How to Set Up SSO with Google Workspace (GSuite) in AIScreen Manager

Single Sign-On (SSO) enables users to log into AIScreen Manager using their Google Workspace (formerly GSuite) credentials, simplifying the login process and enhancing security. This guide provides a detailed, step-by-step process in English to configure SSO with Google Workspace in AIScreen Manager, ensuring clients can easily navigate and complete the setup.

Introduction:

SSO (Single Sign-On) allows users to access multiple applications with a single set of credentials. In this setup, we’ll use Google Workspace as the identity provider and AIScreen Manager as the service provider, leveraging the SAML (Security Assertion Markup Language) protocol to securely exchange authentication data between Google Workspace and AIScreen.

Step 1: Log in to AIScreen Manager

• Open your AIScreen Manager account.

• Navigate to Settings on the left sidebar.

• Select Single Sign-On (SSO) from the menu.

Step 2: Add a New SSO Provider in AIScreen Manager

• Click the Add Provider button.

• In the popup, fill in the following fields:
  
  • Display Name: Enter a name for your SSO provider (how it will appear in AIScreen).
    
  • Domain: Enter your company’s domain.
    
  • Provider Type: Select Google Workspace (GSuite) or equivalent.
    
  • Leave Metadata URL blank for now (you will fill this in later).

• After entering the name and domain and selecting the provider, the system will generate:
  
  • Entity ID
    
  • ACS URL

Step 3: Set Up the SAML App in Google Workspace (GSuite)

3.1 Log into Google Admin Console

• Open a new browser tab and go to the Google Admin Console (https://admin.google.com).

• Log in with your Google Workspace administrator credentials.

3.2. Access Google Workspace Admin Console

• In the left menu, click Apps.
  
• On the next page, select Overview
  
• Select Web and mobile apps.

3.3 Add a Custom SAML App

• On the Web and Mobile Apps page, click the Add App button.

• From the dropdown menu, select Add custom SAML app.

3.4 Configure App Details

• You’ll be taken to the Add custom SAML app page.

• App name: Enter a name, such as “AIScreen SSO”.

• Description (optional): Add a brief description, e.g., “SSO for AIScreen Manager”.

• App icon (optional): Upload a logo for the app (e.g., AIScreen or your company logo) if desired.

• Click Continue.

3.5 Obtain Google Identity Provider Details

On the Google Identity Provider Details step, you’ll see several values:

• SSO URL: The login URL (e.g., https://accounts.google.com/o/saml2/idp?…).
  
• Entity ID: Google’s identifier (e.g., https://accounts.google.com/o/saml2?…).
  
• Certificate: The Google Workspace certificate (available for download or copying).

Copy the SSO URL, Entity ID, and Certificate.

3.6 Insert Details into AIScreen

• Switch back to AIScreen Manager (to the form from Step 2).

• In the provider setup form, click Advanced settings.

• New input fields will appear:
  
  • Paste the SSO URL into the corresponding field.
    
  • Paste the Entity ID into the corresponding field.
    
  • Paste the Certificate into the corresponding field.
    
• Click Add provider to save the settings in AIScreen.

3.7 Return to Google Workspace

• After saving in AIScreen, switch back to the Google Admin Console.

• Click Continue to proceed to the next step.

3.8 Configure Service Provider Details

• On the Service Provider Details page, enter the following:
  
  • ACS URL: Paste the ACS URL copied from AIScreen in Step 2.
    
  • Entity ID: Paste the Entity ID also copied from AIScreen.
    
  • Name ID Format: Select EMAIL (or leave as default if unsure).
    
  • Name ID: Choose Basic Information > Primary Email (this ensures Google sends the user’s email as the identifier).
    
• Click Continue.

3.9 Add Attribute Mapping

• On the Attribute Mapping step, configure the mapping as shown:
  
  • Click Add Mapping.
    
  • Map Basic Information > First Name (Google Directory attribute) to firstName (App attribute).
    
  • Add another mapping: Basic Information > Last Name to lastName.
    
• Click Finish.

Step 4: Enable Access for Users

• Go to User Access:
  
  • After finishing the setup, you’ll be on the app’s page in the Google Admin Console.
    
  • Locate and click User Access.

• Turn On for Everyone:
  
  • On the next page, find the ON for everyone option.
    
  • Toggle the switch to ON.
    
• Click Save to apply the changes.

Step 5: Assign Users and Test the Setup

5.1. Assign Users:

• Ensure the desired users or groups have access to the app in Google Workspace. This is already done if you selected “ON for everyone.”

• To limit access, go back to User Access and add specific users or groups.

5.2. Test the SSO:

• Log out of AIScreen Manager.
  
• Navigate to the AIScreen login page and select the SSO option (e.g., “Google SSO”).
  
• Log in with your Google Workspace credentials to verify the setup works.

Troubleshooting Tips:

• Login fails: Double-check the Entity ID, ACS URL, and Metadata URL for typos or mismatches.

• App not visible: Ensure the app is set to “Visible in Portal” in OneLogin.

• Still stuck?: Contact AIScreen support (hello@aiscreen.io) or OneLogin support with your configuration details.