implementing-google-workspace-sso-configuration skill (Anthropic-Cybersecurity-Skills)

From Public Agent Wiki

What it does. Configures SAML 2.0 single sign-on for Google Workspace against a third-party Part of mukul975/Anthropic-Cybersecurity-Skills (817 security skills) (mukul975/Anthropic-Cybersecurity-Skills).
Upstream mukul975/Anthropic-Cybersecurity-Skills
Skill file skills/implementing-google-workspace-sso-configuration/SKILL.md
License Apache-2.0 (skill folder LICENSE)
Author mukul975
Fetched 2026-09-10

Install

  • npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill implementing-google-workspace-sso-configuration, or copy the skill folder into ~/.claude/skills/implementing-google-workspace-sso-configuration/.
  • Raw file: curl -sL https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-google-workspace-sso-configuration/SKILL.md

SKILL.md (verbatim)

name: implementing-google-workspace-sso-configuration
description: Configures SAML 2.0 single sign-on for Google Workspace against a third-party
  identity provider (Okta, Azure AD/Entra ID, ADFS), with Workspace as the Service
  Provider, to centralize authentication and enable immediate access revocation.
  Use when setting up or troubleshooting Google Workspace SSO/SAML federation or
  migrating from native Google passwords to an external IdP.
domain: cybersecurity
subdomain: identity-access-management
tags:
- google-workspace
- sso
- saml
- identity-provider
- authentication
- federation
version: '1.0'
author: mahipal
license: Apache-2.0
nist_csf:
- PR.AA-01
- PR.AA-02
- PR.AA-05
- PR.AA-06
mitre_attack:
- T1078
- T1110
- T1556
- T1098
mitre_f3:
  version: '1.1'
  tactics:
  - initial-access
  - positioning
  techniques:
  - id: T1110
    name: Brute Force
    tactic: initial-access
    source: attack
  - id: T1110.004
    name: 'Brute Force:  Credential Stuffing'
    tactic: initial-access
    source: attack
  - id: T1539
    name: Steal Web Session Cookie
    tactic: positioning
    source: attack
  - id: F1004
    name: Access with Stolen Session Cookie
    tactic: initial-access
    source: f3
  - id: F1006
    name: Account Takeover
    tactic: initial-access
    source: f3

Implementing Google Workspace SSO Configuration

Overview

Single Sign-On (SSO) for Google Workspace allows organizations to authenticate users through their existing identity provider (IdP) such as Okta, Azure AD (Microsoft Entra ID), or ADFS, rather than managing separate Google passwords. This is implemented using SAML 2.0 protocol where Google Workspace acts as the Service Provider (SP) and the organization's IdP handles authentication. SSO centralizes credential management, enforces MFA policies at the IdP, and enables immediate access revocation when users leave the organization.

When to Use

  • When deploying or configuring implementing google workspace sso configuration capabilities in your environment
  • When establishing security controls aligned to compliance requirements
  • When building or improving security architecture for this domain
  • When conducting security assessments that require this implementation

Prerequisites

  • Google Workspace Business, Enterprise, or Education edition
  • Super Admin access to Google Admin Console
  • Identity Provider with SAML 2.0 support (Okta, Azure AD, ADFS, Ping Identity)
  • IdP signing certificate (X.509 PEM format, RSA or DSA)
  • DNS verification for the Google Workspace domain

Core Concepts

SAML 2.0 SSO Flow

User navigates to Google Workspace app (Gmail, Drive, etc.)
        │
        ├── Google checks: Is SSO configured for this domain?
        │
        ├── YES → Redirect user to IdP Sign-In Page URL
        │          (SAML AuthnRequest sent via browser redirect)
        │
        ├── User authenticates at IdP (credentials + MFA)
        │
        ├── IdP generates SAML Response with signed assertion
        │
        ├── Browser POSTs SAML Response to Google ACS URL:
        │   https://www.google.com/a/{domain}/acs
        │
        ├── Google validates SAML signature against uploaded certificate
        │
        └── User is granted access to Google Workspace

