Configuring SAML SSO for GSuite

Accops let users to Single Sign-On into Google Workspace account with one set of login credentials, eliminating user-managed passwords and the risk of phishing. Google Workspace Single Sign-On set up leverages the existing on-premise Active Directory infrastructure and provides seamless integration without the need to manage multiple on-premise and cloud identities.

Environment#

Accops HySecure Gateway v5299, v5360, v6026 onwards
Gsuite Tenant

Pre-Requisites#

Gsuite Admin Console Access.
Accops HySecure Gateway with Public DNS name and valid SSL Certificate.
Managenent console of HySecure Gateway using Secirity Officer Account.
Shell Access to Hysecure Gateway.

Configurations#

Steps to setup G-Suite in Accops (Identity Provider)#

Step 1: Login with a digital certificate in Accops HySecure Gateway using Security Officer Account.

Step 2: Go to "Access Management >> Applications >> Add" .

Step 3: Click on Add button to create new application as "google".

Gmail

Type : HTTPS
Name: GMail
Discription: Gsuite
Application Server Address: account.google.com
Application Port: 443
Protocol: TCP
Web URL:  https://account.google.com/a/onaccops.com
Use Reverse Proxy: No
Hidden Application: No
Hide Access Pop-up : No
Enable App Tunnling : Yes
Enable L3 VPN Tunneling : No
Enable Single Sign-on : Yes
Authentication Type : SAML Based
Preconfigured Service Provider : google
Service Provider Login URL: https://www.google.com/a/onaccops.com/acs
Service Provider Logout URL : https://www.google.com/a/onaccops.com/saml2/sp/slo
Audience : https://mail.google.com/a/onaccops.com
Issuer : https://sso.accops.cloud (HySecure Gateway Address)

Step 4: Add google app into New/Existing Application Groups.

Step 5: Create/Update an "Application Access" in New/Exisitng "Access Controls"

Step 6: Verify SAML SSO Certificate in Accops HySecure Gateway.

Please ensure below files availability in Accops HySecure Gateway.

Certificate Path: /home/fes/fescommon/certs/

-rw-r--r-- 1 apache fes    2029 Mar 11 11:08 SAML_Signing_Certificate
-rw------- 1 apache fes    2498 Mar 11 11:09 SAML_Signing_Private_Key

note

If above files are not present then, Create it using below command

Change the Working Directoty to "/home/fes/fescommon/certs/

[root@sso1 ~]# cd /home/fes/fescommon/certs/

openssl x509 -inform PEM -in "sslcert.cer" -out SAML_Signing_Certificate

openssl rsa -in "sslcert.pem" -out SAML_Signing_Private_Key

Step 7: Copy the content of SAML SSO Certificate SAML_Signing_Certificate form Accops Gateway.

note

Please ensure while copying the content there aren't any new line in SAML SSO Certificate.

cat /home/fes/fescommon/certs/SAML_Signing_Certificate

Steps to setup Accops in G-Suite (Service Provider)#

Step 1: Go to Google Admin Console https://admin.google.com/u/1/?pli=1 and login with Admin Access.

Step 2: Select Security from Google Admin Console.

Step 3: Select Set up single sign-on (SSO) with a third party IdP.

Step 4: Configure Accops IdP Server Details as below and Click on Save.

Sign-in Page URL : https://sso.accops.cloud/saml-sso/G-Suite

Sign-out page URL: https://sso.accops.cloud/saml-slo/G-Suite

Upload IdP SSL Certificate : SAML_SSO_Certificate.cer

Select *Use a domain-specific issuer*

Sign in to your G-Suite#

Using IDP initiated login#

Go to Accops Workspace Portal (https://sso.accops.cloud)

Here you have to enter the sAMAccountName of the user

For Example: 

Username: pravind.kumar
Password: xxxxxx
Doamin: onaccops.com

Enter Your Login Credentials, Choose domain from dropdown and click on Sign In.
Verify yourself using Multi-Factor Autentcication by choosing the type of MFA from dropdown.
Post successful Autentication and Authorization User will will be redirected to Accops Workspace Portal.
Click on G-Suite icon to launch Single Sign On access to Gmail.

Using SP initiated login#

Go to to Gmail https://mail.google.com and select Login using Accops SSO
Autentication request will be redirected to Organization Sign in Page (Accops IDP Login Portal), Enter Authentication details and click on Sign-In.

Here you have to enter the sAMAccountName of the user

For Example: 

Username: pravind.kumar
Password: xxxxxx

On Below Screen, Accops IDP Server will Prompt More Authenication required, Choose Send Push to Mobile/Desktop and Authorize the Desktop Push to Login.
Access G-Suite Portal.

Help/Support#

Please send a mail to support@accops.com for further help/Support.