# Setting Up Google SSO

This document outlines the steps required to set up Google SSO with StepSecurity.

StepSecurity uses AWS Cognito as the service provider for the SSO experience.

### Setup Instructions

#### Step 1: Access Google Admin Console

* Log in to your Google Workspace as an Administrator.
* From the left sidebar, navigate to:

  > Apps → Web and mobile apps

<figure><img src="/files/AIuTMj1SwPv6c9fNvicq" alt="" width="346"><figcaption></figcaption></figure>

#### Step 2: Add a New Custom SAML App

* Click **Add App** ➔ **Add custom SAML app**.

<figure><img src="/files/5vAniHGnykqpvi3xPhlA" alt=""><figcaption></figcaption></figure>

#### Step 3: Configure App Details

* **Name** the app: `StepSecurity`
* (Optional) Add a **description** and upload the **StepSecurity logo**:\
  [StepSecurity Logo](https://stepsecurity-public-media.s3.us-west-2.amazonaws.com/media/step-security-logo.png)

<figure><img src="/files/GZGmTOK6kdFsNDUtWpdY" alt=""><figcaption></figcaption></figure>

#### Step 4: Download Google SAML Metadata

* **Download the metadata** file provided during this step.
* **Securely share** the metadata file with StepSecurity.

<figure><img src="/files/2MIgJ15TpjAkobTUC9SH" alt=""><figcaption></figcaption></figure>

#### Step 5: Enter Service Provider Details

* On the StepSecurity App navigate to Admin Console → Security & Auth → Configure SSO → Google Workspace

<figure><img src="/files/jVPIwoNfdUXMLmNtpJYU" alt=""><figcaption></figcaption></figure>

* Copy the values displayed there and provide them in the corresponding fields in "Service Provider Details" page

<figure><img src="/files/zgcZcAFFNCo2zYlKNELm" alt=""><figcaption></figcaption></figure>

#### Step 6: Map Identity Attributes

{% hint style="info" %}
**Important**: If any changes are made to SSO group membership in Okta (for example, adding or removing a user from a group), the affected user must log out and log back into StepSecurity for the updated group access and role mappings to take effect immediately otherwise it will be reflected once the sso session is renewed.
{% endhint %}

* In the "Attribute Mapping" section:
  * Map **Primary Email** ➔ **email**.
* Under `Group membership` add your user groups that will be assigned to this app and map it to 'Groups' attribute. This enables StepSecurity’s SCIM-like functionality — for example, you can use Google Workspace groups and map them to roles in the StepSecurity dashboard.

{% hint style="danger" %}
**You should only pass specific groups to the StepSecurity platform. If the app passes&#x20;*****all*****&#x20;group memberships, it may exceed the maximum request body size.**
{% endhint %}

* After completing the mapping, click **Finish** to complete app creation.Is

<figure><img src="/files/3BPLoAqhfkIdFxCx00J2" alt=""><figcaption></figcaption></figure>

#### Step 7: Enable the SAML App

* In the created SAML app page:
  * First set the app to **OFF for everyone**.
* Then switch it **ON for everyone**.
* Click **Save** to apply changes.

#### Step 8: Verification and Finalization

* On the StepSecurity App share the Email Domains and Metadata file and submit the configuration

<figure><img src="/files/QM7uFaFAhlPLxstsYoVE" alt=""><figcaption></figcaption></figure>

* On the StepSecurity Security & Auth page you can test the integration

<figure><img src="/files/ABoc9OKKnx1S1DE3gjIA" alt=""><figcaption></figcaption></figure>

* After setup:
  * Users can log in by entering their email under the "**Sign in with your corporate ID**" section on the StepSecurity login page.

<figure><img src="/files/goaiC4nHF2d2tKQrQOzl" alt=""><figcaption></figcaption></figure>

#### Step 9 (Optional): Access StepSecurity console directly from Google App:

* To get your RelayState value go to the StepSecurity App and navigate to Admin Console → Security & Auth → Configure SSO → Microsoft Entra ID → Step 4

<figure><img src="/files/HRtIseMFN0EW8Ts1bznM" alt=""><figcaption></figcaption></figure>

* In Google Admin:
  * Go to Apps → Web and mobile apps → StepSecurity app → Service provider details,

    then enter the URL under Start URL.

<figure><img src="/files/jdBsg0Zhxlgm28KY2gUt" alt=""><figcaption></figcaption></figure>


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://docs.stepsecurity.io/administration/admin-console/access-control/security-and-auth/setting-up-google-sso.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.