Skip to main content

Google Workspace SSO Setup

Configure SAML-based Single Sign-On with Google Workspace (formerly G Suite).

Prerequisites​

  • Google Workspace account with Super Admin access
  • Propper organization admin access
  • Users must have Google Workspace accounts in your organization

Step 1: Create a Custom SAML App​

  1. Sign in to the Google Admin Console
  2. Navigate to Apps > Web and mobile apps
  3. Click Add app > Add custom SAML app
  4. Enter an app name (e.g., "Propper") and optionally upload a logo
  5. Click Continue

Step 2: Download IdP Metadata​

On the Google Identity Provider details page, you'll see your IdP information:

  1. Copy and save the following values:
    • SSO URL - You'll need this for Propper
    • Entity ID - You'll need this for Propper
  2. Click Download Certificate to save the X.509 certificate
  3. Alternatively, click Download Metadata to get the XML file
  4. Click Continue
tip

Keep this information secure. The certificate is used to verify the authenticity of SAML responses.

Step 3: Configure Service Provider Details​

Enter the following Propper SP details:

FieldValue
ACS URLhttps://auth.propper.ai/saml/acs
Entity IDurn:propper:sp:auth
Start URLhttps://app.propper.ai/login (optional)
Name ID formatEMAIL
Name IDBasic Information > Primary email
info

The Start URL is optional and specifies where users land after IdP-initiated login.

Click Continue

Step 4: Configure Attribute Mapping​

Map Google user attributes to Propper attributes:

  1. Click Add Mapping for each attribute below:
Google Directory AttributeApp Attribute
Primary emailemail
First namefirstName
Last namelastName

Optional: Group Membership (for Role Mapping)​

To enable group-based role assignment:

  1. Click Add Mapping
  2. Select Group membership as the Google Directory attribute
  3. Enter groups as the App attribute
  4. Configure which groups to include
warning

Group membership mapping requires a Google Workspace Business, Enterprise, or Education edition.

Click Finish

Step 5: Enable the App for Users​

By default, the app is off for all users. You need to enable it:

  1. In the app settings, find the User access section
  2. Click on User access or the status indicator
  3. Choose one of the following:
    • ON for everyone - All users in your organization can use SSO
    • ON for selected organizational units - Only specific OUs can use SSO
    • ON for selected groups - Only specific groups can use SSO
  4. Click Save
tip

For initial testing, enable SSO for a small group of users before rolling out to the entire organization.

Step 6: Configure Propper​

  1. Log in to Propper as an organization admin
  2. Go to Settings > Security > SSO
  3. Click Configure SSO or Edit Configuration
  4. Select Google Workspace as the provider

Enter IdP Details​

Using the information from Step 2:

Propper FieldGoogle Value
IdP Entity IDEntity ID from Step 2
SSO URLSSO URL from Step 2
CertificateContents of the downloaded certificate file
info

Open the downloaded certificate file in a text editor and copy the entire contents, including the -----BEGIN CERTIFICATE----- and -----END CERTIFICATE----- lines.

  1. Click Save Configuration

Step 7: Test the Connection​

  1. In Propper SSO settings, click Test Connection
  2. A new window will open with the Google login page
  3. Sign in with a user who has access to the SAML app
  4. If successful, you'll be redirected back to Propper
tip

Test in an incognito/private browser window to ensure you're testing a fresh authentication flow.

Testing IdP-Initiated Login​

You can also test login starting from Google:

  1. Go to myapps.google.com
  2. Find the Propper app tile
  3. Click it to initiate SSO login

Optional: Enable JIT Provisioning​

To automatically create Propper accounts for new SSO users:

  1. In Propper SSO settings, enable Just-In-Time Provisioning
  2. Select a Default Role for new users
  3. Optionally, configure Allowed Domains to restrict which email domains can be provisioned
  4. If using group claims, configure Role Mappings to assign roles based on Google groups

Optional: Enforce SSO​

To require SSO for all users:

  1. First, verify your email domain in Propper
  2. Enable SSO Enforcement for the verified domain
  3. Add admin email addresses to the Bypass List to prevent lockout
warning

Always add at least one admin to the bypass list before enabling enforcement.

Troubleshooting​

Error: "This app is turned off"​

  • The SAML app hasn't been enabled for the user
  • Go to Admin Console > Apps > Web and mobile apps > [Your App] > User access
  • Enable the app for the user's organizational unit or group

Error: Invalid Signature​

  • The certificate in Propper may be outdated
  • Download the latest certificate from Google Admin Console
  • Update the certificate in Propper SSO settings

Error: User attribute missing​

  • Ensure all required attributes are mapped in Step 4
  • Verify the user has values for First name and Last name in Google Workspace
  • Check that Primary email is set correctly

Error: Audience/Entity ID mismatch​

  • Verify the Entity ID in Google exactly matches urn:propper:sp:auth
  • Check for extra spaces or case mismatches

Error: Reply URL mismatch​

  • Verify the ACS URL exactly matches https://auth.propper.ai/saml/acs
  • Ensure there are no typos

Users don't see the app in their launcher​

  • The app may not be enabled for their organizational unit
  • Check the User access settings in Admin Console
  • It can take up to 24 hours for changes to propagate

Error: "SAML response was invalid"​

  • Check that the Name ID format is set to EMAIL
  • Verify the Name ID source is set to Primary email
  • Ensure the certificate hasn't expired

Certificate Rotation​

Google Workspace certificates expire periodically. To rotate:

  1. Go to Admin Console > Apps > Web and mobile apps > [Your App]
  2. Download the new certificate
  3. Update the certificate in Propper SSO settings
  4. Test the connection to verify the new certificate works
tip

Google typically provides advance notice before certificates expire. Set a calendar reminder to rotate certificates before expiration.

Additional Resources​