Key SAML Parameters

Parameter Value
ACS URL https://www.google.com/a/{your-domain}/acs
Entity ID google.com/a/{your-domain} or google.com
NameID Format urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress
NameID Value User's primary Google Workspace email
Binding HTTP-POST (for ACS), HTTP-Redirect (for SSO URL)

Workflow

Step 1: Prepare the Identity Provider

For Okta:

  1. Navigate to Applications > Add Application > Search "Google Workspace"
  2. Configure the Google Workspace app with your domain
  3. Assign users/groups to the application
  4. Download the IdP metadata or note: SSO URL, Entity ID, Certificate

For Azure AD (Microsoft Entra ID):

  1. Navigate to Enterprise Applications > New Application > Google Cloud/Workspace
  2. Configure Single sign-on > SAML
  3. Set Basic SAML Configuration:
    • Identifier (Entity ID): google.com
    • Reply URL (ACS): https://www.google.com/a/{your-domain}/acs
    • Sign on URL: https://www.google.com/a/{your-domain}/ServiceLogin
  4. Download Federation Metadata XML or Certificate (Base64)

For ADFS:

  1. Add Relying Party Trust using federation metadata
  2. Configure claim rules to pass NameID as email address
  3. Export the token-signing certificate

Step 2: Configure Google Workspace SSO

  1. Sign in to Google Admin Console (admin.google.com) as Super Admin
  2. Navigate to Security > Authentication > SSO with third-party IdP
  3. Click "Add SSO profile" or configure the default profile

Third-Party SSO Profile Settings:

Setting Value
Set up SSO with third-party IdP Enabled
Sign-in page URL IdP's SAML SSO endpoint (e.g., https://idp.example.com/sso/saml)
Sign-out page URL IdP's logout URL (e.g., https://idp.example.com/slo)
Change password URL IdP's password change URL
Verification certificate Upload IdP's X.509 signing certificate
Use a domain-specific issuer Enabled (uses google.com/a/{domain} as entity ID)

Step 3: Assign SSO Profile to Users

SSO profiles can be applied at different scopes:

Organization-wide (all users)
    │
    ├── Org Unit level (specific departments)
    │   ├── Engineering OU → SSO via Okta
    │   ├── Marketing OU → SSO via Azure AD
    │   └── Contractors OU → SSO via specific IdP
    │
    └── Group level (specific security groups)
        └── VPN Users → SSO with additional MFA
  1. Navigate to Security > Authentication > SSO with third-party IdP
  2. Select the SSO profile to assign
  3. Choose organizational units or groups
  4. Save and wait for propagation (up to 24 hours, typically minutes)

Step 4: Configure Network Masks (Optional)

Network masks control when SSO is enforced based on the user's IP:

  • If the user's IP matches a network mask, they use Google's sign-in page
  • If the user's IP does NOT match, they are redirected to the IdP

This is useful for allowing direct Google login from corporate network while enforcing SSO for external access.

Step 5: Test SSO

  1. Open an incognito browser window
  2. Navigate to https://mail.google.com/a/{your-domain}
  3. Verify redirect to IdP sign-in page
  4. Authenticate at the IdP
  5. Verify successful redirect back to Google Workspace
  6. Test sign-out flow redirects to IdP logout page
  7. Test with user not assigned in IdP (should fail)

Validation Checklist

  • IdP SAML application configured with correct ACS URL and Entity ID
  • IdP signing certificate uploaded to Google Admin Console
  • SSO profile assigned to target organizational units/groups
  • SAML assertion includes correct NameID (email format)
  • MFA enforced at IdP for all Google Workspace users
  • Sign-out URL configured to terminate IdP session
  • Network masks configured if internal/external access differs
  • Break-glass Super Admin accounts bypass SSO (use Google auth)
  • SSO tested with multiple user types (admin, standard, contractor)
  • SAML response signature validated successfully
  • Error handling tested (expired cert, invalid user, clock skew)

References

Other files in this skill

assets/template.md (verbatim)

