implementing-google-workspace-sso-configuration — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited implementing-google-workspace-sso-configuration (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Single Sign-On (SSO) for Google Workspace allows organizations to authenticate users through their existing identity provider (IdP) such as Okta, Azure AD (Microsoft Entra ID), or ADFS, rather than managing separate Google passwords. This is implemented using SAML 2.0 protocol where Google Workspace acts as the Service Provider (SP) and the organization's IdP handles authentication. SSO centralizes credential management, enforces MFA policies at the IdP, and enables immediate access revocation when users leave the organization.
User navigates to Google Workspace app (Gmail, Drive, etc.)
│
├── Google checks: Is SSO configured for this domain?
│
├── YES → Redirect user to IdP Sign-In Page URL
│ (SAML AuthnRequest sent via browser redirect)
│
├── User authenticates at IdP (credentials + MFA)
│
├── IdP generates SAML Response with signed assertion
│
├── Browser POSTs SAML Response to Google ACS URL:
│ https://www.google.com/a/{domain}/acs
│
├── Google validates SAML signature against uploaded certificate
│
└── User is granted access to Google Workspace| Parameter | Value |
|---|---|
| ACS URL | https://www.google.com/a/{your-domain}/acs |
| Entity ID | google.com/a/{your-domain} or google.com |
| NameID Format | urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress |
| NameID Value | User's primary Google Workspace email |
| Binding | HTTP-POST (for ACS), HTTP-Redirect (for SSO URL) |
For Okta:
For Azure AD (Microsoft Entra ID):
google.comhttps://www.google.com/a/{your-domain}/acshttps://www.google.com/a/{your-domain}/ServiceLoginFor ADFS:
Third-Party SSO Profile Settings:
| Setting | Value |
|---|---|
| Set up SSO with third-party IdP | Enabled |
| Sign-in page URL | IdP's SAML SSO endpoint (e.g., https://idp.example.com/sso/saml) |
| Sign-out page URL | IdP's logout URL (e.g., https://idp.example.com/slo) |
| Change password URL | IdP's password change URL |
| Verification certificate | Upload IdP's X.509 signing certificate |
| Use a domain-specific issuer | Enabled (uses google.com/a/{domain} as entity ID) |
SSO profiles can be applied at different scopes:
Organization-wide (all users)
│
├── Org Unit level (specific departments)
│ ├── Engineering OU → SSO via Okta
│ ├── Marketing OU → SSO via Azure AD
│ └── Contractors OU → SSO via specific IdP
│
└── Group level (specific security groups)
└── VPN Users → SSO with additional MFANetwork masks control when SSO is enforced based on the user's IP:
This is useful for allowing direct Google login from corporate network while enforcing SSO for external access.
https://mail.google.com/a/{your-domain}~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.