This article is intended for administrators wishing to configure Single Sign-on (SSO) for Edge Control using Google Workspace as the Identity Provider (IdPs).
Note: All images are clickable for enlarging, or can be opened in a new tab
Resolution/Information
It is important to ensure that the Attributes & Claims within Google Workspace have been configured correctly otherwise the integration will fail.
Table of Contents
Create the integration with Edge Control
Google Work Space
Log onto the admin portal and go to Apps>Web and mobile apps and add a new SAML app.
Follow the wizard:
Give a Name and Description and click CONTINUE.
Choose Option1 and DOWNLOAD METADATA
Keep this .XML file safe this will be needed later on when configuring SSO in Edge Control and click CONTINUE.
Fill in the Following values:
| Attribute | Value |
|---|---|
| ACS URL | https://auth.manage.stormagic.com/saml2/idpresponse |
| Entity ID | urn:amazon:cognito:sp:eu-west-1_Wj6yDgTye |
| Name ID | |
| Name ID | Basic Information > Primary email |
Set up Mapping.
| Google directory attributes | App attributes |
|---|---|
| First name | firstName |
| Last name | lastName |
| Primary email |
Click FINISH.
To Configure role mapping (optional) see the section below: Configure Role Mapping How this is setup needs to be determined by the Admin of the Google Workspace Domain.
Configure Single Sign-On (SSO) in Edge Control
Log in with the administrator account
Click on the Profile top Right Corner
Select the Organization Configuration and this is where SSO can be configured.
Enter the domain or domains and click Enter on the Keyboard
Fill in the Default Role when role mapping is not set.
Upload the .XML file downloaded from Google Workspace.
Either choose Force Single Sign-ON (SSO) or leave unchecked (whilst verifying functionality it is advised to leave unchecked).
Select SAVE CHANGES.
Log out and then test SSO.
By Selecting SINGLE SIGN ON (SSO)
Fill in the domain name and Sign In
Fill in verification if using MFA.
Accept EULA.
This will then show a VIEW only dashboard or whatever default was configured above.
Note: This current configuration will only map the user as the default role that has been set up with Edge Control. If you want to configure role mapping then add the "roles" App attributes.
Configure Role Mapping
Note: Roles are optional and The Google directory attribute for roles needs to be created by CLI first and this falls out of scope of this document.
Please see this link for further reference or consult with Google.
https://developers.google.com/workspace/admin/directory/reference/rest/v1/schemas
In order for the roles to MAP properly the following properties must be used and the name of the App attribute must be roles.
| Display Name | Value |
| ADMIN | ADMIN |
| MODIFY | MODIFY |
| VIEW | VIEW |
IMPORTANT: "ADMIN" maps the user to the ADMIN Role in Edge Control. "MODIFY" will map the user to the MODIFY role in Edge Control. The default role is VIEW - note this is a choice and the default role can be either VIEW, ADMIN or MODIFY and role mapping does not have to be used.
See Also
https://stormagic.com/doc/edge-control/Organization/manage-org-saml.htm
Comments
0 comments
Article is closed for comments.