Step By Step Guide to Setting Up SSO in Salesforce with Google

Single Sign-On (SSO) allows users to access multiple applications with one set of credentials. They don’t need to remember the userid / password for each application separately. It’s like having a magic key that automatically opens all the other doors once you enter through one door.

To set up SSO, you need to designate one system that will authenticate the user and all other systems will trust that one system and allow users to log in. The system that authenticates users is called “Identity Provider” or IdP and all the other systems that trust IdP are called “Service Provider” or SP.

Salesforce provides different options to configure Single Sign-On. This includes:

1. Federated Authentication using SAML
2. Delegated Authentication
3. OpenID Connect

For the purpose of this blog post, we will limit our discussion to Federated Authentication using SAML. In Federated Authentication, there are two main concepts in SSO that you need to be aware of.

1. The concept of IdP/SP
2. The concept of IdP initiated login and SP initiated login.

Let’s see what they mean.

1. IdP/SP: IdP stands for Identity Provider and SP stands for Service Provider. When logging on, IdP is the system that authenticates user by validating the username and password and then subsequently all other applications trust IdP and allow user to access the application if the IdP asserts that the user is a valid user. In such cases, IdP is the system that stores user’s login name and password. You can configure different systems as IdP, for example Microsoft Active Directory, Oracle Internet Directory, Google, Salesforce etc.
2. IdP initiated Login and SP initiated Login: When a user needs to access the application, he/she can initiate the access in two different ways. User can log on to IdP and then from there, click on links to access other systems (i.e. SP). This is called IdP initiated login. Or otherwise, the user can go directly to an SP application to access the application. In this case, SP will redirect the user to IdP login page where user will provide his or her username and password, IdP will authenticate the user and pass the control back to SP asserting whether user is authenticated or not. SP will then allow user to access the application

With Salesforce, you can configure Salesforce both ways – as an IdP or as a SP. There are different possible combinations in setting up SSO with Salesforce.

In this blog post, we will learn how to configure Single Sign-On in Salesforce with Google. A lot of organizations today use Google Workspace for Email, Productivity and Collaboration. And since Email is an indispensable tool in today’s world, users will login to their email account than any other application.

So, it will make sense to piggyback on user’s login to their Google Account for Email and allow them to login to Salesforce also through their Google account.

Though SSO may sound complex, it won’t take you more than 15-20 minutes to set this up from scratch. Here is what we will be covering in this guide (all in under 15-20 minutes)

1. Configure Google as IdP (Identity Provider)
2. Configure Salesforce as SP (Service Provider)
3. Enable Option to Login through SSO
4. Specify the Federation ID for the User
5. Test Single Sign On
6. Troubleshoot SSO Issues

NOTE: Certain sections of the guide will appear as locked in the free preview. You can download the unlocked version of the guide in PDF format by subscribing to our “All Access” Pass through the link below.

References & Useful URLs

1. Google Help Article – Set up SSO via SAML for Salesforce