You can set up Opal to allow or require users to log in via Google SAML SSO.

Setup

1. When logged into Google Workspace as an administrator, click on Apps on the left sidebar and then Web and mobile apps.

2. Click on Add App and then Add custom SAML app

3. Name your SAML app Opal. You can use this brand asset as the app icon. When ready, click Continue.
4. Copy the value of the SSO URL field
5. In the Authentication section of the Opal Admin UI, click Setup and input the SSO URL into the Identity Provider SAML 2.0 SSO URL (HTTPS) field

6. Download the Google IDP public certificate by clicking on the down arrow button next to the certificate.

7. Upload the certificate with the Upload Certificate button in the Opal Admin page

8. Click Save Changes to save this data to Opal.
9. Then copy the ACS URL and Entity ID values in the Opal Admin page to the corresponding ACS URL and Entity ID fields in the Google SAML app creation page.

10. Click Continue.
11. In the Attribute Statements page, input given_name, family_name, and email as First name, Last name, and Email, respectively, like in the following image:

12. Click Finish to complete the creation of the Google SAML app.
13. Then turn on the SAML app by clicking on OFF for everyone in the SAML app page then clicking ON for everyone then Save.

Testing login via SAML

1. Navigate to Opal, then log out of your Opal account.
2. Click on Continue with SAML on the Opal login screen.
3. Manually type your email address in the Email field. This email must have the same domain name as whoever created the SAML app in the Opal UI earlier (e.g. if [email protected] created the SAML integration, the SAML integration will be tied only to users with the opaltest.com domain).
4. Then click Continue with SAML.
5. This should prompt you to log in with Google.
6. You may arrive at this linking screen (below). If so, you should click continue and log in with the account corresponding to your email address.

7. At this point, you should be able to log into Opal!

Test IDP initiated flow from Gmail

1. Login to Gmail
2. On the upper right corner, click on Google Apps (button with many dots) then Opal

3. This should prompt you to log in with Google.
4. At this point, you should be able to log into Opal!

Common issues

Adding a SAML connection in Google and enabling it for your users can take up to 24 hours to propagate. As a result, sometimes there are caching issues after adding a new SAML connection.

Manifestations of this problem include any of the following:

• 403 app_not_configured
• 403 not_a_saml_app
• 500

In some cases these caching issues can be circumvented by clearing browser state for Opal and Google, or trying the login in an Incognito browser tab or a new browser entirely. But the most consistent fix is to simply wait up to 24 hours for the problem to go away.