Common configuration for Google Workspace - authentication for Fortified ID products
Scenario
Section titled “Scenario”In this scenario, Google Workspace will be used as the IdP to authenticate to a Fortified ID product (in the example below Forms is used as the Fortified ID product).
The integration between the Fortified ID product and Google is federation-based (SAML2). Google will pass user attributes necessary for identification, and potentially additional attributes for delegated administration purposes.
Prerequisite
Section titled “Prerequisite”There are some prerequisite for this use case. You will need the following:
- Google administration rights.
- Host (DNS) name of the Fortified ID product service (external access)
- Fortified ID product installed
- Fortified ID product SP (SAML Service Provider) configured
Configuration
Section titled “Configuration”Update Google to trust Integrity
Section titled “Update Google to trust Integrity”Trust need to be established between the primary IdP (Google) and the SP (Fortified ID product ).
Create custom SAML app
Section titled “Create custom SAML app”- Login to Google admin console (admin.google.com) as an administrator
- In the left hand menu, select Apps->Web and mobile apps
- Click Add app -> Add custom SAML app
- Enter a name of the app, Fortified ID Forms
- Continue
- Click Download IdP metadata
- Place the downloaded IDP metadata file in /customer/config/resources_external/saml_idp_metadata/ on your Forms server. Verify that the name of the file is GoogleIDPMetadata.xml.
- Continue
- Enter ACS URL = https://<your_forms_dns_name>/forms/authn/login
- Enter Entity ID = FortifiedID_Forms
- Leave the Name ID part unchanged
- Continue
- Click Add mapping
- Select the Google Directory attribute field containing the email value
- Enter App attributes = mail
- Click Add mapping
- Select the Google Directory attribute field containing the value used to connect the delegated admin with subordinates, for example department
- Enter App attributes = department
- Finish
- On the User Access part of the app configuration, click Expand (down arrow)
- Change the Service status. Select the group or OU that should be allowed to access Forms. (For example, teachers)
Update Forms to trust Google
Section titled “Update Forms to trust Google”- Restart the Forms service