Using Google

Setting Up Single Sign-On (SSO) with Google Workspace for emSigner

Overview

emSigner supports Single Sign-On (SSO) using Google Workspace to allow users to authenticate using their corporate Google credentials. This enables centralized identity management, improves security, and simplifies access by eliminating separate login credentials for emSigner.

---

Prerequisites

Before configuring Google Workspace SSO for emSigner, ensure the following:

• An active Google Workspace domain

• Google Workspace Admin privileges

• A verified email domain in Google Workspace that matches emSigner user accounts

• SSO enabled for your organization in emSigner by the emSigner support or onboarding team

---

Supported SSO Protocol

emSigner supports SAML 2.0–based SSO with Google Workspace.

---

Configuration Steps

Step 1: Create a SAML App in Google Workspace

1. Sign in to the Google Admin Console.

2. Navigate to Apps → Web and mobile apps.

3. Click Add app → Add custom SAML app.

4. Enter an application name (for example, emSigner SSO) and proceed.

---

Step 2: Download Google Identity Provider (IdP) Metadata

1. On the Google IdP Information page, download the following:

   • IdP Metadata XML, or

   • SSO URL, Entity ID, and Certificate

2. Share these details with the emSigner support or onboarding team.

---

Step 3: Configure Service Provider Details

1. In the Service Provider Details section, enter the values provided by emSigner:

   • ACS URL (Assertion Consumer Service URL)

   • Entity ID

   • Start URL (if applicable)

These values are environment-specific and depend on your emSigner data residency zone.

---

Step 4: Configure Attribute Mapping

1. In Attribute Mapping, configure the following:

   • Primary email → email

2. Ensure the email attribute sent by Google matches the primary identifier configured in emSigner.

---

Step 5: Assign Users or Groups

1. Enable the SAML app for:

   • All users, or

   • Specific organizational units or groups (recommended)

2. Only enabled users will be able to log in to emSigner using Google SSO.

---

emSigner Configuration

Once Google Workspace configuration is complete:

• emSigner validates the IdP metadata.

• SSO is enabled for your organization and mapped to your domain.

• Optional policies such as mandatory SSO or 2-Factor Authentication (2FA) enforcement may be applied based on organizational requirements.

---

User Login Experience

After Google Workspace SSO is enabled:

1. The user enters their email address on the emSigner login page.

2. emSigner detects Google SSO configuration for the domain.

3. The user is redirected to the Google login page.

4. Upon successful authentication, the user is logged in to emSigner.

---

Security & Compliance Notes

• emSigner does not store Google credentials.

• Authentication is performed entirely by Google Workspace.

• Google-enforced security policies such as 2-Step Verification, context-aware access, and device policies continue to apply.

• All authentication events are recorded in emSigner audit logs.

---

Troubleshooting

User is not redirected to Google login

• Verify that SSO is enabled for the organization in emSigner.

• Ensure that the user’s email domain matches the configured Google Workspace domain.

Authentication succeeds but login fails

• Confirm that the email attribute mapping is correct.

• Ensure that the user is enabled for the SAML app in Google Workspace.

Access denied

• Check Google Workspace security policies or 2-Step Verification settings.

---

Need Assistance?

For environment-specific URLs, metadata validation, or enabling Google Workspace SSO for your tenant, please contact emSigner Support or raise a support ticket through the Support Portal.