[Access Control] Single Sign-On (SSO) Connection Procedure (Google Workspace)

Overview

This procedure describes how to configure single sign-on (SSO) between Access Control and Google Workspace so that Users can log in to Google Workspace through Access Control.

Notes

1. After completing the procedures in this article, login to Google Workspace for the applicable Users will be routed through Access Control.
   Please carefully consider the scope of impact and work schedule before proceeding.
2. Information for an Access Control Admin account (Username and Password) is required.
3. Information for a Google Workspace Tenant super administrator account (Username and Password) is required.
4. Google Workspace accounts with super administrator privileges are Skipped from single sign-on (SSO).
   https://support.google.com/a/answer/6341409?hl=ja (External Link)
5. Before performing this work,make sure that Users with the same Email Address have been created in both Google Workspace and Access Control.
   If Email Addresses do not match, or if a User does not exist in either system, the User will be unable to log in to Google Workspace.
6. If the system does not operate as expected, you may be asked to Contact Us at Google.
7. Even if only some Users use HENNGE One products, you must purchase the same number of licenses as the number of Google Workspace licenses.
   HENNGE One License Policy
8. The content of this article is based on product specifications as of April 2026 and may be changed without notice.

Procedure

Create a new organizational unit in Google Workspace

Perform this procedure if you want to integrate Access Control with SSO for only some Users.
If you want to integrate SSO for all Users, proceed to Configure the connected service in Access Control .

1. Create an organizational unit under the parent organization to register the applicable accounts.
   Add an organizational unit (External Link)
2. Register the accounts to be included in single sign-on (SSO) in the organizational unit added in step 1.
   Move Users to an organizational unit (External Link)

Configure the connected service in Access Control

Perform the following procedure.

[Access Control] Temporary Settings for connected service
※ On-Premise App Download of Metadata in step 6 is not required. Copy and save each item of information.

Create an SSO profile in Google Workspace

1. Access ［Google Admin console］－［Security］－［Authentication］－［SSO with third-party IdP］.
2. Configure the following from ［Third-party SSO profiles］－［Add SAML profile］.
   ※ Use the Values obtained in "Configure the connected service in Access Control."
   • ［SSO profile name］: Any name
   • ［Automatically populate email address］: Select ［Send email address in URL as login_hint parameter］
   • ［IdP entity ID］: Copied IdP Issuer
   • ［Sign-in page URL］: Copied single sign-on URL
   • ［Sign-out page URL］: Copied sign-out URL
   • ［Change password URL］: Copied single sign-on URL
   • ［Upload certificate］: Obtained SAML signing Certificate
3. After clicking ［Submit］, ［Entity ID］ and ［ACS URL］ will be displayed under ［SP details］.
   Make a note of them, as they will be required for entry in Access Control.

Edit Connected Service in Access Control

1. Edit the connected service created in "Configure the connected service in Access Control."
   • ［ACS URL］: The ACS URL copied in step 3 of Create an SSO profile in Google Workspace
   • ［SP Issuer (Audience)］: The entity ID copied in step 3 of Create an SSO profile in Google Workspace
2. Configure access permissions for the connected service created in "Configure the connected service in Access Control."
   Refer to the following procedure to configure access permissions for the created connected service for Users subject to SSO or the Access policy group that contains Users subject to SSO.
   [Access Control] Creating/Editing Access Policy Groups
   ※ Since the default connected service ［Gmail］ will not be used, clear the default ［Gmail］ connected service checkbox from the all-users Access policy group as necessary.

Configure SSO settings in Google Workspace

When integrating SSO for all Users

1. Access ［Google Admin console］－［Security］－［Authentication］－［SSO with third-party IdP］, then click ［Manage SSO profile assignments］－［Get started］.
   ※ If ［Get started］ is not displayed, click ［Manage］.
2. Select the top-level organizational unit, then select the profile created in the “Create an SSO profile in Google Workspace” procedure from the pull-down list under ［Select SSO profile］.
3. Select ［After Google prompts Users for their Username, redirect them to the IdP sign-in page for this profile］, then click ［Submit］.

When configuring SSO integration for only some Users

1. Access ［Google Admin console］－［Security］－［Authentication］－［SSO with third-party IdP］, then click ［Manage SSO profile assignments］－［Get started］.
   ※ If ［Get started］ is not displayed, click ［Manage］.
2. Select the organizational unit created in “Create a new organizational unit in Google Workspace,” then select the profile created in the “Create an SSO profile in Google Workspace” procedure from the pull-down list under ［SSO profile］.
3. Select ［After Google prompts Users for their Username, redirect them to the IdP sign-in page for this profile］, then click ［Submit］.
4. Click ［SSO with third-party IdP］－［Domain-specific service URLs］, select “First prompt Users for their Username on the Google sign-in page,” then click ［Submit］.
   ※ If there are organizational units or groups that do not use SSO, be sure to select this setting.
   If this setting is not configured, Users who do not use SSO may be automatically redirected to Access Control and may be unable to log in.

Confirming the connection

• Confirmation for Users subject to SSO
  Access a Google Workspace service and log in as a User belonging to an organization that uses SSO. Confirm that the Access Control authentication screen is displayed.
  ※ Google Workspace accounts with super administrator privileges are not subject to single sign-on (SSO).
• Confirmation for Users not subject to SSO
  Access a Google Workspace service and log in as a User who does not belong to an organization that uses SSO. Confirm that you can log in without the Access Control authentication screen being displayed.

Reference

• Set up SSO for your organization (External link)

Translation Disclaimer

This article has been automatically translated from the original Japanese version for your convenience.
While we strive to ensure accuracy, we cannot guarantee its reliability or completeness.

In the event of any discrepancies or questions regarding the content, the official Japanese version shall prevail.