Skip to main content
Zenskar supports single sign-on (SSO) through SAML 2.0, letting an organization authenticate users through its existing identity provider. This guide sets up SAML in Zenskar using Google Workspace (or Cloud Identity) as the identity provider.
Identity provider (IdP): performs authentication and passes the user’s identity to the service provider. Google Workspace is the IdP here. Service provider (SP): trusts the IdP and authorizes the user. Zenskar is the SP.
  1. Click the account menu at the bottom of the sidebar, and select Settings.
  2. Open the SAML tab.
  3. In the Connection section, enter a Name for this configuration and the Domain to verify, for example acme.com.
  4. Click GET TXT RECORDS.
  5. Add the resulting TXT record to the domain’s DNS.
  6. Click VERIFY DOMAIN once the record has propagated. The domain’s status changes from Pending to Verified.
  7. Under Identity Provider, select Google Workspace from the dropdown. This is the default selection.
  1. Open the Admin Console, and log in as a super admin.
  2. In the menu, click Show more, and go to Security > Authentication > SSO with third party IdP.
  3. Click Add SSO profile.
  4. Set Setup SSO with third party identity provider to enabled.
  5. Fill in the sign-in and sign-out URLs using the values shown in Zenskar’s Zenskar SAML Configuration Values section:
Zenskar’s Entity ID is the same fixed value for every organization. Copy it exactly as shown on the SAML tab.
  1. Leave Use a domain specific issuer cleared.
  2. Under Verification certificate, click Upload certificate, and upload a certificate exported from your Google Workspace SSO profile (see Step 3).
  3. Click Save, then sign out of the Admin Console.
  1. Back in Google Workspace’s SSO profile screen, copy the Entity ID and Sign-in page URL it generated for this SSO profile.
  2. In Zenskar’s Identity Provider Configuration section, paste these into Identity Provider Entity ID and Single Sign-On Service URL.
  3. Paste the SSO profile’s certificate into the Certificate field.
In Zenskar’s Attribute Mapping section, map each Zenskar field to the Google Workspace attribute that carries it:Adjust these if your Google Workspace SSO profile sends custom attribute names.
  1. In Zenskar, turn on SAML Status, and click Save Configuration.
  2. Choose a Zenskar user whose email address matches the primary email address of an existing Google Workspace user, and who does not have Google super-admin privileges. Super-admin accounts always sign in with Google credentials directly and are not suitable for testing SSO.
  3. Sign out, and go to the Zenskar sign-in screen.
  4. Sign in using that user’s email address. With a verified domain and an enabled configuration, the sign-in should route through Google.
  5. On success, the sign-in returns to the Zenskar dashboard.
If sign-in does not work as expected, Google super-admin accounts can always sign in directly with Google credentials, bypassing SSO, so you can still reach the Google Admin Console to review or change settings.
Reach out to help@zenskar.com with questions while going through setup.