Set up Google Workspace single sign-on for Eklo
Connect Eklo to Google Workspace as a SAML 2.0 identity provider — the custom SAML app, attribute mapping, turning it on and a test.
Last updated
This guide connects Eklo to Google Workspace with SAML 2.0, so people at your church's email domain sign in to Eklo through Google Workspace.
Read Single sign-on (SAML) first. You need a verified email domain in Eklo and a Google Workspace super admin account.
If your church only needs "staff sign in with their Google account", you may not need SAML at all: with a verified domain and no SAML connection, Eklo already offers Continue with Google for addresses at that domain. Set up SAML when you want Google Workspace to control who can reach Eklo (by organizational unit or group).
1. Create the custom SAML app
- In the Google Admin console, go to Apps → Web and mobile apps.
- Click Add app → Add custom SAML app.
- App name:
Eklo. Click Continue. - On Google Identity Provider details, click Download metadata (under Option 1). Keep the file: Google doesn't publish its metadata at a URL, so you'll upload this file to Eklo. Click Continue.
2. Service provider details
Copy from Eklo's Settings → Single sign-on:
- ACS URL: Eklo's ACS URL.
- Entity ID: Eklo's Entity ID.
- Leave Start URL empty.
- Leave Signed response unticked (Google signs the assertion either way).
- Name ID format:
EMAIL. - Name ID: Basic Information → Primary email.
Click Continue.
3. Attribute mapping
Add these mappings, then click Finish:
| Google Directory attributes | App attributes |
|---|---|
| Primary email | email |
| First name | givenName |
| Last name | surname |
With these names you can leave Eklo's attribute fields blank.
4. Turn the app on
New custom SAML apps are off for everyone. Open the app, click User access, and turn it ON for everyone or for the organizational units or groups who should use Eklo. Changes can take a few minutes, and occasionally up to 24 hours, to reach everyone.
The app also appears in people's Google app launcher. That tile starts sign-in at Google, which Eklo doesn't accept, so tell people to sign in from the Eklo sign-in page.
5. Connect Eklo to Google
In Eklo, open Settings → Single sign-on, choose Metadata file,
choose the GoogleIDPMetadata.xml file you downloaded (or paste its
contents), and click Save connection.
Eklo shows Google's entity ID (https://accounts.google.com/o/saml2?idpid=…),
sign-in URL and certificate expiry.
6. Test
In a private window, go to the Eklo sign-in page, enter your work email and choose Continue with single sign-on. Google asks you to sign in, then sends you back to Eklo. Google's Test SAML login button starts at Google, so Eklo answers it with "Sign-in must start from Eklo"; test from the Eklo sign-in page instead.
When it works for you, consider turning on Require SSO for the domain. See Require SSO.
Certificate rotation
Google's SAML certificates last five years. When you add a new certificate in the Admin console (Security → Authentication → SSO with SAML applications), download the app's metadata again, then in Eklo click Update connection and upload the new file.