Use the information in the following sections to configure a connector for Google Apps for Business:
Verify that you meet the following requirements before configuring the connector for Google Apps for Business:
A valid Google Apps for Business account
Provisioning APIs enabled on the account
An administrative account and password
Each cluster can support multiple instances of the connector for Google Apps for Business. Once configured, the connector provides user account provisioning and single sign-on access to Google Apps for Business domains. After users log in to CloudAccess, SAML authentication is used to automatically authenticate (single sign-on) users to Google Apps for Business. Providing single sign-on to users increases the security of your company’s information stored in Google Apps for Business.
To configure the connector:
Access the CloudAccess Admin page.
For more information, see Section 3.1, Accessing the Administration Pages.
Drag and drop the Connector for Google Apps for Business from the SaaS Palette to the bar.
Click the Connector for Google Apps for Business, then click Configure.
Provide a unique display name for the connector to appear on the Admin and OSP Welcome pages, and also provide the administrator logon credentials and domain for the Google Apps for Business account.
(Conditional) Select the Automatically configure SSO settings option if you want CloudAccess to configure the single sign-on parameters at Google Apps for Business. Otherwise, you must manually configure the parameters at Google Apps for Business.
(Conditional) Select Prompt users for an existing Google Apps account before provisioning if you want to give users control of when their accounts are provisioned. For more information about account provisioning, see Section 1.6, How CloudAccess Merges Existing Accounts.
(Conditional) If you did not select the Automatically configure SSO settings option, click Federation Instructions. Read the instructions provided to configure the connector for Google Apps for Business to allow single sign-on for users, then complete the following steps:
Copy and paste the text of the signing certificate provided in the Federation Instructions into a file, then save the file.
NOTE:Ensure that you use a text editor that does not introduce hard returns or additional white space. Otherwise, the certificate file may be improperly formatted and unusable. For example, use Notepad instead of Wordpad.
Log in to the Google Apps Dashboard with your administrator account.
Navigate to Advanced Tools > Set up single sign-on (SSO).
Provide the following information:
Enable Single Sign-on: Select this option.
Sign-in page URL: Specify the value provided for the Single Sign-on URL in the Federation Instructions.
Sign-out page URL: Specify the value provided for the Single Logout URL in the Federation Instructions.
Change password URL: This is the page that the URL will redirect to when a user clicks Change Password. (This is not part of the federation per se, but Google requires a value for this field.)
Verification certificate: Upload the file into which you copied the signing certificate text above.
Use a domain specific issuer: Select this option. This changes the value sent in the SAML request to be google.com/a/google_apps_domaininstead of google.com. For more information, see SSO (Single Sign-On) in the documentation for Google Apps for Business.
Network masks: Leave blank. This option is not applicable to SAML configuration.
Click Save Changes.
Click OK, then click Apply to commit the changes to the appliance.
(Optional) To provide users with access to Google Apps Mail from supported mobile devices, click the Connector for Google Apps for Business, then click Enable mobile access.
User accounts that have been provisioned to Google Apps for Business using CloudAccess must authenticate through CloudAccess. Direct logins to Google Apps for Business are not allowed. For more information, see the SAML SSO section of the Google Apps for Business Web site.
CloudAccess can support Google Apps domains by using multiple instances of the connector for Google Apps for Business. Each connector instance must be configured with the unique credentials and domain information of the Google Apps domain that it serves.
NOTE:The Enable mobile access option is global across all instances of the Google Apps connector. (The option is either enabled or disabled for all instances.)