--- title: "Setting up SSO with Google Workspace" slug: "setting-up-sso-with-google-workspace" updated: 2026-10-28T10:16:18Z published: 2026-10-28T10:16:18Z canonical: "help.cintra.co.uk/setting-up-sso-with-google-workspace" --- > ## Documentation Index > Fetch the complete documentation index at: https://help.cintra.co.uk/llms.txt > Use this file to discover all available pages before exploring further. # Setting up SSO with Google Workspace This step-by-step guide walks you through setting up single sign-on (SSO) between Google Workspace (the identity provider) and Cintra People (the service provider). For an overview of how SSO works in Cintra People, including what happens when you turn it on, see [Single sign-on (SSO) overview](/docs/setting-up-single-sign-on-sso). ### Before you begin > [!CAUTION] > Warning! > > SSO configuration requires access to your organisation's identity provider (IdP) and a working knowledge of SAML 2.0. Incorrect settings can prevent users from signing in to Cintra. > > Only proceed if you are responsible for managing your organisation's identity provider. If you're unsure, contact your IT administrator before making any changes. You will need: - A Google Workspace Super Admin account. - User administrator credentials for Cintra People. - A public web host or cloud storage container (e.g. Amazon S3, Google Cloud Storage, Cloudflare R2, or your company's public web server). ### 1. Open the SSO settings in Cintra People 1. Sign in to Cintra People with your admin credentials. 2. In the side menu, expand **Settings** and select **Company settings**. 3. Scroll down to the **Single Sign-on** section. 4. To set up a new domain, click **Add domain**. To change an existing domain's settings, click its **Edit** icon. ![](https://cdn.document360.io/fc2cda72-4645-4b36-96bf-60439ec11f11/Images/Documentation/image-QW3URAK9.png) Under **Step 1 - Cintra configuration values**, you will find the following information to paste into your IdP configuration: - **Cintra ACS URL**: The Assertion Consumer Service (ACS) URL is the endpoint where your identity provider sends the SAML authentication response after a user successfully signs in. - **Cintra Entity ID**: A unique identifier for Cintra as the service provider (SP) within your IdP. This tells your identity provider which application is requesting authentication. ![](https://cdn.document360.io/fc2cda72-4645-4b36-96bf-60439ec11f11/Images/Documentation/image-Z92BTCCZ.png) Keep this page open. You'll copy these values into Google in Step 4, and come back to complete the rest of the page in Step 7. ### 2. Create the SAML app in Google Workspace 1. Sign in to the [Google Admin Console](https://admin.google.com) as a Super Admin. 2. In the left navigation panel, go to **Apps > Web and mobile apps**. 3. Click the **Add App** dropdown at the top and select **Add custom SAML app**. 4. In **App name**, enter `Cintra People`. You should also upload a logo to help users quickly identify Cintra People. [](https://cdn.document360.io/fc2cda72-4645-4b36-96bf-60439ec11f11/Images/Documentation/cintra_logo.png)cintra_logo1.71 KB[](https://cdn.document360.io/fc2cda72-4645-4b36-96bf-60439ec11f11/Images/Documentation/cintra_logo.png) 5. Click **Continue**. ### 3. Download the Google metadata file 1. On the **Google Identity Provider details** screen, click **Download Metadata** to save the `.xml` file to your computer. 2. Click **Continue**. ### 4. Enter the Cintra People details in Google On the **Service Provider Details** screen, enter the following values: | Field | What to enter | | --- | --- | | **ACS URL** | The **Cintra ACS URL** value from Step 1. You also need to add `https://` at the start of this value. | | **Entity ID** | The **Cintra Entity ID** value from Step 1 | | **Name ID format** | Select **EMAIL** | | **Name ID** | Select **Basic Information > Primary email** | Click **Continue**, then on the **Attribute mapping** page: 1. Click **Add mapping**. 2. Set **Google Directory attribute** to **Basic Information > Primary email**. 3. Set **App attribute** to `email`. 4. Click **Finish**. ### 5. Host the Google metadata file publicly Because Google Workspace does not generate a live URL for its metadata files, the downloaded `.xml` file must be hosted in a publicly accessible web location so Cintra People can retrieve it. 1. Upload the downloaded Google metadata `.xml` file to your public web host or cloud storage container (e.g. Amazon S3, Google Cloud Storage, Cloudflare R2, or your company's public web server). 