SAML SSO with Google

Log in to your Document360 account and select the project for which you wish to configure Google SAML Single Sign-On with your Google Workspace account. Next, log in to your Google Workspace account. If you don’t have a Google Workspace account, you can create one at https://workspace.google.com/. Once you have logged in to your Google workplace account, navigate to the admin console using the Admin button at the top right. Please note that only users with Owner or Admin as Project role can configure SSO in Document360.

PRO TIP

It is recommended to open Document360 and Google Workspace in two separate tabs/browser windows, since configuring SSO in Document360 will require you to switch between Okta and Document360 multiple times.

Adding a custom SAML app on Google

1. On the admin console home page, click on the Apps option and select the SAML apps option.

2. Click on Add app and in the dropdown, select Add custom SAML app.

3. In the App details, enter any name for your app and click on Continue.

4. Next, you will find the SSO URL, Entity ID details, and the Certificate.

5. Make a note of these details, since you will need them while accessing the Configure the Identity Provider (IdP) page on Document360.

6. In the Certificate section, click on the Download icon to save the certificate (.pem format) in your computer's local storage.

7. You will have to upload this certificate later in the Configure the Identity Provider (IdP) page in Document360.

8. In User access, the Service status will by default be OFF for everyone.  You must manually change it to ON for everyone to work.

After configuring it on the Google side, here's how your SAML app would look.

Service Provider configuration

To configure Single Sign-On (SSO), you need Service Provider (SP) details such as ACS URL and entity ID. These details will be available in the Create SSO panel on Document360. To navigate to the Create SSO panel,

1. Go to Settings > Users & permissions > SSO Configuration.

2. Click the Create SSO button.

3. In the Choose your Identity Provider (IdP) page, select Google as the identity provider.

4. Next, from the Configure the Service Provider (SP) page, copy the following parameters.

5. Switch to the Google workspace tab and paste the parameters onto the Google custom SAML app page.

6. In Name ID format select EMAIL from the dropdown

7. In Name ID select Basic Information > Primary email

8. Click on the Continue button

Attributes

1. Add and select user fields in Google Directory, then map them to service provider attributes. Add the following attributes.

2. Click on the Add Mapping button each time you add an attribute, and when you're done, click on the Finish button.

Configure the Identity Provider (IdP)

1. Switch back to the Document360 panel, to the Configure the Service Provider (SP) page, and click Next to navigate to the Configure the Identity Provider (IdP) page.

2. The Configure an existing connection field allows you to inherit an SSO configuration that has already been created. By selecting this option, the current SSO configuration will be set as the child and no changes can be made to it.

 NOTE

For more information on Inheritance, go to Inherit from another application.

3. In the Configure the Identity Provider (IdP) page, add the information you had noted down earlier from the Google custom SAML app page.

4. Next, turn on/off the Allow IdP initiated sign in toggle as per your project requirements.

5. Once done, click the Next button to navigate to the SCIM provisioning page.

SCIM provisioning

SCIM provisioning is not supported when Google is configured as your Identity Provider (IdP) in Document360.

This limitation applies in two scenarios:

• When setting up a new Google IdP configuration.

• When you have inherited an existing SSO configuration that uses Google as the IdP.

Click Next to navigate to More settings.

More settings

1. In the More settings page, enter the desired name for the SSO configuration in the SSO name field.

2. Enter the text you would like to show users for the login button in the Customize login button text.

3. Toggle on/off the Auto assign reader group and Sign out idle SSO user toggles based on your requirements.

4. Invite all your users or selected users using the Convert existing user and reader accounts to SSO radio buttons.

The SSO configuration based on the SAML protocol will be configured using Google successfully.

Inherit from another application

When creating a new SSO configuration in Document360, you can inherit SCIM settings from an existing SSO connection. This approach simplifies the setup process, avoids repeating configuration steps, and helps administrators save time while ensuring consistency across integrations.

Inherited SSO configuration

• On the Configure Identity Provider (IdP) page, select the Configure an existing connection field and choose the parent SSO SCIM-enabled application you want to inherit from. Selecting this option will designate the current project as the child project, inheriting all relevant properties from the parent.

 NOTE

Once the SSO configuration is created, the settings will be inherited from the parent application and cannot be modified in the child application.

• Since SCIM provisioning does not support Google IdP configurations, SCIM settings from the parent project cannot be inherited.

While the other SSO configuration settings are inherited from the parent project, SCIM settings alone cannot be inherited.

Managing Users in Google IdP

To view the readers added through your custom app,

1. Go to Document360 and navigate to Settings > Users & permissions > Readers & groups.

2. Select the reader to navigate to their reader profile.

Readers provisioned via SCIM will display an SSO-SCIM badge next to their name.

 NOTE

When SCIM is enabled, editing a user's name or deleting a user directly in Document360 is disabled, as these actions must be managed through your IdP to keep both platforms in sync. You can

only manage the content access from Document360.

Manage content access of Readers, Users and Groups

The default content role assigned to any new user, reader, or group is based on what was configured during SCIM provisioning setup. Permissions will be set to None by default but can be updated at any time.

1. To manage content access, select the desired reader and click Manage Content Access.

2. Choose the desired access level from the dropdown and click Update.

 NOTE

You can also manage groups for a reader by clicking Manage groups under the Reader Group section.