare in the Google Admin console, as Google's guide [Set up your own custom SAML app](https://support.google.com/a/answer/6087519) describes. Qualflare shows the values the app needs only after step 2, so come back to this app in step 3.

Custom SAML apps sign with RSA-SHA256 and have no algorithm setting, so there is nothing to change. Qualflare accepts RSA-SHA256, RSA-SHA384 or RSA-SHA512 over SHA-2 digests.

### Step 2: Upload the Google Workspace metadata to Qualflare

Download the app's SAML metadata as an XML file. In Qualflare, open **Single Sign-On** in the workspace sidebar, under **Administration**, upload the file (`.xml`, up to 1 MB) and click **Save connection**. The connection starts disabled. See [Connect your identity provider](https://docs.qualflare.com/docs/administration/sso#connecting-an-identity-provider).

### Step 3: Copy Qualflare's values into Google Workspace

Under **Service provider details**, copy **Entity ID (Audience URI)** and **ACS URL (Reply URL)** with their copy buttons. Paste them into the Google app as the audience URI and the reply URL, unchanged: Qualflare refuses a sign-in posted to a changed ACS URL, even one with a trailing slash added.

### Step 4: Send the user's email

Have Google send a persistent, email address or unspecified Name ID. Qualflare refuses a transient one.

Qualflare looks in the attribute you enter in **Email attribute** on the Single Sign-On page, then in an email-address Name ID, then in the first of these attributes that Google sends:

```text
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress
urn:oid:0.9.2342.19200300.100.1.3
email
mail
emailAddress
```

### Step 5: Map groups to roles (optional)

Have Google send the user's groups in an attribute, and enter that attribute's name in **Group attribute**. Add **Role rules**: the first matching rule wins, and anyone else gets the **Default role**. Click **Save mapping**. See [Map attributes and roles](https://docs.qualflare.com/docs/administration/sso#attributes-and-role-mapping).

### Step 6: Verify your domain and test

Verify your email domain on [Verified Domains](https://docs.qualflare.com/docs/administration/verified-domains). Turn on **Connection enabled** and click **Turn on connection**. Then run a test sign-in from a private browser window: enter an email address at the verified domain on the sign-in page and select **Continue**. **Require SSO** stays off until a test sign-in succeeds.

## Encrypted assertions (optional)

Custom SAML apps don't encrypt assertions, so leave [Require encrypted assertions](https://docs.qualflare.com/docs/administration/sso#require-encrypted-assertions) off.

## Provision users with SCIM

If your identity provider supports SCIM 2.0, see [SCIM Provisioning](https://docs.qualflare.com/docs/administration/scim).

## Verify

You should see the member signed in to the workspace after the test sign-in, and **Require SSO** can now be turned on.

## Troubleshoot

* `Single sign-on failed. Please try again, or contact your workspace owner if it keeps happening.`: Qualflare refused the sign-in. Custom SAML apps need no signing or encryption change, so check the Name ID format and the email in step 4 first.
* A 403 `origin not allowed` error after Google signs you in: the reply URL in Google isn't Qualflare's ACS URL exactly. Copy **ACS URL (Reply URL)** again and paste it unchanged.
* `Your email address's domain isn't verified for single sign-on with this workspace yet. Contact your workspace owner.`: verify that domain on [Verified Domains](https://docs.qualflare.com/docs/administration/verified-domains).
* **Logging out of Qualflare didn't sign me out of Google**: **Log out** ends only the Qualflare session, so the next single sign-on can go straight through. Sign out of Google too.

## Next steps

* [Require SSO](https://docs.qualflare.com/docs/administration/sso#enforcing-sso) for the members at your verified domains
* [Set the SSO session lifetime](https://docs.qualflare.com/docs/administration/sso#sso-session-lifetime)
* [SCIM Provisioning](https://docs.qualflare.com/docs/administration/scim)
* [Recover from a lockout](https://docs.qualflare.com/docs/administration/sso#recovering-from-a-lockout)