Skip to main content

Google Workspace SSO (SAML)

This guide explains how to configure Single Sign-On (SSO) between Orah and Google Workspace using SAML, allowing users to sign in to Orah using their Google account credentials.

šŸ§© Overview

Google SSO allows schools to authenticate users through Google Workspace instead of separate Orah passwords.

Once configured:

  • Users can log in to Orah using their Google account

  • Password management stays centralized in Google Workspace

  • Schools can simplify onboarding and account management

  • Access can be controlled through Google Organizational Units (OUs)

This integration uses SAML (Security Assertion Markup Language).

šŸ”§ Before you begin

Make sure you have:

  • Administrator access to the Google Admin Console

  • Access to Orah Admin Console

  • Permission to manage authentication settings in both platforms

šŸ§­ Step 1: Create a SAML SSO profile in Orah

  1. Log in to Orah as an administrator

  2. Navigate to Admin Console ā†’ Authentication

  3. Click Create New Profile

  4. Select SAML in the Type dropdown
    ā€‹

  5. Select which users should use this SSO profile

  6. Copy the following values:

    • SP Entity ID

    • SP Login URL

  7. Keep this page open for later steps.
    āš ļø Youā€™ll need these values when configuring Google Workspace.

šŸ§­ Step 2: Configure the SAML app in Google Workspace

  1. Log in to the Google Admin Console

  2. Navigate to:
    ā€‹Apps ā†’ Web and mobile apps

  3. Click:
    ā€‹Add app ā†’ Add custom SAML app
    ā€‹

  4. Enter:

    • App name (for example: Orah)

    • Optional description

    • Optional Orah logo
      ā€‹

  5. On the Google Identity Provider details page, copy:

    • SSO URL

    • Certificate (download or copy the certificate)

āš ļø Youā€™ll use these values in Orah later.

šŸ§­ Step 3: Configure Service Provider details in Google

On the Service provider details page:

Google Field

Orah Value

Entity ID

SP Entity ID

ACS URL

SP Login URL

  1. Enable:

    • Signed response

  2. Set:

    • Name ID format = Persistent

  3. Complete the setup wizard.

šŸ§­ Step 4: Enable user access in Google

By default, the SAML app is turned OFF for users.

  1. Open the newly created Orah SAML app

  2. Turn access ON

  3. Apply access to:

    • specific users, or

    • Organizational Units (OUs)

āš ļø Users will not be able to log in until access is enabled.

šŸ§­ Step 5: Complete the setup in Orah

  1. Return to the Orah Authentication page

  2. Paste the Google SSO URL into:
    ā€‹IdP Login URL

  3. Paste the Google Certificate into:
    ā€‹IdP Public Certificate
    ā€‹

  4. Select the applicable user types

  5. Click Save
    ā€‹

šŸ§­ Step 6: Test the SSO connection

  1. In Orah, click Test Run next to the Authentication profile

  2. Youā€™ll be redirected to the Google login page

  3. Sign in with your Google Workspace account

  4. After authentication, youā€™ll be redirected back to Orah

If configured correctly, youā€™ll see a success message confirming the connection works.
ā€‹

šŸ’” Important note about Google Name ID support

Orah supports Identity Provider initiated login, which can automatically update a userā€™s login email address if it changes in the Identity Provider.

This requires the Identity Provider to send a:

  • unique

  • persistent

  • stable Name ID

āš ļø From current testing, Google Workspace SAML does not reliably support this behavior.

As a result:

  • if a userā€™s email address changes in Google,

  • administrators may need to manually update the userā€™s login email in Orah.

ā“ FAQs

Can users still log in with Orah passwords?

That depends on your Authentication profile configuration and enforcement settings.

Why canā€™t users access the Orah app in Google?

The SAML app may still be OFF for their Organizational Unit or user group.

What happens if the Google certificate expires?

Users may be unable to authenticate. Update the certificate in Orah after rotating it in Google.

Can I limit SSO to certain users?

Yes. You can:

  • assign the SSO profile to specific user types in Orah

  • restrict access through Google Organizational Units

šŸ”§ Troubleshooting

Authentication fails

  • Verify the SSO URL is correct

  • Confirm the certificate was copied fully

  • Ensure there are no extra spaces or missing characters

Redirect / ACS URL mismatch

Ensure the ACS URL in Google exactly matches the:
ā€‹Orah SP Login URL

Users receive ā€œnot authorizedā€ errors

  • Confirm the Google SAML app is enabled

  • Check the userā€™s Organizational Unit access
    ā€‹

Error 403 app_not_configured_for_user on mobile

If a user sees a 403 app_not_configured_for_user error when signing in to the Orah staff app on a phone or tablet, the cause is usually not the Organizational Unit or the app assignment.

The most common cause is that the device is signed in to a personal Google account rather than the school Google Workspace account. The Orah SAML app exists only in the school's Workspace, so a personal account is refused.

Diagnostic: if the same user can log in to Orah successfully in a web browser but the mobile app fails, the device account is almost certainly the problem.

Fix:

  1. Open Safari on the device.

  2. Go to google.com.

  3. Tap the account avatar in the top right.

  4. Tap Add account and sign in with the school Google Workspace account.

  5. Reopen the Orah staff app and choose the school account from the account selector.

If the error persists after the school account is added and selected, check the Organizational Unit access above, then contact Orah support.

Changes are not working immediately

Google Workspace changes can take a few minutes to propagate.

Wait a few minutes and test again.

šŸ”— Additional Resources

Related Articles
Did this answer your question?