Set up single sign-on with Google Workspace

Requiring Google sign-in covers most companies on Google Workspace. Connect Google Workspace itself, as a custom SAML app, when you want its app access settings (which organizational units or groups can use Freesbe) to decide who gets in.

Before you start

• Single sign-on with your own provider comes with the Corporate and Enterprise plans.
• Verify your company’s email domain in the Admin Center under People → Joining → Email domains (see Let people join with their work email). Your provider can only sign in addresses at a verified domain.
• You need to be an owner of the workspace in Freesbe, and able to add apps in Google Workspace.
• Keep the Freesbe page open in one tab and Google Workspace in another: you copy details both ways.

1. Start in Freesbe

1. Open the Admin Center: Security → Sign-in & access → Single sign-on.
2. Choose Google Workspace, then Set up Google Workspace.
3. The page shows Add Freesbe to Google Workspace with the details to copy. Leave it open.

2. Add Freesbe to Google Workspace

1. In the Google Admin console, go to Apps → Web and mobile apps and choose Add app → Add custom SAML app.
2. Name it Freesbe and click Continue.
3. On Google Identity Provider details, click Download metadata to save the metadata file, then Continue.
4. On Service provider details, paste Freesbe’s Reply URL into ACS URL and its Entity ID into Entity ID. Set Name ID format to EMAIL and Name ID to Basic Information > Primary email. Click Continue.
5. Optionally map First name and Last name, then click Finish.
6. Open the app’s User access and turn it ON for everyone, or for the organizational units or groups who use Freesbe. It can take a few minutes to apply.

3. Tell Freesbe about Google Workspace

Under Tell Freesbe about Google Workspace, choose Metadata file, then Choose file… and pick the file from step 2.3. Click Save.

Google’s metadata has no link to read again, so Freesbe emails you before the certificate runs out (Google’s last five years): download the new metadata then and upload it here.

4. Test it

1. Back on the Freesbe page, under Test it, click Test sign-in.
2. Sign in to Google Workspace as yourself. You’re brought back to the page, which says Signed in and shows what Google Workspace sent: your email address, name and any other attributes.
3. Nobody else can sign in through Google Workspace until a test goes through. Once it has, people at your domain choose Sign in with your company’s SSO on the sign-in page.

To make everyone use it, see Require single sign-on for everyone.

If the test doesn’t sign in

The page says why. The usual reasons:

• “isn’t at one of this workspace’s verified email domains”: Google Workspace sent an address at another domain, or a username instead of the email. Send the user’s primary email as the Name ID (Primary email).
• “isn’t signed with the identity provider’s certificate”: the certificate Freesbe has isn’t the one Google Workspace signs with. Paste the metadata URL again, or upload the new metadata file.
• “for another app (Audience)” or “isn’t for this sign-in address”: the entity ID or reply URL in Google Workspace doesn’t match Freesbe’s. Copy them again from step 1; they end in /metadata and /acs.
• “is encrypted”: turn off assertion encryption for the Freesbe app.
• The provider shows its own error (often “not assigned”): give yourself access to the Freesbe app in Google Workspace.

See Single sign-on for everything else.