Single Sign-On with Google Workspace

This guide connects Google Workspace to Workprentice for single sign-on. You need to be an owner of the Workprentice organization and a super administrator in Google Workspace, and your email domain must already be verified by DNS.

This is different from the Google button on the sign-in page. That button signs in anyone with a Google account. A SAML application in your Workspace lets you decide who has access, and lets you require it.

Keep two tabs open: Organization settings → Single sign-on in Workprentice, with Google Workspace chosen at the top, and the Google Admin console. The steps follow the console as Google’s documentation describes it. Where a label differs, go by the field names in the tables.

Single sign-on

Create the application in Google

1. In the Google Admin console, open Apps → Web and mobile apps and choose Add app → Add custom SAML app.

2. Name the app Workprentice and choose Continue.

3. Google now shows its own details. Copy them into Workprentice before continuing:

   Google shows	Workprentice field
   SSO URL	Sign-in URL
   Entity ID	Issuer
   Certificate	Signing certificate: download it, open the file in a text editor, and paste its contents

   Choose Continue.

4. Under Service provider details, fill in these fields from the Workprentice page:

   Google field	Value from Workprentice
   ACS URL	Single sign-on URL
   Entity ID	Audience
   Start URL	Start URL (optional)
   Name ID format	EMAIL
   Name ID	Basic Information > Primary email

   Leave Signed response unchecked or checked as you prefer; Workprentice accepts either.

5. Choose Continue, skip attribute mapping, and choose Finish.

6. Save in Workprentice.

Turn it on and test

A new SAML app is off for everyone. Open the app, choose User access, and turn it on for everyone or for the organizational units that should have access. Google says a change can take up to 24 hours to reach everyone, though it is usually minutes.

Then open a private browser window, go to the Workprentice sign-in page, enter your work email, and choose Continue with single sign-on.

Google’s certificate expires after five years. Before it does, create the new one in Google, paste it after the old one in Workprentice, and save.

Directory provisioning

Google Workspace provisions users only to the applications in its own catalog, so it cannot add or remove people in Workprentice. Without provisioning:

• People at your domain get an account the first time they sign in through Google, so nothing has to be created ahead of time.
• Turning the app off for a person in Google stops them signing in once single sign-on is required, but does not remove them. Remove them under Organization settings → Members as well, which also revokes their API keys and credentials.

If you manage identities in Okta or Microsoft Entra ID alongside Google, connect that provider instead to get directory provisioning.

If something does not work

• Google shows “app_not_configured_for_user”. The app is not turned on for that person, or the change has not reached them yet.
• Sign-in fails with “could not be completed”. Check that ACS URL and Entity ID in Google match the Workprentice page exactly, and that the certificate in Workprentice is the one the app uses.
• Someone signs in at Google but is refused. Their primary email must be at a domain you have verified by DNS.