Google Workspace and Nebula single sign-on configuration

The following instructions assist the Identity Provider administrator with the setup of single sign-on (SSO) for Nebula with Google Workspace. Nebula only supports SAML 2.0 authentication protocol. 

Get started

• The email address used for the Nebula account must match the email address used for Google Workspace.
• Log in to Nebula and go to Configure > Single Sign-on.
• Log in to your Google Workspace Administrator portal and go to the Admin > Applications page.

Add the application in Google Workspace

1. In your Google Admin console, go to Menu, then Apps > Web and mobile apps.
2. Click Add App > Add custom SAML app. 
3. Enter the app name and optionally upload an app icon.
4. Click Continue.

Setup Google Workspace SAML Settings

1. In the Nebula Single Sign-On page, copy the Solicted Whitelist URL.
2. Paste the copied URL into the ACS URL field in Google.
3. In Nebula, copy the Service Provider Entity ID URL.
4. Paste the copied URL into the Entity ID field in Google.
5. In Nebula, copy the Assertion Consumer Service URL
6. Paste the copied URL into the Start URL field in Google.
7. For extra security, enable or disable the Signed response checkbox:
   • Enabled: The entire SAML authentication response must be signed.
   • Disabled: Only the assertion within the response is signed.
8. Set the Name ID format and value for your custom SAML app.
   • Name ID Format: Email
   • Name ID: Basic Information > Primary Email.
9. Click Continue.
10. Map the user attributes based on the service provider's requirements.
    • Google Directory attributes: Primary Email
    • App Attributes: user.mail
11. Click Finish.

Upload Google Workspace SSO XML file into Nebula

1. Right-click Identity Provider metadata and select Save link as... to download the metadata.xml file in Google Workspace.
2. Name the file > click Save.
3. On the Nebula Single Sign-On page, have a Nebula Super admin drag the .xml file or Choose a Different File to upload the Identity Provider (iDP) Metadata.

Enable SSO

1. Once the metadata is uploaded, toggle on Enable SSO.
2. Toggle on Just-In-Time (JIT) Provisioning to automatically create Nebula users if they don't already exist when authenticating through Google Workspace.
3. Toggle on Service Provider Initiated SSO.
4. Now the application can be assigned to your Nebula administrators in Google Workspace. For more information, see Turn on your SAML app.