SSO with Google Workspace

This is how you connect a workspace to Google Workspace. The overall order (verify the domain first, then the connection) is described under Enterprise sign-in; this page fills in the part that happens in the Google Admin console.

One peculiarity up front: Google provides no metadata URL, only a file to download. In verstag you therefore use the "XML file" source — and after a certificate rotation at Google you upload a new file, because nothing can be re-fetched from a file.

The menu paths match the Google Admin console as of September 2026.

What you need

• In verstag: a verified e-mail domain and the „Unternehmens-Anmeldung (SSO)“ (Enterprise sign-in) card under Settings → „Sicherheit & SSO“. Under „Werte für den Identitätsanbieter“ (Values for the identity provider) it shows the two values, with copy buttons, that you are about to enter.
• In Google: an account with super-admin rights for the Admin console.

Step 1: Create a custom SAML app

1. Open the Google Admin console and go to Menu → Apps → Web and mobile apps.
2. Choose Add app → Add custom SAML app.
3. Enter a name (say, "verstag") and continue.

Step 2: Download the metadata file

On the "Google Identity Provider details" page, choose "DOWNLOAD METADATA". The file is called GoogleIDPMetadata.xml — it is what verstag is about to receive. You do not need the SSO URL and certificate shown beside it individually; they are inside the file.

Step 3: Enter the service provider details

On the "Service provider details" page, enter the two values from the verstag card:

• ACS URL → the value „ACS-URL (Reply URL)“
• Entity ID → the value „Entity ID (Identifier)“

Under Name ID, set:

• Name ID format: EMAIL
• Name ID: Basic Information → Primary email

Step 4: Map the e-mail address and the name

This is the setting a Google connection otherwise fails on. On the "Attribute mapping" page, choose "ADD MAPPING" and map:

• Basic Information → Primary email → app attribute email
• Basic Information → First name → app attribute given_name
• Basic Information → Last name → app attribute family_name

verstag matches a sign-in by e-mail address and reads it from this attribute; the Name ID alone is not enough. Without the mapping, verstag refuses every sign-in with „Dein Unternehmenskonto hat bei der Anmeldung keine E-Mail-Adresse übermittelt“ (your company account sent no e-mail address) — even when everything else is right.

First and last name are optional. With them, a new member appears under their name in the member list and the activity log; without them, under their e-mail address.

For an app that already exists, the mapping is in the app's overview under "SAML attribute mapping".

Step 5: Turn the app on for users

After creation the app stands at "OFF for everyone". Open User access in the app's overview and switch it ON — for everyone, or for the organisational units that should use verstag. Google usually needs a few minutes before the change applies everywhere — occasionally considerably longer.

Step 6: Upload it in verstag

Back on the „Unternehmens-Anmeldung (SSO)“ card:

1. Set the source to „XML-Datei“ (XML file) and pick the downloaded GoogleIDPMetadata.xml.
2. Pick the role for new members and decide about automatic admission.
3. „Verbindung speichern“ (Save connection).

Check it

Sign in through your workspace's sign-in address (the page's third card). Use that route instead of the test button in the Google console too: the button starts the sign-in at Google, the sign-in address starts it at verstag — and that is the route your members take.

When Google rotates the certificate

Google certificates expire after a few years; the Admin console shows this under Security → Authentication → SSO with SAML applications. Download the new metadata file then and upload it in verstag again — an uploaded file does not refresh itself.