Google SAML SSO Example

[stevenGravy]

Prerequisites:

• Teleport cloud or enterprise cluster
• Google Workspace (formerly Gsuite)
• Recommend having one or more users in groups in the directory

Replace the proxy url teleport.example.com below with your proxy URL.

Create SAML App

Go into Apps -> Web and mobile apps

Select Add custom SAML app

1. Give a name such as "Teleport".
2. Download the Metadata which you will use in the Teleport connector
3. Give the ACS and Entity in the format of https://<proxy>/v1/webapi/saml/acs . Change the Name ID Format to Email

4. Add One or more groups including email mapping

Create Teleport Auth Connector

Create a connector in the UI or with tctl create -f google.yaml.

#
# Example resource for a SAML connector
# This connector can be used for SAML endpoints like Okta
#
kind: saml
version: v2
metadata:
  # The name of the connector
  name: google
spec:
  # Connector display name that will be appended to the title of "Login with"
  # button on the cluster login screen so it will say "Login with Okta"
  display: Google
  # SAML provider will make a callback to this URL after successful authentication
  # cluster-url is the address the cluster UI is reachable at
  acs: https://teleport.example.com/v1/webapi/saml/acs
  attributes_to_roles:
    - {name: "groups", value: "admin", roles: ["editor"]}
    - {name: "groups", value: "developers", roles: ["access"]}
  # Note that the entire XML document is indented by 4 spaces. This is
  # required because the pipe symbol indicates what follows is raw text.
  # Below is an Example. Replace with your XML
  entity_descriptor: |
    <entity descriptor contents>

Login with Google Auth

If you encounter areas review the Audit Log under the Management Area in Activity.

[sebastianwebber]

the ACS config in the example will not work. To work properly is necessary to add a suffix like/something at the end, for example:

https://<proxy>/v1/webapi/saml/acs/google

then in the connector config:

# ...
spec:
  # SAML provider will make a callback to this URL after successful authentication
  # cluster-url is the address the cluster UI is reachable at
  acs: https://<proxy>/v1/webapi/saml/acs/google

In the example i'm adding the /google which is the connector name.

[webvictim]

IIUC this should only be necessary to allow IDP-initiated logins (i.e. starting the login on the Google side, which is disabled by default and also requires setting allow_idp_initiated: true under spec in the connector)

The regular Teleport/SP-initiated flow should work with a URL ending in /acs.