G Suite SSO

Question

G Suite SSO

Ivo Neves 6

I've configured the SSO options on both G Suite and Azure side.

The provisioning seems to be working correctly and whenever I create a new user on Microsoft, it gets automatically created in G Suite, and I am able to login on Google. Everything is ok for new users.

For the existing G Suite accounts, however, I get the error: "This account cannot be accessed because the login credentials could not be verified.".
Can someone help me understand what the problem may be?

Thanks in advance.

Ivo Neves 6 Reputation points

2020-08-03T14:44:42.63+00:00

Problem solved.
Thanks.
Hüseyin Zengin 1 Reputation point

2020-08-21T05:45:34.583+00:00

Hello,
I change google 3rd party IDP integration to Azure IDP.
When I test login to google mail with azure ad credentials all test users successfully login and open gmail. But my account and some few accounts cannot get gmail inbox after authenticate.

From the google help arcticle;
https://support.google.com/a/answer/2463723
in section "This account cannot be accessed because the login credentials could not be verified."

Ensure that the the SAML Response doesn't included any non-standard ASCII characters. This issue most commonly occurs in the DisplayName, GivenName, and Surname attributes in the AttributeStatement,
thats the problem; my name and most of our users givenname and last name includes Turkish characters.
When I removed user.givenname and user.lastname attributes from Azure IDP (G Suite Connector by Microsoft) all users start the login successfully.

May I need this attributes in the feature, how can I transform non-ascii chars?
Hrvoje Kusulja 146 Reputation points MVP

2021-11-25T09:32:30.89+00:00

I have the same issue. Azure IDP is integrated with Google , login is working, however several users have issue after login. The issue is on Google side, not accepting non-ascii characters in fields display name, last name etc. I do not know how to transform claim value to asci in Azure AD - SAML Based sign-on setting
Jukka Pirinen 1 Reputation point

2022-03-24T08:17:47.947+00:00

You should remove the additional claims. Please see the instructions from here (Configuring Azure AD for single sign-on)
https://cloud.google.com/architecture/identity/federating-gcp-with-azure-ad-configuring-provisioning-and-single-sign-on

1 answer

Your answer

Ivo Neves 6 Reputation points

2020-08-03T14:44:42.63+00:00

Problem solved.
Thanks.
Hüseyin Zengin 1 Reputation point

2020-08-21T05:45:34.583+00:00

Hello,
I change google 3rd party IDP integration to Azure IDP.
When I test login to google mail with azure ad credentials all test users successfully login and open gmail. But my account and some few accounts cannot get gmail inbox after authenticate.

From the google help arcticle;
https://support.google.com/a/answer/2463723
in section "This account cannot be accessed because the login credentials could not be verified."

Ensure that the the SAML Response doesn't included any non-standard ASCII characters. This issue most commonly occurs in the DisplayName, GivenName, and Surname attributes in the AttributeStatement,
thats the problem; my name and most of our users givenname and last name includes Turkish characters.
When I removed user.givenname and user.lastname attributes from Azure IDP (G Suite Connector by Microsoft) all users start the login successfully.

May I need this attributes in the feature, how can I transform non-ascii chars?
Hrvoje Kusulja 146 Reputation points MVP

2021-11-25T09:32:30.89+00:00

I have the same issue. Azure IDP is integrated with Google , login is working, however several users have issue after login. The issue is on Google side, not accepting non-ascii characters in fields display name, last name etc. I do not know how to transform claim value to asci in Azure AD - SAML Based sign-on setting
Jukka Pirinen 1 Reputation point

2022-03-24T08:17:47.947+00:00

You should remove the additional claims. Please see the instructions from here (Configuring Azure AD for single sign-on)
https://cloud.google.com/architecture/identity/federating-gcp-with-azure-ad-configuring-provisioning-and-single-sign-on

Answer 1

Alfredo Revilla - Upwork Top Talent | IAM SWE SWA 27,526 Moderator

From the G Suite SAML SSO FAQ: This usually means that the private key used to sign the SAMLResponse does not match the public key certificate that G Suite has on file. Please upload the certificate in the SSO Settings in control panel and retry.

Saurabh Sharma 23,846 Reputation points Microsoft Employee Moderator

2020-07-31T21:10:52.49+00:00

@Ivo Neves Please let us know if you still having issues and need help on the same.
Alfredo Revilla - Upwork Top Talent | IAM SWE SWA 27,526 Reputation points Moderator

2020-08-03T20:44:21.993+00:00

@Ivo Neves please let us know if this answer was helpful to you. If so, please remember to mark it as the answer so that others in the community with similar questions can more easily find a solution.
Alex 1 Reputation point

2021-07-20T10:05:11.023+00:00

I have this problem and it is not solved
Certificate is uploaded users all login in but one!

Share via

G Suite SSO

1 answer

Your answer