SAML-based single sign-on (SSO) with Google for Persona Dashboard

Overview

You can enable SAML-based Single Sign-On for the Persona Dashboard via Google SSO via your Google Workspace account by following this guide.

By default, users can choose to login through SAML or via email and password. SAML enforcement can be configured by navigating to Organization > Authentication for a user with Admin permissions.

Retrieve your Organization Slug

Log in to your Persona dashboard as a user with Admin permissions.

1. Navigate to Organization > Authentication.
2. Under Single sign-on, you’ll find your Organization Slug.

Make note of your Organization Slug. You’ll need it in the steps below.

Steps in Google Workspace

1. From Google Workspace admin console, navigate to Menu > Apps > Web and mobile apps.
2. Click on Add app and select Add custom SAML app.
3. Fill out App details. Click CONTINUE.
4. Download IdP metadata (Option 1). Click CONTINUE
5. Add service provider details, replace <ORGANIZATION-SLUG> from the first section
   • ACS URL: https://withpersona.com/saml/<ORGANIZATION-SLUG>/acs
   • Entity ID: https://withpersona.com/saml/<ORGANIZATION-SLUG>/metadata
6. Leave Name ID format as UNSPECIFIED and Name ID as Basic Information > Primary email and click CONTINUE.
7. Leave attributes and group membership as-is. Click FINISH.
8. You’ll now see your SAML app added. In this example, we named our Persona Application “withpersona SSO”.

9. If you haven’t already downloaded the metadata, click on Download Metadata.

Steps in the Persona Dashboard

1. Log in to your Persona dashboard as a user with Admin permissions
2. Navigate to Organization > Authentication.
3. Under Single sign-on, click Manage.
4. Enter the Metadata you obtained from the last step in the previous section.
   • Copy the metadata into Provide the raw Metadata XML IdP details section.
5. Click Parse metadata.

Renewing an expiring SAML SSO certificate

Google signing certificates have a five-year lifetime. If the certificate expires before it is replaced, your users will not be able to sign in to Persona through Google SSO until a new certificate is in place.

Unlike Okta and Azure, Google Workspace does not publish a metadata URL for custom SAML apps, so Persona cannot pick up a renewed certificate on its own. Every rotation requires re-uploading the updated metadata to Persona.

Generate a new certificate in Google Workspace

1. Sign in to the Google Admin console as a super administrator.
2. Go to Menu > Security > Authentication > SSO with SAML applications.
3. Click Add another certificate. Google generates the new certificate for you.

Assign the new certificate to your Persona app

1. Go to Menu > Apps > Web and mobile apps and click your Persona SAML app to open its Settings page.
2. Click Service provider details.
3. Click the Down arrow and choose the new certificate.
4. Download the updated IdP metadata for the app.

Refresh the metadata in Persona

1. Log in to your Persona dashboard as a user with Admin permissions.
2. Navigate to Organization > Authentication.
3. Under Single sign-on, click Manage.
4. Copy the updated metadata into the Provide the raw Metadata XML IdP details section.
5. Click Parse metadata.

Access to SAML-based SSO with Google by plan

Learn about pricing and plans