Skip to content
Help Center
withpersona.comDashboard

SAML-based single sign-on (SSO) with Google for Persona Dashboard

View Markdown Contact support Contact support 3 min read
On this page

Overview

Use this guide to enable SAML-based Single Sign-On for the Persona Dashboard through Google SSO with your Google Workspace account.

By default, users can log in through SAML or with email and password. To configure SAML enforcement, a user with Admin permissions goes to Organization > Authentication.

Retrieve your Organization Slug

Log in to your Persona dashboard as a user with Admin permissions.

  1. Go to Organization > Authentication.
  2. Your Organization Slug is under Single sign-on.

Write down your Organization Slug. You need it in the steps below.

Steps in Google Workspace

  1. In the Google Workspace admin console, go to Menu > Apps > Web and mobile apps.

  2. Click Add app and select Add custom SAML app.

  3. Complete the App details. Click CONTINUE.

  4. Download IdP metadata (Option 1). Click CONTINUE.

  5. Add service provider details. Replace <ORGANIZATION-SLUG> with your Organization Slug from the first section.

    • ACS URL: https://withpersona.com/saml/<ORGANIZATION-SLUG>/acs
    • Entity ID: https://withpersona.com/saml/<ORGANIZATION-SLUG>/metadata

  6. Keep Name ID format as UNSPECIFIED and Name ID as Basic Information > Primary email. Click CONTINUE.

  7. Do not change attributes and group membership. Click FINISH.

  8. Your new SAML app shows. In this example, the name of our Persona Application is “withpersona SSO”.

    Google SSO - Google Workspace

  9. If you did not download the metadata, click Download Metadata.

Steps in the Persona Dashboard

  1. Log in to your Persona dashboard as a user with Admin permissions.
  2. Go to Organization > Authentication.
  3. Under Single sign-on, click Manage.
  4. Enter the Metadata that you got in the last step of the previous section.
    • Copy the metadata into Provide the raw Metadata XML IdP details section.
  5. Click Parse metadata.

Renewing an expiring SAML SSO certificate

Google signing certificates usually stay valid for five years.

Rotate the certificate before the five years end. Google does not rotate your certificate for you when it expires. If a certificate expires before you replace it, your users cannot sign in to Persona through Google SSO until there is a new certificate. But rotation needs only a few clicks. If you add a new certificate in the Admin console, or delete your current one, Google automatically generates a new certificate. Add a calendar reminder some months before the five-year date. Then do the steps below to rotate.

Google Workspace does not publish a metadata URL for custom SAML apps. Persona gets renewed certificates automatically when it reads an IdP metadata URL again. Thus, with Google, you must upload the updated metadata to Persona again each time the certificate rotates.

You do not have to create a new SAML app. Use the existing app that you set up for Persona login. A new app is the most frequent cause of broken SSO.

Generate a new certificate in Google Workspace

  1. Sign in to the Google Admin console as a super administrator.
  2. Go to Menu > Security > Authentication > SSO with SAML applications.
  3. Click Add another certificate. Google generates the new certificate for you.

Assign the new certificate to your Persona app

  1. Go to Menu > Apps > Web and mobile apps. Click your Persona SAML app to open its Settings page.
  2. Click Service provider details.
  3. Click the Down arrow and select the new certificate.
  4. Download the updated IdP metadata for the app.

Refresh the metadata in Persona

Persona continues to use the old certificate until you complete these steps. Do them immediately after you assign the new certificate in Google. This prevents interruptions to sign-ins.

  1. Log in to your Persona dashboard as a user with Admin permissions.
  2. Go to Organization > Authentication.
  3. Under Single sign-on, click Manage.
  4. Copy the updated metadata into the Provide the raw Metadata XML IdP details section.
  5. Click Parse metadata.

Plans Explained

SAML-based SSO with Google by plan

Startup ProgramEssential PlanGrowth PlanEnterprise Plan
SAML-based SSO with GoogleAvailableAvailableAvailableAvailable

Learn more about pricing and plans.

Was this page helpful?If something is missing, let us know and we will take a look.
Thanks for the feedback. It helps us improve these docs.

Related articles

SAML-based single sign-on (SSO) with Okta for Persona Dashboard
Admin · Single sign-on (SSO) and Authentication
SAML-based single sign-on (SSO) with Azure for Persona Dashboard
Admin · Single sign-on (SSO) and Authentication
Setting up Okta SCIM
Admin · Single sign-on (SSO) and Authentication
Setting up Microsoft Entra SCIM
Admin · Single sign-on (SSO) and Authentication