.svg)
Google Workspace SAML2 SSO
With the Google Workspace SAML2 SSO integration, your employees log in to Flexopus using their familiar Google credentials—securely, easily, and without extra passwords. User management remains centralized in Google Workspace.
What is the Google Workspace SAML2 SSO integration?
The Google Workspace SAML2 SSO integration connects Flexopus to your Google Workspace directory using the standardized SAML2 (Security Assertion Markup Language) protocol. Google Workspace acts as the Identity Provider (IdP), verifying user identities and securely transmitting this information to Flexopus.
During the login process, the user is redirected from Flexopus to Google, signs in with their existing Google credentials, and is then automatically logged into Flexopus. Flexopus does not store any passwords.
Additionally, the SAML2 connection allows profile attributes such as first name, last name, email address, department, and job title to be automatically transferred and synchronized in Flexopus.
What is the purpose of the integration?
The integration simplifies access to Flexopus for the entire organization and significantly reduces administrative effort. Typical use cases include:
- Centralized login management: Employees use their Google credentials for Flexopus—no separate account required.
- Automatic user provisioning: New users are automatically created in Flexopus upon their first SSO login, without manual admin setup.
- Access control via Google Workspace: Administrators define which users or organizational units have access to Flexopus in the Google Admin Console.
- Profile synchronization: Master data like name, department, and job title are pulled directly from Google Workspace and kept up to date.
- Enhanced security: Centralized authentication via Google eliminates the risk of weak or reused passwords in Flexopus.
How easy is the integration?
Setting up the Google Workspace SAML2 SSO integration is done entirely through the Google Admin Console and Flexopus administration settings. No programming skills are required.
Essentially, a custom SAML app is created in Google Workspace, and a metadata file is downloaded and uploaded to Flexopus. Afterward, attributes are mapped and access rights are configured. Following a quick test, the integration is ready for use.
A complete step-by-step guide for setup can be found in our Help Center.
What are the benefits of the integration?
- Easy login for everyone: Employees sign in with their familiar Google credentials—no extra password for Flexopus.
- Automatic user provisioning: New users are automatically created in Flexopus upon their first login—no manual effort for admins.
- Centralized access control: Access to Flexopus is managed directly in the Google Admin Console.
- Profile synchronization: Name, email, department, and job title are automatically pulled from Google Workspace.
- Higher security: No additional passwords, no password management in Flexopus—authentication runs entirely through Google.
- SSO enforcement: Administrators can disable email/password login in Flexopus to make SSO the only sign-in method.
- Included for free: The SAML2 SSO integration is part of Flexopus and incurs no additional license costs.
Additional integrations
.svg)
Questions and answers
Are passwords transmitted to Flexopus during SAML2 login?
No. With SAML2 login, the user enters their password exclusively at Google. Flexopus only receives an encrypted confirmation of identity – no access credentials. Flexopus does not store any passwords.
What happens if a user's email address changes?
Since the email address is used as the unique identifier (UPN), a change will result in a new user profile being created in Flexopus. The old profile remains. We recommend contacting Flexopus support when an email address changes to arrange for the profiles to be merged.
Can I determine which employees have access to Flexopus?
Yes. In the Google Admin Console, administrators can precisely control which users or organizational units have access to the Flexopus app. Additionally, a domain whitelist can be configured in Flexopus to allow only specific email domains.
Are new employees automatically created in Flexopus?
Yes, provided the corresponding setting is active in Flexopus. Upon the first successful SSO login, a user profile is automatically created in Flexopus. This option is enabled by default and can be disabled if required.
Can I disable email and password login once SSO is set up?
Yes. Email/password login can be completely disabled in the Flexopus authentication settings. For emergencies, an alternative admin access remains available via a separate login URL.