Open the Advanced Authentication Administration portal.
Click Events > New Event to add a new event with the following options:
Name: Google
Event Type: SAML2
Chains: Select the required chains.
SP SAML 2.0 metadata: Paste the Service Provider metadata.
Sample metadata is as follows:
<EntityDescriptor entityID="google.com" xmlns="urn:oasis:names:tc:SAML:2.0:metadata"> <SPSSODescriptor protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol"> <NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress</NameIDFormat> <AssertionConsumerService index="1" Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="https://www.google.com/a/mycompany.com" /> </SPSSODescriptor> </EntityDescriptor>
Replace mycompany.com in the Location URL to your primary domain from the Domains settings in Google.
NOTE:It is not recommended to use the sample metadata in the production environment.
NOTE:You must use the Service Provider metadata when one domain exists in the G Suite. If you have more than one domain in G Suite, then every Service Provider metadata for each domain must have google.com as an entityID replaced with google.com/mycompany.com, where mycompany.com is your domain name.
Select Send E-Mail as NameID (suitable for G-Suite) from the NameID formatting options. This is applicable for the G-Suite.
Click Save.