Setting up Google Workspace authentication - User Guide - BlueCat Horizon

1. Create a custom SAML application

1. In the Google Admin Console, navigate to Apps > Web and mobile apps > Add app > Add custom SAML app.
2. In the App name field, enter Horizon SSO.
3. Select Continue.

2. Configure service provider details

1. Enter the following values from the metadata file you downloaded previously for these fields:

   Field	Value
   ACS URL	AssertionConsumerServiceURL without query parameters, for example https://example.com/login/callback
   Entity ID	entityID

2. Enable Signed Response.
3. Select Continue.

3. Configure attribute mapping

In Google Workspace, SAML attributes are configured using both:

• Attribute mapping for user profile fields
• Group mapping for group membership

Each mapping defines a SAML claim that will be included in the SAML assertion sent to BlueCat Horizon.

Each claim consists of:

• App Attribute: The claim identifier expected by BlueCat Horizon
• Google Directory Attribute: The source of the value in Google Workspace

1. Add the following mappings:

   App attribute	Google Directory attribute
   https://bluecatnetworks.com/saml/claims/emailaddress	Primary email address
   https://bluecatnetworks.com/saml/claims/name	Google Workspace does not provide a default full name attribute for SAML. You must create a custom user attribute, such as “Full Name”, and populate it with the user’s full name

4. Configure group mapping

When configuring group mapping in Google Workspace, keep the following in mind:

• The Groups claim must return a multi-value list of strings.
• Each group name must exactly match a group configured in BlueCat Horizon
• Google Workspace does not send all groups by default. Only selected groups are included.
• If no matching groups are found, the user will be authenticated but no roles or permissions will be assigned.

1. On the same screen, scroll down to Group membership (optional).
2. Select the groups you want to include. Make sure the groups match the ones you created in BlueCat Horizon for your external users.
   Note: Google Workspace only sends explicitly selected groups. If a group is not selected here, it will not be included in the SAML assertion.
3. Set the App attribute name to https://bluecatnetworks.com/saml/claims/groups.
4. Select Finish.

5. Assign users

1. Navigate to Apps > Web and mobile apps > Horizon SSO > User access.
2. Either select ON for everyone or assign users by group or organization.
3. Select Save.

6. Retrieve Google identity provider information

1. Navigate to Apps > Web and mobile apps > Horizzon SSO > Download metadata.
2. Copy the SSO URL value.
3. Download the Certificate.

7. Update the SSO connection

1. In BlueCat Horizon, navigate to Administration > Single sign-on.
2. Your SSO connection and its details should be displayed, including the placeholder values. Select Edit.
3. In the dialog, replace the placeholder values with the real ones from your SSO configuration:
   1. Enter the SSO URL value you copied in the Google Admin Console into the Sign in URL field.
   2. Drag and drop or upload the Google Signing Certificate you downloaded into the Signing certificate field.
4. Select Update.