This document provides guidelines on how to configure Workvivo to authenticate via Single Sign On (SSO) using Google Workspace as the identify provider (IdP) solution in a SAML2 SSO configuration. The information contained in this document is intended as a guideline only - there may be significant differences in any given Google Workspace configuration that require a different approach to be taken.
1. Set up Workvivo as a Custom SAML App
The first step to configuring Workvivo in Google Workspace is to add it is as a custom app.
From the Google Workspace Admin console Home page, go to Apps and then Web & Mobile Apps.
Click Add App, then select "Add Custom SAML App"
Enter a name for the App, for example Workvivo. You have the option to choose an App Icon, and select Continue.
Choose Option 1 to download your IdP metadata. Alternatively, copy the SSO URL, Entity ID and Certificate from Option 2 to enter these details directly on Workvivo later
2. Complete the configuration on Workvivo
If your full user base will be using SSO authentication for Workvivo, you can plug in the metadata directly in Workvivo.
Firstly you will need the "IT Administrator" role on Workvivo - this can be granted by a current Admin, or your Workvivo point of contact.
Once you have been granted this role, navigate to the Admin section > Authentication and System Settings.
Under Authentication Mode, choose Single Tenant SSO Only
Next, select Set up SSO Tenant
Enter a Name for your New SSO Tenant
Note: this is just a label for you to identify your sso tenant, for example 'Google SSO Tenant'
On the next screen, you will find your specific Entity ID and ACS URL to enter into Google Workspace. Copy and save these elsewhere for now, so you can retrieve them for the later steps.
Once you have saved the URLs, next you will need to enter the metadata details from Google Workspace.
Add the required metadata details you downloaded from the IdP Metadata URL (Option 1) . You can also copy and paste the three values listed below directly from Google Workspace (Option 2).
1. Entity ID → IdP Entity ID
2. SSO URL → SSO Service URL
3. Certificate → X.509 Certificate
Note: The Option to Force Google Account Chooser allows the user to select the correct Google account when multiple accounts are logged in
Once those details are added, Save your configuration
3. Configure the Service provider details in Google Workspace
Return to Google Workspace to complete the SAML configuration.
In the Service provider details screen, enter the below values using the URLs you copied directly from Workvivo previously to populate the ACS URL and Entity ID fields
- ACS URL: https://[companyname].workvivo[.com][.us][.me]/saml/acs
- Entity ID: https://[companyname].workvivo[.com][.us][.me]/saml/metadata
- Name ID Format: EMAIL
- Name ID: Basic Information, Primary Email
*Note - Depending on whether your Workvivo instance is hosted on our EU, US, or UAE data center, make sure you enter the correct domain. It will either be workvivo.com, workvivo.us, or workvivo.me. The format may also differ if your organisation has configured a custom domain name for Workvivo. If you do not know your Workvivo domain name, please contact our Support team via 'Submit a request' for assistance.
Click "Continue" to move to the next step.
Create a new mapping for Basic Information: Primary Email to Email
Click "Finish"
4. Enable SSO for Users
The final step is to turn the app on for all employees.
From the Admin console Home page, go to Apps and then Web & Mobile Apps and select your new Workvivo SAML app.
Click to expand the panel on the top right.
To apply settings for all users, check the 'ON for everyone' radio button and then click "Save".
To apply settings to individual organisational units, select the relevant organisational unit that contains the users whose settings you want to change from the list on the left hand side. To change the setting, elect On or Off.
5. Testing SSO
To test that SSO has been configured correctly:
- Ensure the user profile has been created on Workvivo either manually or via SCIM provisioning.
- Open your Workvivo URL in your browser and you should be automatically redirected to the Google sign-in page.
- Enter your sign-in credentials.
- Once authenticated , you should be automatically redirected back to the Workvivo app.
* If the SAML X509 Certificate is updated on Google this can take up to 24 hours to come into effect.
Please note, if you have some password based users or have multiple single sign-on tenants you would need to configure these by choosing the relevant Authentication Mode under Authentication and System Settings in the Workvivo Admin panel. If you have any questions please contact our Support Team via the 'Submit a request' button, who can help assist you with this configuration.