How do I configure developer access to Azure using Google Workspace SSO?

Ryan 1

I'm having an absolutely ridiculously difficult time configuring SSO for our Azure AD tenant. This is required so that we can manage developer accounts in one place. This was extremely straightforward with AWS SSO.

Can someone please point me to instructions for how to do this? The majority of the documents I can find talk about using Azure AD as the IdP for Google, but I want the opposite. The rest of the documents I can find fail to explain the process in any meaningful or actionable way.

Ryan 1 Reputation point

2022-07-08T23:29:28.217+00:00
Key items that I cannot figure out:

What is the ACS URL?

Where do I find the Entity Id?

1 answer

Alfredo Revilla - Senior Freelance SWE, SWA, IAM 26,936 Reputation points

2022-07-10T04:24:20.437+00:00

Hello @Ryan , please follow the steps detailed in Office 365 cloud application. You will need to manually or automatically (prefered) provision your users before attempting to login with them.

Note: Google documentations states:

If you set up Google to autoprovision users, you don’t have to configure ImmutableID, it is mapped by default to the user’s email address (the User Principle Name or UPN). Continue to Step 2 below.

However, you will need to manually configure the ImmutableID mapping.

Let us know if this answer was helpful to you or if you need additional assistance. If it was helpful, please remember to accept it and complete the quality survey so that others in the community with similar questions can more easily find a rated solution.
Please sign in to rate this answer.
Ryan 1 Reputation point

2022-07-10T04:39:33.73+00:00

I've done multiple iterations of this as far as I can tell with no luck, although this is the first time I've come across any resource suggesting I use the Office 365 App. I'm not in any way interested in using Office 365 however--is it relevant if I only need Azure access? I did download the metadata file from Google and upload into AD, but from there was not able to get a successful login flow.

I gave up after several hours of troubleshooting. I will pick this up after the weekend. Many steps here are opaque, the errors are unclear (when you're lucky enough to get one). The errors you get in the dashboard are different than what you see in the network logs if you open the debug console, terminology is not consistent between the providers, etc. AWS has clear instructions for this specific case and we were able to set it up in a few minutes.

Alfredo Revilla - Senior Freelance SWE, SWA, IAM 26,936 Reputation points

2022-07-10T04:41:42.463+00:00

Hi @Ryan , Office 365 relies on Azure AD so it's pretty good for this case. I will try getting ahold of a Google Workspace account (hope they offer trials) and test it myself. I will let you know of any outcome.

Ryan 1 Reputation point

2022-07-10T04:46:51.547+00:00

Thank you, I appreciate it. The main thing I'm really unsure about is the "entity Id" that Google wants. I can't find any mention of this in the Azure docs. I'm using the Audience URL, but I have no idea if this is correct. I also have no idea if this is what's causing my problems since I can't really make much sense of the errors. If I had a reference for how to make this specific configuration work I'm sure I'd be able to work it out from there--at least I'd know I was following steps that had worked at least once and any remaining problems were not based on the configuration.

Ryan 1 Reputation point

2022-07-10T04:47:24.393+00:00

Unfortunately I don't know much about SAML so I'm a bit in the dark with a lot of the terminology.

Alfredo Revilla - Senior Freelance SWE, SWA, IAM 26,936 Reputation points

2022-07-10T04:56:48.273+00:00

This goes into $IssuerURI.

Ryan 1 Reputation point

2022-07-10T04:59:03.84+00:00

Right but then the Workspace configuration wants an entity Id from Azure AD and I can't find any reference to anything with that name. I'm about 75% sure it's the Audience in this case, but can't find any verification of this.

Ryan 1 Reputation point

2022-08-16T22:16:18.91+00:00

Sorry still really stuck here. I'm still getting this error:

The requested federation realm object 'https://accounts.google.com/o/saml2?idpid=xxxxxx' does not exist.

I'm trying to follow these instructions:

https://learn.microsoft.com/en-us/troubleshoot/azure/active-directory/authentication-fails-with-error

However-

Resolution 1 doesn't help--the Issuer URI seems to be set properly already.

Resolution 2 doesn't work--calling Get-MsolDomainFederationSettings fails because it can't find my domain name.

I can't figure out how to set up the domain name. I've added my domain, but it can't find it. I assume this is because it isn't verified, but I also understand that you cannot verify the domain for it to work with SAML.

Any help would be greatly appreciated.
Sign in to comment