Google Workspace SSO Implementation Template

Configuration Details

Setting Value
Google Workspace Domain
ACS URL https://www.google.com/a/{domain}/acs
Entity ID google.com/a/{domain}
IdP Name Okta / Azure AD / ADFS / Other
IdP SSO URL
IdP Sign-out URL
Certificate Expiry

Pre-Implementation Checklist

  • Google Workspace Super Admin access confirmed
  • IdP SAML application created for Google Workspace
  • IdP signing certificate exported (X.509 PEM)
  • User attributes mapped (NameID = email)
  • Test users assigned in IdP
  • Break-glass Super Admin account identified (bypasses SSO)

Testing Results

Test Case Result Notes
SP-initiated SSO (from Google login) Pass/Fail
IdP-initiated SSO (from IdP portal) Pass/Fail
User not in IdP (access denied) Pass/Fail
Sign-out flow Pass/Fail
Super Admin bypass Pass/Fail
MFA enforcement at IdP Pass/Fail
Clock skew tolerance Pass/Fail

Rollout Plan

  • Phase 1: IT team pilot (1 week)
  • Phase 2: Engineering department (1 week)
  • Phase 3: All organizational units
  • User communication sent
  • Help desk trained
  • Monitoring configured for auth failures

references/api-reference.md (verbatim)

API Reference: Implementing Google Workspace SSO Configuration

SAML 2.0 Endpoints

Endpoint URL
SP ACS URL https://accounts.google.com/samlrp/acs?rpid=RPID
SP Entity ID google.com/a/DOMAIN
SP Metadata https://accounts.google.com/samlrp/metadata?rpid=RPID

Admin Console Path

Admin Console > Security > Authentication > SSO with third-party IdP

SAML Configuration Fields

Field Description
Sign-in page URL IdP SSO endpoint (HTTPS required)
Sign-out page URL IdP SLO endpoint
Change password URL IdP password change page
Verification certificate IdP X.509 signing cert (PEM, RSA 2048+)
Domain-specific issuer Use domain in SAML issuer

Certificate Validation (Python cryptography)

from cryptography import x509
cert = x509.load_pem_x509_certificate(pem_data)
print(cert.not_valid_after_utc)
print(cert.subject.rfc4514_string())
print(cert.public_key().key_size)

Admin SDK Reports API (Login Activity)

from googleapiclient.discovery import build
service = build("admin", "reports_v1", credentials=creds)
activities = service.activities().list(
    userKey="all", applicationName="login",
    eventName="login_success").execute()

Common IdP Providers

IdP SAML SSO URL Pattern
Okta https://DOMAIN.okta.com/app/APP_ID/sso/saml
Azure AD https://login.microsoftonline.com/TENANT/saml2
ADFS https://ADFS_HOST/adfs/ls/
Ping Identity https://sso.connect.pingidentity.com/sso/sp/initsso

References

references/standards.md (verbatim)

Google Workspace SSO - Standards Reference

SAML 2.0 Standard

OASIS SAML 2.0 Core

  • Assertions: Authentication statements, attribute statements
  • Protocols: AuthnRequest, Response, LogoutRequest
  • Bindings: HTTP Redirect, HTTP POST, Artifact
  • Profiles: Web Browser SSO, Single Logout

Google Workspace SAML Requirements

  • SAML 2.0 compliant IdP
  • HTTP POST binding for Assertion Consumer Service
  • Signed SAML assertions (RSA-SHA256 recommended)
  • NameID format: emailAddress (user's primary email)
  • X.509 PEM certificate for signature verification

Google Workspace SSO Parameters

Parameter Value
ACS URL https://www.google.com/a/{domain}/acs
Entity ID (domain-specific) google.com/a/{domain}
Entity ID (generic) google.com
NameID Format urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress
SAML Version 2.0
Binding HTTP-POST

Compliance Mapping

NIST SP 800-63-3 (Digital Identity Guidelines)

  • AAL2: Multi-factor authentication (enforced at IdP)
  • Federation assurance levels (FAL1-FAL3)
  • Assertion protection requirements

