How to Configure SAML SSO for Google IdP

In this article, we will walk through the required steps to integrate your Google IdP with Chili Piper.

Table of Contents

• Things to Know
• How to Configure SAML SSO for Google IdP

Things to Know

• You must be a Chili Piper admin to enable Single Sign-On (SSO).
• You must use the same email address for both Chili Piper and your IdP.
• Chili Piper supports any enterprise identity provider (IdP) using the SAML 2.0 protocol.

How to Configure SAML SSO for Google IdP

In the Command Center, access SAML Configuration by clicking Integrations in the left-side menu, clicking the Single Sign-On tab, and clicking Connect on the Single Sign-On card.

Before you can begin Step 1 to configure SAML for Google IdP, please ensure the following:

• If you have not already, you will need to create Chili Piper as a new, custom SAML Application in Google IdP here. We recommend calling this app Chili Piper.
  • The Google Support article on how to do this is here.

• To make the managed app available to select users, choose a group or organizational unit.
  • Google Support article to learn more here

Step 1

In Google’s Command Center, go to Apps > Web & Mobile Apps > Chili Piper and open the Service provider details dropdown

Copy and Paste the fields from Chili Piper into Google’s Service provider details.

• Please note that the Single Sign-On URL field in Chili Piper is the same as the ACS URL field in Google:
  • Please delete /clients/common from the end of the URL when pasting to Google

Recommended: Send a Stable, Immutable NameID

In the same Service Provider details step (Admin console > Apps > Web and mobile apps > Add app > Add custom SAML app), you set both Name ID and Name ID format. Attribute mapping ("Add mapping") is a separate, later step and does not affect the Name ID.

By default, Name ID is set to Basic Information > Primary email, which is mutable. The Name ID value dropdown only exposes directory fields, and Google Workspace has no built-in stable numeric user ID option. To send an immutable value:

1. Create a custom user attribute in Directory > Users (or via the Admin SDK) that holds a stable identifier for each user.
2. On the Service provider details step, select that custom attribute as the Name ID value.

Google's Name ID value is case-sensitive. Google's own setup examples use the EMAIL Name ID format, so review the Name ID format dropdown carefully if you want a different format.

For more information, see Google's documentation on setting up a custom SAML app and SSO with a third-party identity provider.

Step 2

Setting up SAML attribute mapping in Google IdP. Make sure the following attributes are created: 

Paste into the Metadata URL field in Chili Piper in the Step 2 section of the IdP setup:

• If you do not have access to a Metadata URL in Google and have access to download metadata - download the metadata and send to your dedicated CSM. They can assist you in converting this to a Metadata URL.

In Chili Piper, click Test Connection, and you will be directed to your IdP login screen. You must log in to your IdP using the same credentials that you use to log into Chili Piper.

If the Connection is successful, you will be redirected back to Chili Piper, where you can enforce SSO for all users.

If you want to enforce your users' only logging in via your IdP, you can opt to do this now. However, this option will only be available if testing the connection in Step 2 was successful.

Reference file: how-to-configure-saml-sso-for-google-idp.md (https://help.chilipiper.com/hc/article_attachments/53436217130259)