Google SAML SSO feature is a paid feature.

If you’re using Infisical Cloud, then it is available under the Pro Tier. If you’re self-hosting Infisical, then you should contact [email protected] to purchase an enterprise license to use it.

1

Prepare the SAML SSO configuration in Infisical

In Infisical, head to your Organization Settings > Authentication > SAML SSO Configuration and select Set up SAML SSO.

Next, note the ACS URL and SP Entity ID to use when configuring the Google SAML application.

Google SAML initial configuration

2

Create a SAML application in Google

2.1. In your Google Admin console, head to Menu > Apps > Web and mobile apps and create a custom SAML app.

Google SAML app creation

2.2. In the App details tab, give the application a unique name like Infisical.

Google SAML app naming

2.3. In the Google Identity Provider details tab, copy the SSO URL, Entity ID and Certificate.

Google SAML custom app details

2.4. Back in Infisical, set SSO URL, IdP Entity ID, and Certificate to the corresponding items from step 2.3.

Google SAML Infisical config

2.5. Back in the Google Admin console, in the Service provider details tab, set the ACS URL and Entity ID to the corresponding items from step 1.

Also, check the Signed response checkbox.

Google SAML app config 2

2.6. In the Attribute mapping tab, configure the following map:

  • First name -> firstName
  • Last name -> lastName
  • Primary email -> email

Google SAML attribute mapping

Click Finish.

3

Assign users in Google Workspace to the application

Back in your Google Admin console, head to Menu > Apps > Web and mobile apps > your SAML app and press on User access.

Google SAML user access

To assign everyone in your organization to the application, click On for everyone or Off for everyone and then click Save.

You can also assign an organizational unit or set of users to an application; you can learn more about that here.

Google SAML user access assignment

4

Enable SAML SSO in Infisical

Enabling SAML SSO allows members in your organization to log into Infisical via Google Workspace.

Google SAML enable

5

Enforce SAML SSO in Infisical

Enforcing SAML SSO ensures that members in your organization can only access Infisical by logging into the organization via Google.

To enforce SAML SSO, you’re required to test out the SAML connection by successfully authenticating at least one Google user with Infisical; Once you’ve completed this requirement, you can toggle the Enforce SAML SSO button to enforce SAML SSO.

We recommend ensuring that your account is provisioned the application in Google prior to enforcing SAML SSO to prevent any unintended issues.

If you’re configuring SAML SSO on a self-hosted instance of Infisical, make sure to set the AUTH_SECRET and SITE_URL environment variable for it to work:

  • AUTH_SECRET: A secret key used for signing and verifying JWT. This can be a random 32-byte base64 string generated with openssl rand -base64 32.
  • SITE_URL: The URL of your self-hosted instance of Infisical - should be an absolute URL including the protocol (e.g. https://app.infisical.com)

References:

Was this page helpful?

Keycloak SAMLOverview