Set up single sign-on with Google Workspace

PlatoForms connects to Google Workspace with SAML 2.0 through a custom SAML app. Members then sign in with their Workspace account and get a PlatoForms tile in the Google app launcher.

For an overview of the Single Sign-On page, see Single sign-on (SSO).

Before you begin

• You are a Google Workspace super administrator.
• In PlatoForms, you are the team owner or a member with the Manage members access.
• In PlatoForms, open your team menu and select Single Sign-On. On the Connection tab, pick Google Workspace. Keep this page open: it shows the values Google needs, each with a Copy button.

In the Google Admin console

1. Go to Apps > Web and mobile apps, click Add app, then Add custom SAML app.

2. Enter an app name, for example PlatoForms, and click Continue.

3. On Google Identity Provider details, click Download metadata and keep the file. Click Continue.

4. On Service provider details, enter:

   • ACS URL: the ACS URL from PlatoForms.
   • Entity ID: the Entity ID from PlatoForms.
   • Start URL: the Start URL from PlatoForms.
   • Name ID format: EMAIL.
   • Name ID: Basic Information > Primary email.

   Click Continue.

5. On Attribute mapping, add:

   Google directory attribute	App attribute
   Primary email	email
   First name	first_name
   Last name	last_name

   Click Finish.

6. Open User access and turn the app ON for everyone, or for the organizational units that may sign in. Changes can take a few minutes to apply.

In PlatoForms

Google Workspace has no metadata URL, so you paste three values from the metadata file you downloaded. Open the file in a text editor.

1. Under 3. Values from your identity provider, fill in:

   • Identity provider entity ID (issuer): the entityID of the EntityDescriptor element.
   • Sign-on URL (HTTP-Redirect): the Location of the SingleSignOnService element with the HTTP-Redirect binding.
   • Signing certificate: the text inside the X509Certificate element.

2. Click Save connection.

Verify your domain, test and turn on

1. On the Email domains tab, add your Workspace domain, create the TXT record PlatoForms shows at your DNS provider, and click Verify.

2. In the status card, click Test connection. A window signs you in through Google and shows the email, name and attribute names PlatoForms received.

3. Click Turn on single sign-on.

Members can now click SSO on the PlatoForms login page, open the start URL, or use the PlatoForms tile in the Google app launcher. See Sign-in rules to require single sign-on or to let new members join automatically.

Troubleshooting