Set up single sign-on with Google Workspace

FormCan connects to Google Workspace with SAML 2.0 through a custom SAML app. Members then sign in with their Workspace account and get a FormCan tile in the Google app launcher.

For an overview of the Single Sign-On page, see Single sign-on (SSO).

Before you begin

• You are a Google Workspace super administrator.
• In FormCan, you are the team owner or a member with the Manage members access.
• In FormCan, open your team menu and select Single Sign-On. On the Connection tab, pick Google Workspace. Keep this page open: it shows the values Google needs, each with a Copy button.

In the Google Admin console

1. Go to Apps > Web and mobile apps, click Add app, then Add custom SAML app.

2. Enter an app name, for example FormCan, and click Continue.

3. On Google Identity Provider details, click Download metadata and keep the file. Click Continue.

4. On Service provider details, enter:

   • ACS URL: the ACS URL from FormCan.
   • Entity ID: the Entity ID from FormCan.
   • Start URL: the Start URL from FormCan.
   • Name ID format: EMAIL.
   • Name ID: Basic Information > Primary email.

   Click Continue.

5. On Attribute mapping, add:

   Google directory attribute	App attribute
   Primary email	email
   First name	first_name
   Last name	last_name

   Click Finish.

6. Open User access and turn the app ON for everyone, or for the organizational units that may sign in. Changes can take a few minutes to apply.

In FormCan

Google Workspace has no metadata URL, so you paste three values from the metadata file you downloaded. Open the file in a text editor.

1. Under 3. Values from your identity provider, fill in:

   • Identity provider entity ID (issuer): the entityID of the EntityDescriptor element.
   • Sign-on URL (HTTP-Redirect): the Location of the SingleSignOnService element with the HTTP-Redirect binding.
   • Signing certificate: the text inside the X509Certificate element.

2. Click Save connection.

Verify your domain, test and turn on

1. On the Email domains tab, add your Workspace domain, create the TXT record FormCan shows at your DNS provider, and click Verify.

2. In the status card, click Test connection. A window signs you in through Google and shows the email, name and attribute names FormCan received.

3. Click Turn on single sign-on.

Members can now click SSO on the FormCan login page, open the start URL, or use the FormCan tile in the Google app launcher. See Sign-in rules to require single sign-on or to let new members join automatically.

Troubleshooting