> ## Documentation Index > Fetch the complete documentation index at: https://syteca.com/docs/llms.txt > Use this file to discover all available pages before exploring further. # Configure Google Workspace SSO > Set up SAML single sign-on between Syteca and Google Workspace so administrators sign in to the Management Tool with their Google accounts. Google Workspace can act as the SAML identity provider for the Syteca Management Tool, so administrators sign in with their Google accounts instead of a separate Syteca password. This page covers the full setup: creating the SAML app in Google, importing its metadata into Syteca, and returning to Google to supply the Syteca endpoints. The configuration crosses between the two consoles twice, so work through the sections in order. ## Before you start | You need | Notes | | - | - | | A Google Workspace account with super administrator rights | Required to create a custom SAML app. | | A Management Tool user with the administrative **Tenant Management and System Configuration** permission | Required to open **Configuration → SSO Integration**. | | Your Management Tool URL | You will enter it in three places, and all three must match exactly. See below. | | HTTPS on the Management Tool | SAML assertions are posted back over HTTPS. | ### Get your Management Tool URL right This is the single most common cause of a failed setup. Google and Syteca must agree on the Management Tool's address, character for character. Open the Management Tool in a browser and copy the address from the URL bar, up to and including the application path. You will get something like `https://10.0.2.10/Syteca`. Throughout this page, `` means that value. ## 1. Create the SAML app in Google Workspace **1. Open the Apps section** Sign in to the Google Workspace Admin Console and go to **Apps**. **2. Add a custom SAML app** Select **Web and mobile apps**, click **Add app**, then choose **Add custom SAML app**. **3. Name the app** Fill in **App name** and **Description** with anything that identifies the integration for your team, for example `SytecaSSO` and `SytecaSSO-Integration`. An app icon is optional, up to 4 MB. Click **Continue**. **4. Download the IdP metadata** On the **Google Identity Provider details** step, under **Option 1: Download IdP metadata**, click **DOWNLOAD METADATA**. This saves an XML file you will upload to Syteca in the next section. > [!WARNING] > > **Leave the Google wizard open.** You return to it in section 3 to fill in the service provider details. Closing it now means starting the app over. ## 2. Import the metadata into Syteca **1. Open SSO Integration** In the Management Tool, click the gear icon to open **Configuration**, then select **SSO Integration**. **2. Enter the Issuer name** In **Issuer name**, type your ``, for example `https://10.0.2.10/Syteca`. **3. Upload the metadata file** Next to **Identity provider metadata (xml)**, click **Choose File** and select the XML file you downloaded from Google. **4. Choose a certificate option** Select **Self-signed certificate** or **Custom certificate**, depending on which certificate the Management Tool should use for the SAML exchange. **5. Decide how new users are handled** Leave **Auto-create a Management Tool account for a new user on the first SSO login** selected to create accounts on demand, or clear it to allow only users who already have a Syteca account to sign in. See the note below before deciding. **6. Save** Click **Save**. ![Syteca SSO Integration configuration page showing issuer name and identity provider metadata fields](https://mintcdn.com/syteca/p5NWVPEDUKZwkakZ/images/administration/integrations/google-sso-management-tool-config.png?fit=max\&auto=format\&n=p5NWVPEDUKZwkakZ\&q=85\&s=ac0f8deb11c8e41ffb9df9c1aa59641c) The SSO Integration page with the Google metadata uploaded. > [!WARNING] > > **Auto-create affects who can get into the Management Tool.** With it enabled, any Google Workspace user the app is turned on for receives a Management Tool account the first time they sign in. Scope the app in [section 4](#4--turn-the-app-on-for-your-users) to the organizational units that should have administrative access, rather than leaving it on for the whole domain. ## 3. Complete the service provider details in Google Return to the Google wizard, on the **Service provider details** step. **1. Enter the ACS URL and Entity ID** Build both values from your ``: | Field | Value | | - | - | | **ACS URL** | `/Account/ConsumeSSO` | | **Entity ID** | `` | For a Management Tool at `https://192.168.56.1/Syteca`, that gives an ACS URL of `https://192.168.56.1/Syteca/Account/ConsumeSSO` and an Entity ID of `https://192.168.56.1/Syteca`. **2. Leave Start URL and Signed response alone** **Start URL** stays empty, and **Signed response** stays cleared. **3. Set the Name ID** Set **Name ID format** to **EMAIL**, and **Name ID** to **Basic Information > Primary email**. **4. Finish the wizard** Click **Continue**, then **Finish**. No attribute mapping is required. ![Google Workspace service provider details showing ACS URL, Entity ID, and Name ID configuration](https://mintcdn.com/syteca/p5NWVPEDUKZwkakZ/images/administration/integrations/google-sso-service-provider-details.png?fit=max\&auto=format\&n=p5NWVPEDUKZwkakZ\&q=85\&s=f853a73a2a291f4e97322fe3c6aed4ab) The service provider details, built from the Management Tool URL. > [!NOTE] > > The **Certificate** drop-down is pre-filled with the Google SAML certificate generated for your domain. Note its expiry date, shown next to its name. SSO stops working when it expires, so track that date alongside your other certificate renewals. ## 4. Turn the app on for your users A newly created SAML app is off by default. Until you turn it on, sign-in fails with a Google 403. **1. Open the app's Service status** Go to **Apps → Web and mobile apps**, select your SAML app, then open **Service status**. **2. Turn it on** Set the service to **ON for everyone**, or turn it on for the specific organizational units that should have Management Tool access. Click **Save**. ![Service status panel showing the ON for everyone option selected](https://mintcdn.com/syteca/p5NWVPEDUKZwkakZ/images/administration/integrations/google-sso-service-status.png?fit=max\&auto=format\&n=p5NWVPEDUKZwkakZ\&q=85\&s=c1120a226812458dffd0fcb2a1523397) Turning the SAML app on for users. > [!NOTE] > > Google notes that most changes take effect within a few minutes, so allow a short delay before testing. ## 5. Test the sign-in **1. Open the Management Tool** Go to the Management Tool sign-in page. **2. Click Log in with SSO** The **Log in with SSO** button appears below the standard **Log In** button. **3. Sign in with Google** You are redirected to the Google sign-in page. After authenticating, you are returned to the Management Tool, signed in. > [!TIP] > > Signing in with a Google Workspace account returns you to the Management Tool without a Syteca password. ![Syteca Management Tool login page showing the Log in with SSO button](https://mintcdn.com/syteca/p5NWVPEDUKZwkakZ/images/administration/integrations/google-sso-login-button.png?fit=max\&auto=format\&n=p5NWVPEDUKZwkakZ\&q=85\&s=c1791472817eeaa2a71d60ee0d599365) The Log in with SSO button on the Management Tool sign-in page. > [!TIP] > > Keep at least one local Syteca administrator account that can sign in with a password. If the identity provider becomes unreachable, or the SAML certificate expires, that account is how you get back into the Management Tool. ## Troubleshooting > **Error 403: app\_not\_configured\_for\_user** > > Google reports *"Service is not configured for this user."* The SAML app is not turned on for the account you are signing in with. > > Go to **Apps → Web and mobile apps → your SAML app → Service status** and turn the service on, as described in [section 4](#4--turn-the-app-on-for-your-users). If it is already on for some organizational units, confirm the account you are testing with belongs to one of them. > **Sign-in redirects to Google but fails to return** > > The ACS URL in Google does not match the Management Tool. Compare the **ACS URL** in the Google app's service provider details against your Management Tool URL, including the application path (`Syteca` or `EkranSystem`) and the `/Account/ConsumeSSO` suffix. A trailing slash, a different hostname form, or `http` instead of `https` are all enough to break it. > **The Log in with SSO button does not appear** > > The SSO configuration has not been saved in the Management Tool. Re-open **Configuration → SSO Integration** and confirm the Issuer name is filled in and the identity provider metadata file is uploaded, then click **Save**. > **A user signs in but has no access to anything** > > The account was created by **Auto-create a Management Tool account for a new user on the first SSO login** and has no permissions yet. Open the user on the [Users page](https://syteca.com/docs/administration/users/users.md) and assign the user groups and administrative permissions they need. ## Related > **[SSO integration](https://syteca.com/docs/administration/integrations/sso.md)** > > How SSO works in Syteca, and what it applies to. > **[Users and user groups](https://syteca.com/docs/administration/users/users.md)** > > Assign permissions to accounts that sign in through SSO. > **[Administrative permissions](https://syteca.com/docs/administration/users/administrative-permissions.md)** > > The permission required to configure SSO Integration. > **[Two-factor authentication](https://syteca.com/docs/administration/access/two-factor-authentication.md)** > > Additional sign-in protection for Management Tool accounts. This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.