SOC 2 - CC6.1

  • Single sign-on centralizes access control
  • Audit trail of authentication events
  • Timely deprovisioning via IdP user removal

ISO 27001:2022 - A.8.5

  • Secure authentication through centralized IdP
  • MFA enforcement via SSO configuration
  • Session management controls

references/workflows.md (verbatim)

Google Workspace SSO - Workflows

SSO Configuration Workflow

1. PREPARE IDP
   ├── Create Google Workspace SAML application in IdP
   ├── Configure ACS URL: https://www.google.com/a/{domain}/acs
   ├── Configure Entity ID: google.com/a/{domain}
   ├── Set NameID to user email address
   ├── Map required attributes (firstName, lastName)
   └── Download IdP metadata (SSO URL, certificate, entity ID)

2. CONFIGURE GOOGLE ADMIN CONSOLE
   ├── Navigate to Security > Authentication > SSO with third-party IdP
   ├── Enable third-party SSO
   ├── Enter Sign-in page URL from IdP
   ├── Enter Sign-out page URL from IdP
   ├── Upload IdP verification certificate
   ├── Enable domain-specific issuer
   └── Save configuration

3. ASSIGN SSO PROFILE
   ├── Apply to entire organization OR
   ├── Apply to specific organizational units OR
   └── Apply to specific groups

4. TEST
   ├── Test IdP-initiated SSO (login from IdP portal)
   ├── Test SP-initiated SSO (login from Google page)
   ├── Test sign-out flow
   ├── Test with user not in IdP (should fail)
   └── Test break-glass Super Admin access (should bypass SSO)

5. ROLLOUT
   ├── Communicate changes to users
   ├── Apply to all organizational units
   ├── Monitor for authentication failures
   └── Update help desk with troubleshooting guide

User Authentication Flow (SP-Initiated)

User navigates to mail.google.com/a/{domain}
    │
    ├── Google identifies federated domain
    │
    ├── Redirect to IdP with SAML AuthnRequest
    │   URL: {IdP SSO URL}?SAMLRequest={base64encoded}
    │
    ├── User authenticates at IdP:
    │   ├── Enter credentials
    │   ├── Complete MFA challenge
    │   └── IdP validates against directory
    │
    ├── IdP generates SAML Response:
    │   ├── Assertion with NameID (email)
    │   ├── Authentication context (MFA)
    │   ├── Digitally signed with IdP certificate
    │   └── Optionally encrypted
    │
    ├── Browser POSTs Response to Google ACS URL
    │
    ├── Google validates:
    │   ├── Signature against uploaded certificate
    │   ├── Assertion not expired
    │   ├── Audience matches entity ID
    │   ├── NameID matches a Google Workspace user
    │   └── InResponseTo matches original request
    │
    └── User logged in to Google Workspace

Certificate Renewal Workflow

IdP signing certificate approaching expiration (30 days before)
    │
    ├── Generate new signing certificate in IdP
    │
    ├── Upload new certificate to Google Admin Console
    │   (Google supports multiple verification certificates)
    │
    ├── Promote new certificate as primary in IdP
    │
    ├── Verify SSO still works with new certificate
    │
    └── Remove old certificate from Google Admin Console after confirmation

Troubleshooting Workflow

User reports SSO failure
    │
    ├── Check 1: Is user assigned to the Google Workspace app in IdP?
    │   └── NO → Assign user in IdP
    │
    ├── Check 2: Does NameID match user's Google email exactly?
    │   └── NO → Fix attribute mapping in IdP
    │
    ├── Check 3: Is the IdP certificate expired?
    │   └── YES → Upload renewed certificate
    │
    ├── Check 4: Is there clock skew between IdP and Google?
    │   └── YES → Sync NTP on IdP server (max 5 min skew allowed)
    │
    ├── Check 5: Is the SAML assertion properly signed?
    │   └── NO → Verify IdP signing algorithm matches uploaded cert
    │
    └── Check 6: Check IdP SAML debug logs for detailed error

Back to mukul975/Anthropic-Cybersecurity-Skills (817 security skills) or Agent skills.