Skip to main content
Google Workspace can act as the SAML identity provider for the Syteca Management Tool, so administrators sign in with their Google accounts instead of a separate Syteca password. This page covers the full setup: creating the SAML app in Google, importing its metadata into Syteca, and returning to Google to supply the Syteca endpoints. The configuration crosses between the two consoles twice, so work through the sections in order.

​
Before you start

​
Get your Management Tool URL right

This is the single most common cause of a failed setup. Google and Syteca must agree on the Management Tool’s address, character for character. Open the Management Tool in a browser and copy the address from the URL bar, up to and including the application path. You will get something like https://10.0.2.10/Syteca. Throughout this page, <management-tool-url> means that value.

​
1. Create the SAML app in Google Workspace

1

Open the Apps section

Sign in to the Google Workspace Admin Console and go to Apps.
2

Add a custom SAML app

Select Web and mobile apps, click Add app, then choose Add custom SAML app.
3

Name the app

Fill in App name and Description with anything that identifies the integration for your team, for example SytecaSSO and SytecaSSO-Integration. An app icon is optional, up to 4 MB. Click Continue.
4

Download the IdP metadata

On the Google Identity Provider details step, under Option 1: Download IdP metadata, click DOWNLOAD METADATA. This saves an XML file you will upload to Syteca in the next section.
Leave the Google wizard open. You return to it in section 3 to fill in the service provider details. Closing it now means starting the app over.

​
2. Import the metadata into Syteca

1

Open SSO Integration

In the Management Tool, click the gear icon to open Configuration, then select SSO Integration.
2

Enter the Issuer name

In Issuer name, type your <management-tool-url>, for example https://10.0.2.10/Syteca.
3

Upload the metadata file

Next to Identity provider metadata (xml), click Choose File and select the XML file you downloaded from Google.
4

Choose a certificate option

Select Self-signed certificate or Custom certificate, depending on which certificate the Management Tool should use for the SAML exchange.
5

Decide how new users are handled

Leave Auto-create a Management Tool account for a new user on the first SSO login selected to create accounts on demand, or clear it to allow only users who already have a Syteca account to sign in. See the note below before deciding.
6

Save

Click Save.
Syteca SSO Integration configuration page showing issuer name and identity provider metadata fields

The SSO Integration page with the Google metadata uploaded.

Auto-create affects who can get into the Management Tool. With it enabled, any Google Workspace user the app is turned on for receives a Management Tool account the first time they sign in. Scope the app in section 4 to the organizational units that should have administrative access, rather than leaving it on for the whole domain.

​
3. Complete the service provider details in Google

Return to the Google wizard, on the Service provider details step.
1

Enter the ACS URL and Entity ID

Build both values from your <management-tool-url>:For a Management Tool at https://192.168.56.1/Syteca, that gives an ACS URL of https://192.168.56.1/Syteca/Account/ConsumeSSO and an Entity ID of https://192.168.56.1/Syteca.
2

Leave Start URL and Signed response alone

Start URL stays empty, and Signed response stays cleared.
3

Set the Name ID

Set Name ID format to EMAIL, and Name ID to Basic Information > Primary email.
4

Finish the wizard

Click Continue, then Finish. No attribute mapping is required.
Google Workspace service provider details showing ACS URL, Entity ID, and Name ID configuration

The service provider details, built from the Management Tool URL.

The Certificate drop-down is pre-filled with the Google SAML certificate generated for your domain. Note its expiry date, shown next to its name. SSO stops working when it expires, so track that date alongside your other certificate renewals.

​
4. Turn the app on for your users

A newly created SAML app is off by default. Until you turn it on, sign-in fails with a Google 403.
1

Open the app's Service status

Go to Apps → Web and mobile apps, select your SAML app, then open Service status.
2

Turn it on

Set the service to ON for everyone, or turn it on for the specific organizational units that should have Management Tool access. Click Save.
Service status panel showing the ON for everyone option selected

Turning the SAML app on for users.

Google notes that most changes take effect within a few minutes, so allow a short delay before testing.

​
5. Test the sign-in

1

Open the Management Tool

Go to the Management Tool sign-in page.
2

Click Log in with SSO

The Log in with SSO button appears below the standard Log In button.
3

Sign in with Google

You are redirected to the Google sign-in page. After authenticating, you are returned to the Management Tool, signed in.
Signing in with a Google Workspace account returns you to the Management Tool without a Syteca password.
Syteca Management Tool login page showing the Log in with SSO button

The Log in with SSO button on the Management Tool sign-in page.

Keep at least one local Syteca administrator account that can sign in with a password. If the identity provider becomes unreachable, or the SAML certificate expires, that account is how you get back into the Management Tool.

​
Troubleshooting

Google reports “Service is not configured for this user.” The SAML app is not turned on for the account you are signing in with.Go to Apps → Web and mobile apps → your SAML app → Service status and turn the service on, as described in section 4. If it is already on for some organizational units, confirm the account you are testing with belongs to one of them.
The ACS URL in Google does not match the Management Tool. Compare the ACS URL in the Google app’s service provider details against your Management Tool URL, including the application path (Syteca or EkranSystem) and the /Account/ConsumeSSO suffix. A trailing slash, a different hostname form, or http instead of https are all enough to break it.
The SSO configuration has not been saved in the Management Tool. Re-open Configuration → SSO Integration and confirm the Issuer name is filled in and the identity provider metadata file is uploaded, then click Save.
The account was created by Auto-create a Management Tool account for a new user on the first SSO login and has no permissions yet. Open the user on the Users page and assign the user groups and administrative permissions they need.

SSO integration

How SSO works in Syteca, and what it applies to.

Users and user groups

Assign permissions to accounts that sign in through SSO.

Administrative permissions

The permission required to configure SSO Integration.

Two-factor authentication

Additional sign-in protection for Management Tool accounts.