SAML/SSO with Google Workspace

• Administration abilities within Google Workspace.
• Super-admin user role within Hudu.
• Your own domain is registered and verified with Google Workspace.
• All users provisioned in Google Workspace with the same exact email address as listed in Hudu. We don't create new user accounts from SSO.
• Ensure that the users have already been created in Hudu before starting this process.

How to Enable SSO

• Login to Hudu and click the Admin tab on the top toolbar.
• Click Security.
• Click Configure SAML/SSO.
• Turn Single Sign-In On.
• Enter SAML details. See the relevant section below on how to fill this information out.
• Click Save.

Configuring Google Workspace

• In Google Workspace:
  • Navigate to Apps → Web and mobile apps → Add App → Add custom SAML app

• Provide app details:
  • App name (required)
  • App description (optional)
  • App icon (optional)

• Click continue.
  • This will open up a page with two options with your Google Identity provider details; copy the Option 2 SSO URL, Entity ID, and Certificate - we'll need these later (you can also access these later).

• Click continue.
• Service provider details:
  • These will come from your Hudu instance.
  • ACS (Assertion Consumer Service) URL: Enter your Hudu URL, followed by /saml/consume
    • e.g. https://docs.mywebsite.com/saml/consume
  • Entity ID: Enter your Hudu URL
    • e.g. https://docs.mywebsite.com
  • Start URL: This can be skipped.
  • Signed response: This can be skipped.
• Define Name ID format:
  • Name ID format: EMAIL
  • Name ID: Basic Information → Primary Email

• Click continue.
  • Attribute mapping can be skipped.
• Click finish.
• Lastly, you'll need to enable access for users via the Users Access dropdown. This must be ON for all users that will be utilizing SSO.

Configuring Hudu

• In Hudu, with a user role of Admin or Super Admin:
  • Navigate to your Hudu admin area → Security → SAML/SSO Configure.
• Provide Identity Provider (IdP) information. This is the information that we copied earlier, from Option 2.
  • SAML Issuer URL: This is what Google Workspace calls their "Entity ID." Copy this exactly into Hudu.
  • SAML Login URL: This is what Google Workspace calls their "SSO URL." Copy this exactly into Hudu.
  • SAML Logout URL: This should be identical to your SAML Login URL, paste the SSO URL here as well.
  • SAML Fingerprint: Copy the SHA-256 fingerprint provided by Google Workspace.
  • SAML Certificate: This is provided by Google Workspace, and should be the same certificate used to configure the fingerprint; copy this exactly, including the -----BEGIN CERTIFICATE----- and -----END CERTIFICATE----- lines.

• SAML ARN: This signifies the Authentication Context that Hudu will provide to the IdP. AuthnContext is the method by which a user tries to log in (i.e. via password, passwordless, etc.).
  • If you have users that use Passwordless login to your IdP, Do not pass RequestedAuthnContext must be selected.

• Click Enable Single Sign-On.
• Hit Update SAML Details and SAML should now be activated.

Testing SAML

Exempt Groups from SSO

You have the option to select groups to exempt from SSO. Portal users are always exempt. Admins are always able to use password login instead. If the admin is configured in the identity provider, they can always log in via password by adding /?sso_disabled=true to the end of your instance URL.

FAQ