SAML/SSO with Google Workspace

• Administration abilities within Google Workspace.
• Admin or super-admin user role within Hudu.
• Your own domain is registered and verified with Google Workspace.
• All users provisioned in Google Workspace with the same exact email address as listed in Hudu. We don't create new user accounts from SSO.
• Ensure that the users have already been created in Hudu before starting this process.

Guides

How to Enable SSO

1. Login to Hudu and click the Admin tab on the top toolbar.
2. Click General.
3. Click Configure Single Sign-On.
4. Enter SAML details. See the relevant section below on how to fill this information out.
5. Click Enable Single Sign-On.
6. Hit Update SAML Details and SAML should now be activated.

Configuring Google Workspace

• In Google Workspace:
  • Navigate to Apps >> Web and mobile apps >> Add App >> Add custom SAML app

• Provide app details:
  • App name (required)
  • App description (optional)
  • App icon (optional)

• Click continue.
  • This will open up a page with two options with your Google Identity provider details; copy the Option 2 SSO URL, Entity ID, and Certificate - we'll need these later (you can also access these later).

• Click continue.
• Service provider details:
  • These will come from your Hudu instance.
  • ACS (Assertion Consumer Service) URL: Enter your Hudu URL, followed by /saml/consume
    • e.g. https://docs.mywebsite.com/saml/consume
  • Entity ID: Enter your Hudu URL
    
    • e.g. https://docs.mywebsite.com
  • Start URL: This can be skipped.
  • Signed response: This can be skipped.
• Define Name ID format:
  • Name ID format: EMAIL
  • Name ID: Basic Information > Primary Email

• Click continue.
  • Attribute mapping can be skipped.
• Click finish.
• Lastly, you'll need to enable access for users via the Users Access dropdown. This must be ON for all users that will be utilizing SSO.

Configuring Hudu

1. In Hudu, with a user role of Admin or Super Admin:
   • Navigate to your Hudu admin area >> General >> SAML/SSO Configure.
2. Provide Identity Provider (IdP) information:
   • This is the information that we copied earlier, from Option 2. To access these again:
     • Navigate back to Google Workspace >> Apps >> Web and mobile apps
     • Click into the app you've just created >> Service provider details dropdown arrow.
     • Click Manage Certificates.
   • SAML Issuer URL: This is what Google Workspace calls their "Entity ID." Copy this exactly into Hudu.
   • SAML Login URL: This is what Google Workspace calls their "SSO URL." Copy this exactly into Hudu.
   • SAML Logout URL: This should be identical to your SAML Login URL, paste the SSO URL here as well.
   • SAML Fingerprint:
     • Copy the SHA-256 fingerprint provided by Google Workspace.
     • Alternatively, follow the steps below to calculate the SHA-1 fingerprint.
       • Obtaining the SHA-1 fingerprint:
         1. In order to get the fingerprint into the SHA-1 format, go to https://developers.onelogin.com/saml/online-tools/x509-certs/calculate-fingerprint.
         2. Paste the SAML Certificate provided by Google Workspace into the X.509 cert text box.
         3. Set the algorithm to sha1.
         4. Copy the fingerprint. It should look like this:
         5. e1ec606f56ddcf9f364be0c2cff7221354223121
   • SAML Certificate: This is provided by Google Workspace, and should be the same certificate used to configure the fingerprint; copy this exactly.
   • -----BEGIN CERTIFICATE----- and -----END CERTIFICATE----- should be included.

• SAML ARN: This signifies the Authentication Context that Hudu will provide to the IdP. AuthnContext is the method by which a user tries to log in (i.e. via password, passwordless, etc.).
  • • If you specify Do not pass RequestedAuthnContext in your request, the URN is used by the IdP to say "I don't want to tell you how I identified the user".
      • Requested Authentication Context may be required for your IdP, but it is typically optional.
      • If you have users that use Passwordless login to your IdP; do not pass RequestedAuthnContext must be selected.
    • If you specify Password in your request, the IDP knows it has to authenticate the user through login/password.
    • If you specify PasswordProtectedTransport in your request, the IDP knows it has to authenticate the user through login/password, protected by SSL/TLS.

• Click Enable Single Sign-On.
• Hit Update SAML Details and SAML should now be activated.

Testing SAML

Disable Password Access for non-Admins

FAQ