An initial step in connecting Google Workspace with TimeTac is creating and configuring Google SAML application within your Google Workspace account, which will be ‘in charge’ of communicating with our TimeTac system.
Prerequisites
To set up SSO for an application that you will add to your Google Workspace account, you need:
- A Google Workspace account with an active Super Administrator user
Configure SAML-based Single Sign-On
- Sign in to your Google Workspace Admin Console:
- Open the Main Menu and click on Apps → Web- and mobile Apps
- Click on add App and choose ‘add custom SAML-App’
- In the first step, you are asked to define a name and description for the app.
- In the next step, your IdP Metadata is provided. This Information has to be saved for later use in the TimeTac SSO configuration.
- SSO-URL: required for the fields ‘Login-Url’ and ‘Logout-Url’ in the SSO configuration in your TimeTac account
- Entity ID: will be needed to set up SSO in your TimeTac account
- Certificate: copy the string —-BEGIN CERTIFICATE—- and —-END CERTIFICATE—-. Make sure there are no line breaks in that string. That string will be used in the SSO configuration in your Timetac account.
- Define Service Provider Details by defining the
Assertion Consumer Service (ACS) and the Entity ID:- Entity ID: Please use https://go.timetac.com/{accountName}/modules/saml/consume.php for that field. {accountName} has to be replaced with your TimeTac company account name
- ACS URL: use https://go.timetac.com/{accountName}/modules/saml/consume.php. {accountName} has to be replaced with your TimeTac company account name
- Signed Response must NOT be checked
- Ensure that Name ID Format field is set to “EMAIL”
- Ensure that Name ID is set to ‘Basic Information > Primary email’
- After the last step from a previous part of the tutorial, you are redirected to your new app
- By default, the newly created application is “OFF for everyone”, which means that it will not work for our users. To enable it, change it to ON for everyone
