Note: Each SAML app supports only one ACS URL, therefore, a unique app must be created for each MVP One site that requires Single Sign-On 

1. In the Google Workspace Admin app, go to Apps > Web and mobile apps 

2. Select Add app > Add custom SAML app 

3. Select an appropriate name for the app 

4. Copy the SSO URL and save for use in step 9.  Select to download the certificate. 

5. The next page requires an Assertion Consumer Service (ACS) URL and Entity ID.   

• To get the ACS URL, log into MVP One and go to Administration > Settings > Company.  In the Authentication section, set the Single Sign On Authentication Type to SAML if not already set.  Copy and use the Assertion Consumer Service URL from the bottom of the page 

• Use a globally unique name for Entity ID.  Make a note of this Entity ID for later use. 

• Select EMAIL as the Name ID format 

• Leave Name ID as Basic Information > Primary email 

6. On the next page, create an attribute mapping by clicking Add Mapping. 

• Select Primary email as the Google Directory attribute and type in EmailAddress as the app attribute. 

7. Click Finish 

8. After completing app creation, open the User Access menu for the app and grant access as needed.  Any users or groups who will be using Single Sign-On will need access to this app. 

9. Log into MVP One and navigate to Administration > Settings > Company.  Populate the SAML fields as follows: 

• Provider Endpoint URL: Paste the SSO URL copied during app creation 

• Issuer ID: Use the Entity ID entered during step 5 

• Username Claim Assertion Attribute: EmailAddress 

• Drag and drop the downloaded certificate into the box to upload 

10. Click Save 

Testing 

• Ensure users who will be using Single Sign-On have a username in MVP One matching their email address and an authentication type of SAML Authentication 

• Click the Single Sign-On Login button at the MVP One login screen.  The user should be logged in or be prompted to authenticate to Google and subsequently log in. 

• Opening the created SAML app directly from the Google app menu will take the user to the MVP One site’s login page but will not directly log them in as Identity Provider initiated sign-in is not currently supported.