2. Make sure the file permissions are set to **Public Read** so Cintra People can access it over HTTPS. 3. Copy the direct URL to the file (e.g. `https://yourdomain.com/saml-metadata.xml` or `https://your-bucket.s3.amazonaws.com/saml-metadata.xml`). > [!NOTE] > **Note:** The metadata file only contains Google's public signing certificate and sign-in addresses. It doesn't contain any passwords or secret keys, so it's safe to make public. ### 6. Turn on user access in Google 1. In the Google Admin Console, open the **Cintra People** app you created. 2. Click **User access**. 3. Set access to **ON for everyone**, or select specific organisational units or groups. 4. Click **Save**. > [!NOTE] > **Note:** Changes to user access in Google can take up to 24 hours to take effect. If the test in Step 8 fails straight away, this may be the reason. ### 7. Enter your configuration values in Cintra People Return to the Cintra People **Single Sign-on** settings page and complete **Step 2 - Your configuration values**: ![](https://cdn.document360.io/fc2cda72-4645-4b36-96bf-60439ec11f11/Images/Documentation/image-N481XY78.png) | Field | What to enter | | --- | --- | | **Metadata URL** | Paste the hosted metadata URL from [step 5 above](/docs/setting-up-sso-with-google-workspace#step-5-host-the-google-metadata-file-publicly) (e.g. `https://yourdomain.com/saml-metadata.xml`). This file contains the technical information Cintra People needs to establish a trusted connection with your IdP, including certificates and endpoint details. | | **Email Attribute Name** | Enter `email`. This is the name of the attribute your identity provider uses to pass a user's email address in the SAML assertion. It must match the **App attribute** you set in [step 4 above](/docs/setting-up-sso-with-google-workspace#step-4-enter-the-cintra-people-details-in-google). | | **Email Domain** | Enter your primary organisation domain (e.g. `yourcompany.com`). Cintra People uses this to identify which users should be authenticated via SSO and route them to the correct identity provider at sign-in. | Click **Save Configuration**. ### 8. Test the connection 1. Under **Step 3 - Testing**, click **Test Sign In**. 2. When prompted, sign in with your Google Workspace account. Depending on whether or not the test is successful, follow the Success or Fail steps shown on the screen. ![](https://cdn.document360.io/fc2cda72-4645-4b36-96bf-60439ec11f11/Images/Documentation/image-QUAUVO1N.png) ### 9. Turn on SSO for all users When the test is successful, turn on Single Sign-On to enable it for all users. To do this, click **Enable SSO**, then **Yes** to confirm. The next time any user with a matching domain signs in to Cintra People, they will not be prompted to enter their password. > [!NOTE] > **Note:** Any user whose email domain has not been set up for SSO will continue to sign in using their password. With SSO enabled, clicking **Disable SSO** will require all users to use their passwords when signing in. ### Renewing the Google certificate SAML metadata files rarely change. The certificate inside Google's metadata is valid for 5 years. You will only need to update the hosted file when you renew the SAML signing certificate in Google Workspace. Cintra does not automatically refresh metadata from your Metadata URL, so you will need to update your metadata manually before the existing certificate expires. ### Why isn't SSO working? If your users are unable to sign in after SSO has been configured, check the following: - **Incorrect email attribute name**: the value entered must match exactly what your IdP sends in the SAML assertion. For Google Workspace, this is `email`. - **Wrong ACS URL**: confirm the Cintra ACS URL was copied accurately into your IdP configuration with no trailing spaces or characters. Check that it starts with `https://`. - **Users not assigned to the IdP app**: users must be explicitly assigned to an application before they can authenticate through it. In Google Workspace, check that user access is turned on for the user's organisational unit or group (Step 6). - **Domain mismatch**: the email domain configured in Cintra must match the email suffix of the users trying to sign in. - **Metadata file not accessible**: open the metadata URL in a private browser window to check that it loads without needing to sign in.