This guide enables seamless and secure user authentication by integrating your custom application with Google Workspace as the Identity Provider (IdP). Please note, we do not support IdP-Initiated logins with Google Workspace.

Step 1: Add a Custom SAML App

1. Sign in to the Google Admin Console using an administrator account.
2. Navigate to Apps > Web and mobile apps.
3. Select Add App > Add custom SAML app.

Step 2: Define App Details

1. Enter a descriptive App name that users will recognize, such as “FMX”
2. Optionally, upload an icon to display in the Google App Launcher.
3. Click Continue.

1. Click Download Metadata to obtain the XML file containing Google's certificates and endpoints.
2. Note the SSO URL and Entity ID for manual configuration that you will need later.
3. Upload this metadata to your Service Provider (application) settings and click Continue.

Step 3: Configure Service Provider Details

1. Input the ACS URL and Entity ID provided by your application.
2. Set the Name ID format (typically EMAIL) and set Name ID to Primary email.
3. Start URL can be left blank.
4. Click Continue.

Step 4: Map Attributes

1. Click Add Mapping to sync user data.
2. Map Google fields (First Name, Last Name, Primary Email at minimum) to the corresponding application parameters.
3. Click Finish.

Step 5: Enable Access

1. In the User access section, select Service status.
2. Change the status to ON for everyone (or specific groups) and click Save.

Step 6: Send the XML Metadata File

Once setup is complete, please send the Metadata file over to your CSM/COM to allow an FMX Support Specialist to complete the final steps in enabling SSO on your site.