This document outlines how to configure Google for SAML 2.0 SSO integration with Cleary.
NOTE: There are two environments: sandbox and production. Sandbox is hosted at pre-gocleary.com and production is hosted at gocleary.com Each environment will need its own Google Auth configuration - please send over both.
Watch a screencast showing the steps below
Step 1 - Create New App in Google
- Log in to the Google admin dashboard
- select "Apps" from the sidebar menu
- then select "Web and Mobile Apps" from the following list
- Select "Add App" and then "Add custom SAML app".
- Give the app a descriptive name and upload an icon, if applicable. Click "Continue".
- Copy the SSO URL and the Certificate and paste them into a file that’ll be shared with Cleary later. Then click Continue.
- For the ACS and Entity ID put the same URL below, accordingly to what environment you are setting up:
- Sandbox: https://your-cleary-subdomain.pre-gocleary.com/auth/saml/callback
- Production: https://your-cleary-subdomain.gocleary.com/auth/saml/callback
- Set “Name ID Format” to EMAIL then click Continue
- Click Add Mapping
- Select Primary Email on the left field and set ‘uid’ to the right field
- Click Finish
Step 2 - Give Users Access
- Click on the “User Access” Section
- Set up the access as you wish
Step 3 - Test your new SAML Application
- Click this TEST SAML LOGIN button
- It should redirect you to the Cleary App if it’s working fine. You won’t be authenticated yet, it’s just a test to make sure you set it up correctly. Note: It can take several minutes before it starts working, then make sure you wait perhaps 30min to try again before you consider it’s wrong.
Step 4 - Add Credentials to Cleary
- Open the Cleary App
- Navigate to the Admin > App Integrations page
- Expand the Authentication section
- Click the ‘Configure SAML’ button (if you don’t see it, you probably need to disable one of the other authentications types)
- Fill in the fields in the form and click Install
- Additionally, make sure you add the allowed email login domains for your company. People can’t log in if their email domain is not on this list