Set up a SAML SSO with Google

You can set up a SAML SSO on the platform with Google Workspace as the identity provider.

To create the SAML app, you need Super Admin rights in your Google Workspace account. Your platform must also use a custom subdomain: see Customize the platform URL.

Keep Google's guide to setting up a custom SAML app open as a reference for the Google Admin console.

The general process is as follows:

1. Request the metadata URL.
2. Create a custom SAML app in Google Workspace.
3. Turn on user access.
4. Send the setup details to your Solution Deployment Manager.
5. Wait for the green light.

Request the metadata URL

Send an email to your Solution Deployment Manager to request the metadata URL.

They send you back a metadata URL that looks like this:

• https://app.360learning.com/api/sso/saml/acme/metadata
• https://app.us.360learning.com/api/sso/saml/acme/metadata if your platform is hosted in the US data center

The acme part towards the end of the URL is your SP entity ID. In most cases, it is identical to your subdomain. You need it to create the app in Google Workspace.

Create a custom SAML app in Google Workspace

1. In the Google Admin console, go to Menu → Apps → Web and mobile apps.

2. Click Add app → Add custom SAML app.

3. On the App details page, enter a name for the app, such as 360Learning.

   • You can also enter a description.

4. Click Continue.

5. On the Google Identity Provider details page, click Download Metadata, and keep the .xml file to send to your Solution Deployment Manager.

   • You can instead copy the SSO URL and the Entity ID, and download the Certificate.

6. Click Continue.

7. On the Service provider details page, enter the following values:

   • ACS URL: https://app.360learning.com/api/sso/saml/<SP-entity-ID>/postResponse, replacing <SP-entity-ID> with the SP entity ID from the metadata URL. If your platform is hosted in the US data center, enter https://app.us.360learning.com/api/sso/saml/<SP-entity-ID>/postResponse instead. You can also find the exact URL in the metadata URL, ending with /postResponse.
   • Entity ID: https://app.360learning.com. If your platform is hosted in the US data center, enter https://app.us.360learning.com instead.
   • Start URL: https://<subdomain>.360learning.com, replacing <subdomain> with your platform subdomain. If your platform is hosted in the US data center, enter https://<subdomain>.us.360learning.com instead.

8. In Name ID format, select EMAIL.

9. In Name ID, select Basic Information → Primary email.

10. Click Continue.

11. On the Attribute mapping page, click Add mapping, and map the following attributes:

    Google Directory attributes	App attributes
    Primary email	email
    First name	firstName
    Last name	lastName

12. Click Finish.

Turn on user access

Users can log in with the SAML app only once it is turned on for them.

1. In the Google Admin console, go to Menu → Apps → Web and mobile apps.
2. Click on the SAML app you created for 360Learning.
3. Click on User access.
4. Select the organizational unit or group to which you want to give access.
5. In Service status, select ON for everyone.
6. Click Save.

Changes can take up to 24 hours to reach all users in Google Workspace.

Send the setup details to your Solution Deployment Manager

Send an email to your Solution Deployment Manager with the following details:

• The metadata .xml file from Google Workspace, or the SSO URL, the Entity ID, and the Certificate. To download the metadata again, open the SAML app in the Google Admin console, and click Download Metadata.
• The ID of the group on which to set up the SSO. To set it up on the whole platform, send the ID of the platform group. See Find the ID of a group.
• The SSO type: forced or mixed. See Choose between forced and mixed SSO.
• The user provisioning rule: yes or no.

With user provisioning, users who have no 360Learning account get one when they first log in, with their first and last name from Google Workspace. They are created as learners in the group where the SSO is set up.

Without user provisioning, users who have no 360Learning account can log in only after you invite them, or create an account for them.

Wait for the green light

Once you’ve sent the setup details, your Solution Deployment Manager sets up the SSO on the 360Learning side. They send you a confirmation email when the SSO is active.

Users with access to the SAML app can then log in to 360Learning with their Google account.