How do I connect Grovo to G Suite for single sign-on (SSO)?

Using Security Assertion Markup Language (SAML), a user can use their managed Google account credentials to sign in to enterprise cloud applications via single sign-on (SSO). An identity and access management (IAM) service provides administrators with a single place to manage all users and cloud applications. You don't have to manage individual user IDs and passwords tied to individual cloud applications for each of your users. An IAM service provides your users with a unified sign-on across all their enterprise cloud applications.

Prerequisites

• An active G Suite plan
• An administrator account 

Download Your Metadata

1. From your web browser, sign in to your Admin console as a super administrator.
2. Click Apps > SAML apps.
3. Click the plus (+) icon in the bottom corner. The Enable SSO for SAML Application window opens.
4. Click Set up my own custom app.
   The Google IDP Information window opens and the Single Sign-On URL and the Entity ID URL fields automatically populate.
5. Download the IDP metadata, and then come back to the admin console and click Next.

Step 1: Enter service provider (SP) details in Google Admin console

1. In the Basic Application Information window, add an application name and description.
2. (Optional) Click Choose file next to the Upload Logo field to upload a PNG or GIF file to serve as an icon. The file size should be 256 pixels square.
3. In the Service Provider Details section, enter the following URLs into the Entity ID, ACS URL, and Start URL fields:
           ACS URL: https://<subdomain>.grovo.com/sso/saml2/saml-assertion
           Entity ID: https://<subdomain>.grovo.com/sso/saml2/metadata 
           Start URL: https://<subdomain>.grovo.com
4. Leave Signed Response unchecked. 
5. Set Name ID to Primary Email and the Name ID Format to Email 
6. Click Next.
7. Click Add new mapping and enter a new name for the attribute you want to map. Grovo requires the following four attributes which must be entered exactly:
   • Email Address
   • First Name
   • Last Name
   • employeeID
8. In the drop-down list, select the Category and User attributes to map the attribute from the Google profile.
9. Click Finish.

Step 2: Enable the Grovo app

1. Sign in to your Admin console.
2. Go to Apps > SAML apps.
3. Select Grovo.
4. At the top of the gray box, click Moreand choose:

   • On for everyone to turn on the service for all users (click again to confirm).
   • Off to turn off the service for all users (click again to confirm).
   • On for some organizations to change the setting only for some users.
5. Ensure that your Grovo user account email IDs match those in your Google domain.

Step 3: Configuring Grovo (SP)

Step 4: Verify that SSO is working

1. Close all browser windows.
2. Open https://<subdomain>.grovo.com and attempt to sign in. You should be automatically redirected to the Google sign in page.
3. Enter your sign in credentials.
4. After your sign in credentials are authenticated you're automatically redirected back to Grovo.