4

SSO

Last Update hace 14 horas

Single Sign-On (SSO) Overview Set Up SSO with Google Workspace Set Up SSO with Microsoft Entra ID Set Up SSO with Okta

Set Up SSO with Google Workspace

Connect Google Workspace to BounceBan with a custom SAML app, with optional team roles from Google groups.

Gavin

Last Update hace 14 horas

This guide shows how to connect Google Workspace to BounceBan with a custom SAML app. For how SSO works in BounceBan, see the Single Sign-On (SSO) overview.
Use SAML with Google Workspace. Google's OpenID Connect doesn't send group membership (so team roles from groups won't work), and Google can't push SCIM provisioning to custom apps. With Google Workspace, new people get a BounceBan account the first time they sign in with SSO.
Before you start
  • SSO must be turned on for your BounceBan team (contact your account manager or [email protected]).
  • You need to be the BounceBan team owner or a team admin, and a Google Workspace super administrator.
  • Open your BounceBan SSO page: https://bounceban.com/app/account/sso.
  • Verify your email domain in step 1 of the SSO page first (see the overview).
1. Create a custom SAML app in Google
  1. In the Google Admin console (admin.google.com), go to Apps > Web and mobile apps.
  2. Click Add app > Add custom SAML app.
  3. Enter an app name (for example "BounceBan") and click Continue.
  4. On the Google Identity Provider details page, copy the SSO URL, Entity ID and Certificate. Keep this page open, or come back to it later from the app's details. Click Continue.
2. Enter BounceBan's details in Google
On the BounceBan SSO page, in step 2, choose SAML 2.0. In Google's Service provider details, enter:
  • ACS URL: BounceBan's ACS URL (Reply URL)
  • Entity ID: BounceBan's Entity ID (Audience URI)
  • Start URL (optional): BounceBan's Sign-on URL (optional)
  • Name ID format: EMAIL
  • Name ID: Basic Information > Primary email
The BounceBan values look like https://bounceban.com/sso/saml/
Leave Signed response unchecked (BounceBan accepts Google's default signed assertion). Click Continue.
3. Map attributes
On the Attribute mapping page:
  1. Click Add mapping: Google Directory attribute Primary email → App attribute email.
  2. Optional, for team roles: under Group membership (optional), choose the Google groups that matter for BounceBan (for example "BounceBan Admins") and set App attribute to groups. Google sends only the selected groups the person belongs to.
  3. Click Finish.
4. Turn the app on for your users
  1. Open the app's details and click User access.
  2. Choose ON for everyone, or turn it on only for the organizational units or groups who should use BounceBan.
  3. Click Save.
Changes in Google usually take effect within a few minutes, but Google says they can take up to 24 hours.
5. Copy Google's settings into BounceBan
On the BounceBan SSO page, in step 2 (SAML 2.0), fill in:
  • IdP Entity ID (Issuer): Google's Entity ID (looks like https://accounts.google.com/o/saml2?idpid=…).
  • IdP SSO URL (Login URL): Google's SSO URL.
  • Signing certificates: paste Google's Certificate.
Leave IdP metadata URL (optional) empty. Google only offers metadata as a file to download, not as a URL, so copy the values above instead. Click Save.
6. Test and turn on SSO sign-in
  1. In step 3 of the BounceBan SSO page, click Test connection and sign in with your own Google Workspace account (the app must be on for you).
  2. Check the result: it should show your email address on your verified domain and, if you set it up, your groups.
  3. Turn on Turn on SSO sign-in.
People can now sign in at https://bounceban.com/account/sso with their work email.
To let people open BounceBan from the Google apps menu, either set the Start URL in Google (step 2 above), or turn on Allow sign-in from the identity provider's app dashboard (IdP-initiated) in step 3 of the SSO page.
Optional: team roles from Google groups
  1. Make sure Google sends the groups attribute (step 3 above).
  2. In step 5 of the BounceBan SSO page, keep Groups attribute or claim as groups.
  3. Under Admin groups, enter the Google group names whose members should be BounceBan team admins, one per line (up to 20, not case-sensitive). Use Test connection to see exactly how Google sends them.
  4. Turn on Set team roles from these groups and click Save.
Roles are updated each time someone signs in with SSO. People in none of the admin groups become members. The team owner's role doesn't change.
Troubleshooting
Google shows "Error 400: malformed_certificate".
The certificate of your Google SAML app has expired. In the Google Admin console, open the app, create a new certificate, and copy it. On the BounceBan SSO page, paste the new certificate under Signing certificates (you can keep up to 2; remove the expired one), click Save, then test the connection again and turn Turn on SSO sign-in back on. Changing the certificate turns SSO sign-in off until you test again.
Google shows "app not configured for user" or a similar access error.
The app isn't turned on for this person's organizational unit or group. Check User access (step 4) and wait a few minutes for the change to take effect.
The test says the SAML response could not be verified.
Check that the ACS URL and Entity ID in Google exactly match your BounceBan SSO page, and that the IdP Entity ID, SSO URL and certificate in BounceBan match Google's Google Identity Provider details.
The test shows no groups.
Check that the group mapping's app attribute is groups and that your test user is in one of the selected groups.
For more answers, see the SSO overview FAQ.

Was this article helpful?

0 out of 0 liked this article

Still need help? Message Us