> ## Documentation Index
> Fetch the complete documentation index at: https://zenskar.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# SAML authentication with Google Workspace

Zenskar supports single sign-on (SSO) through SAML 2.0, letting an organization authenticate users through its existing identity provider. This guide sets up SAML in Zenskar using **Google Workspace** (or Cloud Identity) as the identity provider.

<Note>
  Identity provider (IdP): performs authentication and passes the user's identity to the service provider. Google Workspace is the IdP here. Service provider (SP): trusts the IdP and authorizes the user. Zenskar is the SP.
</Note>

***

<Accordion title="Step 1: Domain verification" icon="fa-shoe-prints">
  1. Click the account menu at the bottom of the sidebar, and select **Settings**.
  2. Open the **SAML** tab.
  3. In the **Connection** section, enter a **Name** for this configuration and the **Domain** to verify, for example `acme.com`.
  4. Click **GET TXT RECORDS**.
  5. Add the resulting TXT record to the domain's DNS.
  6. Click **VERIFY DOMAIN** once the record has propagated. The domain's status changes from Pending to Verified.
  7. Under **Identity Provider**, select **Google Workspace** from the dropdown. This is the default selection.
</Accordion>

<Accordion title="Step 2: Configure single sign-on in Google Workspace" icon="fa-shoe-prints">
  1. Open the [Admin Console](https://admin.google.com/), and log in as a super admin.
  2. In the menu, click **Show more**, and go to **Security > Authentication > SSO with third party IdP**.
  3. Click **Add SSO profile**.
  4. Set **Setup SSO with third party identity provider** to enabled.
  5. Fill in the sign-in and sign-out URLs using the values shown in Zenskar's **Zenskar SAML Configuration Values** section:

  | Google Workspace field | Zenskar source                                                                              |
  | ---------------------- | ------------------------------------------------------------------------------------------- |
  | Sign-in page URL       | Zenskar SAML tab > Zenskar SAML Configuration Values > **Entity ID**                        |
  | Sign-out page URL      | Same domain as the Entity ID, with the sign-out path Google requests during setup           |
  | Change password URL    | Same domain as the Entity ID, with the account-management path Google requests during setup |

  <Note>
    Zenskar's Entity ID is the same fixed value for every organization. Copy it exactly as shown on the SAML tab.
  </Note>

  6. Leave **Use a domain specific issuer** cleared.
  7. Under **Verification certificate**, click **Upload certificate**, and upload a certificate exported from your Google Workspace SSO profile (see Step 3).
  8. Click **Save**, then sign out of the Admin Console.
</Accordion>

<Accordion title="Step 3: Identity provider configuration in Zenskar" icon="fa-shoe-prints">
  1. Back in Google Workspace's SSO profile screen, copy the **Entity ID** and **Sign-in page URL** it generated for this SSO profile.
  2. In Zenskar's **Identity Provider Configuration** section, paste these into **Identity Provider Entity ID** and **Single Sign-On Service URL**.
  3. Paste the SSO profile's certificate into the **Certificate** field.
</Accordion>

<Accordion title="Step 4: Attribute mapping" icon="fa-shoe-prints">
  In Zenskar's **Attribute Mapping** section, map each Zenskar field to the Google Workspace attribute that carries it:

  | Zenskar field | Google Workspace attribute (common default) |
  | ------------- | ------------------------------------------- |
  | User ID       | Primary email                               |
  | Email address | Primary email                               |
  | First name    | First name                                  |
  | Last name     | Last name                                   |

  Adjust these if your Google Workspace SSO profile sends custom attribute names.
</Accordion>

<Accordion title="Step 5: Finish and test" icon="fa-shoe-prints">
  1. In Zenskar, turn on **SAML Status**, and click **Save Configuration**.
  2. Choose a Zenskar user whose email address matches the primary email address of an existing Google Workspace user, and who does not have Google super-admin privileges. Super-admin accounts always sign in with Google credentials directly and are not suitable for testing SSO.
  3. Sign out, and go to the Zenskar sign-in screen.
  4. Sign in using that user's email address. With a verified domain and an enabled configuration, the sign-in should route through Google.
  5. On success, the sign-in returns to the Zenskar dashboard.

  <Note>
    If sign-in does not work as expected, Google super-admin accounts can always sign in directly with Google credentials, bypassing SSO, so you can still reach the Google Admin Console to review or change settings.
  </Note>
</Accordion>

Reach out to [help@zenskar.com](mailto:help@zenskar.com) with questions while going through setup.