Single Sign On with Google

Note: For you to enable SSO, our support team must first turn on the option for your organization. To get SSO turned on, please reach out to our support team on our contact form.

After contacting FireHydrant support to get SSO turned on for your organization, follow the steps in this article. 

Setting up single sign on with Google enables users in your G Suite account to authenticate (and provision) into your FireHydrant organization.

To follow the configuration steps, you must have permission to configure SAML applications in your Google admin panel. You must also have the role of Owner on FireHydrant to enable SSO for your account.

Creating the SAML Application

To get started:

1. Follow Google's instructions on how to set up your own custom SAML application. Google prompts you with steps to configure an app.
2. In a separate browser tab, open FireHydrant's SSO settings page. 
3. In FireHydrant, check Enable SSO. Three additional fields appear, requiring:
   • an IdP Login URL
   • the IdP Issuer
   • an IdP X509 Certificate
4. Locate this information from the Google Identity Provider Details page where you're following the application setup steps.
5. Copy the SSO URL into the IdP Login URL field in FireHydrant.
6. Copy the Entity ID field into the IdP Issuer field on FireHydrant.
7. Download the certificate that Google generates.
8. Open the file in a text editor.
9. Copy the entire contents of the certificate file and paste the text into FireHydrant's field for IdP X509 Certificate.
10. (Optional) In the Domains section, add the email domain name for your organization. This enables a message that appears when users attempt to log in using credentials from your org, advising them to log in with SSO.
11. Click Save in FireHydrant.
12. In the Google UI, provide the application name and (optionally) a description.
13. Click Next. Google prompts you to fill in Service Provider details.
14. For the ACS URL and Entitiy ID fields, enter https://app.firehydrant.io/sso/saml/consume.
15. Enable the Signed Response checkbox.
16. Verify that Primary Email is selected for the Name ID section. This is how your SSO configuration automatically creates accounts or logs existing users in to FireHydrant.
17. For the Name ID Format field, select Email.
18. Click Next.
19. (Optional) On the last step of the Google setup, provide any attribute mappings you'd like to include when users are sent to FireHydrant. These are optional, but we recommend setting the first and last name attributes so when users are provisioned, their names are automatically set correctly in FireHydrant.
    
20. Click Finish. This completes your Google SSO setup.