Skip to main content

Configure SAML SSO with Google Workspace

This guide configures Google Workspace as the SAML Identity Provider (IdP) and VeloDB Cloud as the Service Provider (SP) for one VeloDB Cloud organization.

Prerequisites​

Before you begin, make sure that:

  • Your VeloDB Cloud organization uses the Premium plan.
  • You are an Organization Admin in VeloDB Cloud.
  • You are a Google Workspace administrator with permission to create and assign SAML applications.
  • You can create a DNS TXT record for your corporate email domain.
  • You have configured any required 2-Step Verification policies in Google Workspace.

Keep an active Organization Admin session open while you configure and test SSO.

Start SAML setup in VeloDB Cloud​

  1. Sign in to VeloDB Cloud as an Organization Admin.

  2. Click your profile area in the bottom-left corner of the console to open the account menu, then select Authentication.

  3. Turn on SAML Single Sign-on.

  4. In Add Application, copy the following values:

    • Single Sign-On URL
    • Service Provider Entity ID

Keep this page open while you configure Google Workspace.

Create the Google Workspace application​

  1. Sign in to the Google Admin console.

  2. Go to Apps → Web and mobile apps.

  3. Select Add app → Add custom SAML app.

  4. Enter an application name, such as VeloDB Cloud, and select Continue.

  5. On the Google Identity Provider details page, copy the Metadata URL and store it securely for the next section.

  6. Select Continue.

  7. Configure the Service Provider details:

    Google Workspace fieldValue
    ACS URLThe VeloDB Cloud Single Sign-On URL
    Entity IDThe VeloDB Cloud Service Provider Entity ID
    Start URLLeave blank
    Signed responseEnabled
    Name ID formatEMAIL
    Name IDBasic Information → Primary email

  8. Select Continue.

  9. Add the following attribute mapping:

    Google directory attributeApp attribute
    Primary emailemail

  10. Select Finish.

  11. Open User access and enable the application for the appropriate groups or organizational units.

For more information, see Set up your own custom SAML application in the Google Workspace documentation.

Import Google Workspace metadata​

  1. Return to VeloDB Cloud and continue to Configure Identity Provider.
  2. Paste the Google Workspace metadata URL into Metadata URL.
  3. Select Verify.
  4. Confirm that VeloDB Cloud displays the imported IdP SSO URL and certificate.

The metadata URL must be publicly accessible over HTTPS.

Verify a domain and configure provisioning​

  1. Continue to Verify Domain.
  2. Select Add Domain, and enter your corporate email domain without @.
  3. At your DNS provider, create a TXT record using the TXT Record Name and Record Value displayed by VeloDB Cloud.
  4. Wait for the DNS change to propagate, and then select Verify for the domain.
  5. Select the Default Role assigned to users created through JIT provisioning.
  6. Select a JIT Provisioning Policy.
  7. Select Continue.

For details about the provisioning policies, see JIT provisioning.

Test and enable SSO​

  1. In Test SSO Login, select Test SSO Login.
  2. Authenticate with a Google Workspace account that has access to the application.
  3. Confirm that VeloDB Cloud reports SSO Test Successful.
  4. Continue to Enable SSO, select Enable SSO, and complete the setup.

Enforce SSO​

Before you enforce SSO, an active Organization Admin must complete a regular SAML sign-in:

  1. Sign out of VeloDB Cloud.
  2. Start a new sign-in at https://www.velodb.cloud using the Organization Admin's email address.
  3. Authenticate through Google Workspace and confirm that the administrator can access the organization.
  4. Return to Authentication and open the SAML SSO configuration.
  5. Select Configure next to Enable SSO, choose Enforce SSO, and confirm the change.

Do not start sign-in from the Google Workspace application tile. VeloDB Cloud supports Service Provider-initiated sign-in only.

When SSO is enabled but not enforced, the email sign-in page remains available for password or verification-code sign-in.

Removing a user's Google Workspace application access does not remove an existing VeloDB Cloud organization membership. When you offboard a member, remove the member separately on the VeloDB Cloud Members page.