This guide helps Google Workspace admins connect Go1 to Google Workspace using SAML single sign-on (SSO).
Before you start
You will need:
Super admin access to Google Admin console.
Admin access to your Go1 portal.
Your Go1 portal URL.
Your Go1 portal ID.
A test learner account in Google Workspace.
1. Create the custom SAML app
Sign in to the Google Admin console with a super administrator account.
Go to Apps.
Go to Web and mobile apps.
Select Add app.
Select Add custom SAML app.
Enter a clear app name, such as
Go1.Optional: upload an app icon.
Select Continue.
2. Save the Google identity provider details
On the Google Identity Provider details page, save the values you will need for Go1.
You can either:
Download the IdP metadata, or
Copy the SSO URL and Entity ID, then download the certificate.
You will add these values to Go1 after the SAML app is created.
3. Add Go1 service provider details
In Service Provider Details, add these values:
Google Workspace field | Go1 value |
ACS URL |
|
Entity ID |
|
Start URL |
|
Replace {customer portal id} with your Go1 portal ID.
The Start URL is optional, but it is usually needed if learners start from Google Workspace.
For Name ID, use the learner's primary email address.
4. Add learner attribute mappings
Add these attribute mappings so Google Workspace sends learner details to Go1:
Google Directory attribute | App attribute |
Primary email |
|
First name |
|
Last name |
|
Platform language and locale
Do not add locale mapping for Google Workspace until Go1 confirms the right attribute and format for your setup.
Go1 supports mapping SAML locale for some identity providers, but Google Workspace locale mapping still needs validation before it should be published as a standard setup step.
If you need Google Workspace to set each learner's platform language in Go1, contact your Go1 implementation or support team before rollout.
5. Finish the SAML app setup
Select Continue.
Optional: add group membership mapping only if Go1 has asked you to send group details.
Select Finish.
6. Turn on the SAML app
In Google Admin console, go to Apps.
Go to Web and mobile apps.
Select the Go1 SAML app.
Select User access.
Turn the app on for the right users, groups, or organizational units.
Save your changes.
Changes can take up to 24 hours, but usually happen sooner.
Before testing, make sure the email addresses learners use for Google Workspace match the email addresses they use in Go1.
7. Copy Google details into Go1
In Go1, use the values from the Google Identity Provider details page.
Go1 field | Google Workspace value |
Sign-in URL | SSO URL |
Entity ID | Entity ID |
X.509 certificate | Certificate |
Logout URL | Leave blank unless your setup provides one |
Google Workspace does not support encrypted SAML assertions in its standard configuration, so leave encrypted assertions off unless Go1 has confirmed a custom setup.
In Go1, use this field mapping:
{
"email": "https://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress", "family_name": "https://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname", "given_name": "https://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname"
}
If you configured the Start URL and want learners to start from Google Workspace, enable IdP-initiated SSO in Go1.
8. Test sign-in
Sign in as a test learner assigned to the Go1 SAML app.
Confirm the learner can reach Go1.
Confirm the learner's email, first name, and last name are correct.
Test with at least one learner who has every mapped attribute populated in Google Workspace.
If sign-in fails, check that Google Workspace is sending every attribute that is mapped in Go1.