Ithura with Google Workspace: SAML single sign-on

You need workspace admin access (role 20) in Ithura at /{workspace}/settings/sso, and a Google Workspace super admin who can add custom SAML apps. Single sign-on is on the Ithura Pro plan.

Provisioning note. Google Workspace does not push SCIM to custom SAML apps. With Google, users are provisioned just in time: Ithura creates the account and adds it to the workspace on first sign-in, at your default role. To onboard a whole domain automatically, pair this with a verified domain. If you need directory-driven deprovisioning through SCIM, use an IdP that supports it (see Okta or Microsoft Entra ID).

Keep the Ithura SSO settings page open in a second tab.

The values you will exchange

From Ithura's SSO settings page:

• ACS URL: https://<api-host>/sso/{workspace}/saml/acs
• Entity ID (Audience): https://<api-host>/sso/{workspace}/saml/metadata

On Ithura Cloud the API host is api.ithura.com.

1. Add Ithura as a custom SAML app

1. In the Google Admin console, go to Apps -> Web and mobile apps.
2. Click Add app -> Add custom SAML app.
3. Give it a name (for example Ithura), optionally add an icon, and click Continue.

2. Give Google's IdP details to Ithura

1. On the Google Identity Provider details step, either Download Metadata or copy the SSO URL, the Entity ID, and the Certificate. Click Continue.
2. In Ithura at /{workspace}/settings/sso, select SAML 2.0 and paste Google's metadata into the IdP Metadata XML box (Ithura parses the entity ID, SSO URL, and signing certificate out of it). Save.
   • If you copied the three values instead: put Google's Entity ID in IdP Entity ID, the SSO URL in IdP SSO URL, and the Certificate in IdP Signing Certificate.

3. Give Ithura's SP details to Google

Back on the Google Service provider details step:

• ACS URL: paste Ithura's ACS URL.
• Entity ID: paste Ithura's Entity ID (Audience).
• Name ID format: EMAIL.
• Name ID: Basic Information > Primary email.
• Leave Signed response as its default and click Continue.

4. Map the name attributes

On the Attributes step, map Google directory fields to the claim names Ithura reads for the display name (the email already arrives as the Name ID):

Google directory field	App attribute (claim name)
First name	http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname
Last name	http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname

Ithura reads givenname + surname for the name and keys the account on the email Name ID. Click Finish.

5. Turn it on and test

1. On the app page, open User access. Turn the service ON for everyone, or ON for specific organizational units or groups, and Save. Google can take a few minutes to apply this.
2. In Ithura, set the Default role for auto-join and leave Enforce SSO off for now.
3. Test a sign-in: go to https://ithura.com/sign-in, click Sign in with SSO, enter your workspace slug, and complete the Google prompt. When it works, tick Enforce SSO in Ithura if you want to require it.

Onboarding a whole domain

Because Google does not push SCIM to custom SAML apps, the cleanest way to bring a whole company in is to add and verify your domain under Verified Domains on the same SSO settings page. Every person who signs in (through Google or otherwise) with a verified email at that domain is then auto-joined at the role you set. See Verified domains.

Troubleshooting

"App not found" or access denied at Google. The service is off for that user's organizational unit, or the change has not propagated. Confirm User access is ON for the right OU or group and wait a few minutes.

Audience or ACS mismatch error. The Entity ID or ACS URL in Google does not exactly match Ithura's SP values, including the workspace slug. Recopy both.

The user signs in but has no name. Confirm the first-name and last-name attribute mappings on the Google Attributes step.

Certificate rotation. If you rotate the Google SAML certificate, re-import the metadata (or re-paste the certificate) in Ithura.