How do I set up a custom SAML application using Google SSO

1. Sign in to your Google Admin console (admin.google.com)
2. From the Admin console Home page, open Apps.
3. Open Web and mobile apps.

Open the Add app dropdown, and select Add custom SAML app.

Enter the App name (Echo) 

1. Download the IDP metadata. You will use this when configuring Echo.

In the Service Provider Details window, add an ACS URL, an Entity ID, and a Start URL. Use the following URLS (this information can also be found at (https://api.agilixbuzz.com/SAML/USERSPACE/metadata.xml):

• ACS (AssertionConsumerService) URL:  https://api.agilixbuzz.com/SAML/USERSPACE/Consumer
• Entity ID: https://api.agilixbuzz.com/SAML/USERSPACE
• Start URL: https://USERSPACE.echo-ntn.org/home

If you want to attach additional information to app (e.g., names, email, titles, etc):

1. Click Add mapping.
2. Open the Google directory attributes dropdown, and select the desired attribute for everything you want to add.
3. Provide the information in the App attributes fields.
4. Click Finish.

Google shows you a summary of the SAML configuration. From this screen you can make changes, including turning the app on or off for everyone.

1. Sign in to your Google Admin console (admin.google.com)
2. From the Admin console Home page, open Apps.
3. Open Web and Mobile apps.

Click your new SAML app.

Click the User access card.

1. At the left, the top-level organization and any organizational units appear. Ensure that your user account email IDs match those in the domain for your Google service (e.g., studentname@school.com).
2. Select ON for everyone to enable SSO for the listed organizations.
3. Save.

Go to the Admin app in Echo for the USERSPACE you configured in Google, and from Domain select Domain Settings from the vertical menu.

1. On the Authentication card, select SAML as your authentication Type (Do not choose the "old version" of SAML)
2. Click Add identity provider (IdP).

1. Provide the Login prompt. This is what appears on the login button. If you have only one IdP, this defaults to Login, if you have more, you can label them appropriately.
2. Upload the idp-meta XML file that you downloaded from Google.
3. The Metadata resource path and Provider ID are automatically populated.
4. Click Done.

• Provide a Logout redirect URL if you want users to be taken to somewhere other than the Echo login screen with they sign out.
• Indicate if you want to Prevent users form using Echo credentials.
• If you don't select this, you have the option to Allow users to create their own accounts rather than requiring they be created for them. You will also be able to set up your password policy.

1. Go to your Echo login page.
2. Click Login to launch the Google SSO.

1. Enter your G Suite credentials.
2. After your G Suite credentials are authenticated you will be automatically redirected back to your Echo home page.

Echo is constantly being improved based on the feedback from users and we strive to keep our documentation up to date.  If this document doesn’t match what you are seeing in Echo, please let us know.