Single Sign-On with Google

Step 1: Set the Base URL

1. In the Platform sidebar, click on your user, then click Organization settings. Switch to the Single sign-on tab.
2. In the Base URL field, enter the HTTPS URL for your platform installation and click Submit. This will generally match the value in your browser. It should be the domain or subdomain you host CloudQuery platform on, like https://cloudquery.example.com:

Step 2: Create a SAML app in Google Admin

1. In a new tab, open https://admin.google.com/
2. Click Apps → Web and mobile apps → Add app → Add custom SAML app

Step 3: Complete App Details

1. In the App Name field, enter a name to identify your application with. CloudQuery is a good choice in most cases.
2. (Optional) Enter a description
3. (Optional) Provide an App icon for your users. You can use this icon: (Right-click on the image → Save Image As… → Save to your drive. Then upload it in the Google interface.)
4. Click Continue

Step 4: Download & Upload Metadata

1. On the next page, click Download Metadata:

This will download a GoogleIDPMetadata.xml file onto your drive. Click Continue.

2. Upload the XML metadata file in the CloudQuery admin panel by clicking Upload metadata file:

Step 5: Enter ACS URL and Entity ID

Back in the Google Admin interface, enter the value for ACS URL and Entity ID. These values can be copy-pasted from the CloudQuery Platform Admin page:

Copy these values into the highlighted fields:

When done, click Continue on the Google page.

Step 6: Set Attribute Mappings

Next, enter some basic attribute mapping information:

1. First name → first_name
2. Last name → last_name
3. Primary email → email

Step 7: Configure Group Membership

On the same screen, configure group membership so that CloudQuery Platform can assign roles based on your Google Workspace groups.

1. In the Group membership section of the Google SAML app, add the groups you want to map to CloudQuery Platform roles. Set the App attribute to the name you want to use as the group claim (e.g., groups).

2. In the CloudQuery Platform SSO settings, set the Group attribute field to the same value as the App attribute you configured in Google (e.g., groups).

3. Click Continue in the Google UI.

You can map multiple groups to different roles in CloudQuery Platform. For the full configuration, including default roles for users not in any group and multiple group-to-role mappings, see Map Groups to User Roles.

Step 8: Enable User Access

Now, click on the User access section.

Select ON for everyone. Then click SAVE.

Step 9: Save and Test

Click Save and enable on the CloudQuery admin page:

On the Google Admin page, click TEST SAML LOGIN.

If everything is set up correctly, you should now be logged into CloudQuery Platform with your Google account.

Next Steps

• Map Groups to Roles - Map Google groups to platform roles
• Certificate Rollover - Manage certificate updates
• User Management - Manage users and roles