Google Workspace
Connect Google Workspace to Fuser with a custom SAML 2.0 app.
Google Workspace connects to Fuser over SAML 2.0 using a custom SAML app in the Google Admin console.
Set up
Create the SAML app
In the Google Admin console, go to Apps → Web and mobile apps → Add app → Add custom SAML app.
Give it a name (for example, Fuser) and continue.
Collect Google's details
The Google Identity Provider details screen gives you everything Fuser needs:
| Fuser field | Google calls it |
|---|---|
| Sign-on URL | SSO URL |
| Issuer | Entity ID |
| Signing certificate | Certificate — use Download certificate to get the PEM file |
Open the downloaded certificate in a text editor and copy it whole, including the -----BEGIN CERTIFICATE----- and -----END CERTIFICATE----- lines.
Register the provider in Fuser
In Fuser, open Settings → Workspace → Security → Single Sign-On, choose SAML, enter your email domain and the three values above, and click Add provider.
Return to the Google setup wizard's Service provider details screen and fill it in from Fuser's provider card:
| Google field | Paste from Fuser's provider card |
|---|---|
| ACS URL | ACS URL |
| Entity ID | Entity ID / Audience URI |
Leave Start URL empty and leave Signed response unchecked. Set Name ID format to EMAIL and Name ID to Basic Information > Primary email.
Fuser does not support IdP-initiated sign-in, so the Fuser tile in the Google app launcher will not work — members sign in from Fuser.
Map the attributes
On the next screen, Attribute mapping, add three mappings. The App attribute name on the right is what Fuser reads, and it is matched exactly:
| Google Directory attribute | App attribute |
|---|---|
| Primary email | email |
| First name | givenName |
| Last name | surname |
Only email is required, but without the two name attributes members show up under their email address instead of their name.
Click Finish.
Turn on user access
Open the app you just created and click User access. Google creates every SAML app OFF for everyone — until you change this, nobody can sign in.
Set it to ON for everyone, or turn it on for the specific organizational units and groups that should have access, and save.
Give the access change time to propagate
Until access is on, Google rejects the sign-in with app_not_enabled_for_user. After you switch it on the change usually takes effect within minutes, but Google allows up to 24 hours, so wait and retry before changing anything else.
Verify the domain and test
Add the TXT record shown on Fuser's provider card, wait for the card to flip to Verified — SSO active, then sign in from Fuser with a Workspace address on that domain.
See Verifying the domain with DNS for the details.
Rotating the signing certificate
Google's SAML certificates belong to your Workspace account, not to an individual app: one default certificate serves every SAML app, with room for a second while you roll over. Fuser stores the copy you pasted at registration and never fetches updates.
So when you rotate the account certificate, every Fuser provider using it must be removed and re-added with the new value, or sign-in fails on signature validation.
Removing and re-adding mints new endpoint URLs and a new DNS record, so plan on re-pasting them in your IdP and verifying the domain again — see Provider settings are final.