# Use Google SAML as an Identity Provider (IdP)

The Google Identity Provider (IdP) is a trusted entity that allows you to enable single sign-on to access other sites or services, such as Azion. Your users can continue using their corporate user identities without having to remember a specific password or enter credentials each time they access Azion's platform. 

To set up a Google custom SAML app as your account IdP for Azion, follow the next steps.

:::caution[warning]
Even if you're using an IdP, it's necessary to register all users of the account on Azion's platform as they're synced in both Azion's platform and IdP. An inexistent user on Azion's platform won't be able to log in to it.
:::

---

## Configuring the SAML app on Google Admin

:::note
You need to be an administrator of the Google account to perform the following tasks.
:::

1. Access [Google Admin Console](https://admin.google.com).
2. Go to the upper-left corner of the page, and in the dropdown menu, select **Apps** > **Web and mobile apps**.
3. Click **Add App** > **Add custom SAML app**.
4. On the App Details page:

    - Type a name for the app you're creating.
    - Click **Continue**.

5. On the Google *Identity Provider details* page, copy the *SSO URL* and *Entity ID* and download the Certificate. You'll need this information on Azion's platform.

---

## Configuring the Identity Provider on Azion

:::note
You must be the **Account Owner** on Azion's platform to perform these settings.
:::

1. Access [Azion Console](/en/documentation/products/guides/how-to-access-azion-console/).
2. On the upper-right corner of the page, select the avatar menu. This is the **Account menu**.
3. Select **SSO Management**.
4. Click the **Add Identity Provider** button and select **SAML**.
5. On the **Identity Provider** page, choose a name that identifies your Identity Provider. Example: `Google IdP`.
6. Fill in the following fields with the data copied from Google Admin:

- Identity provider's Entity ID URI.
- Sign-in URL.
- Certificate. It must include the —-BEGIN CERTIFICATE—- and —-END CERTIFICATE—- parts.

7. Click **Save**. You'll be redirected to the list of identity providers, where you can view all the providers created in your account.

---

## Completing the registration of the app on Google Admin

1. On the **SSO Management** page of Azion Console:

    - Find the box of your recently created identity provider.
    - Click the context menu, represented by three dots > **Edit**.

:::caution[warning]
Don't click **Activate and turn on identity Origin** before you complete the configuration on Google Admin.
:::

2. On the **Identity Provider** page you'll need to copy the following information to finish the configuration on Google Admin:

    - Assertion Consumer Service URL.
    - Service Provider's Entity ID URI.
    - Sign-in URL.

3. On Google Admin, access the **Service Provider Details** of the app you've created and provide the following information:

    - In the **ACS URL** field, paste the Assertion Consumer Service URL you've copied from Console.
    - In the **Entity ID** field, paste the Service Provider's Entity ID URI you've copied from Console.
    - In the **Start URL** field, paste the Sign-in URL you've copied from Console (*optional field*).

4. Check the *Signed Response* box.
5. In the **Name ID format** field, select the option UNSPECIFIED.
6. In the **Name ID** field, select the option *Basic Information > Primary email*.
7. Click **Continue**.
8. On the Attribute mapping page, click **Add Another Mapping**.
9. In the **Google Directory attributes** field, select *Basic Information > Primary email*.
10. In the **App Attributes** field, set the string *email*.
11. Click **Finish**.

---

## Turning on the Google custom SAML app

After setting the service provider details:

1. Go back to [Google Admin Console](https://admin.google.com).
2. Go to the upper-left corner of the page, and in the dropdown menu, select **Apps** > **Web and mobile apps**.
3. Select the SAML app you've just created.
4. Click **User access** and then click **On for everyone** to turn the service on for everyone in your organization. If you want to turn the app off, click **Off for everyone**.
5. Click **Save**.

---

## Turning on the Identity Provider on Azion

1. Back on Console, access the [SSO Management](https://console.azion.com/iam/sso/identity-providers) page.
2. On the box of the Identity Provider you've added, click **Activate and turn on identity Origin** and then click **Confirm**.

Now all the users of the account, except for the **Account Owner** will be able to access Console using Google as the Identity Provider.


:::note
When the IdP app is activated, the Multi-Factor Authentication (MFA) stops being verified by Azion's platform and starts to be authenticated by the IdP. If the account returns to Azion's SSO, it'll use the last active status of the MFA.
:::