ParasendDocs
Sign in Start free

Single sign-on: Google Workspace

Your staff sign in to Parasend with their Google work account. Setting it up takes about 15 minutes, but Google can take up to 24 hours to give people access to a new app.

Google Workspace has no provisioning (SCIM) for custom apps. So Google can't tell Parasend when someone leaves. Read "When someone leaves" below before you rely on it.

You need to be an admin in Parasend, on Plan 1–3 or Enterprise. In Google, you need to be a super admin.

Before you start

  • Verify your e-mail domain in Parasend under Team → Domains. Single sign-on can be turned on only once a

    domain is verified. When staff sign in with SSO and enter their work e-mail, the domain tells Parasend where to send them.

  • Open the Set up dialog in Parasend under Sign-in & SSO → Set up, and choose Google Workspace. It shows

    the addresses to paste into Google, each with a copy button. Keep it open next to this guide.

1. Create the app in Google

  1. In the Google Admin console, go to Apps → Web and mobile apps → Add app → Add custom SAML app. Name it, for

    example "Parasend", and continue.

  2. On Google Identity Provider details, choose Download metadata. You get an XML file. Continue.
  3. On Service provider details, paste these from Parasend's Set up dialog:
    • ACS URL;
    • Entity ID;
    • Start URL.
  4. On the same page, set Name ID format to EMAIL and Name ID to Basic Information → Primary email.

    Continue.

  5. Under Attribute mapping, you may map First name to firstName and Last name to lastName. Parasend only

    shows them. Finish.

  6. Open the app's User access and turn it on for everyone, or for the organisational units or groups who should

    use Parasend.

  7. In Parasend's dialog, paste the whole content of the XML file under step 3 and choose Register provider.

2. Test, then turn on

  1. In Parasend, choose Test with your own account. You sign in at Google and come back to Parasend. If Google says

    you don't have access to the app, wait: access can take up to 24 hours.

  2. Parasend shows whom Google signed in. If it is you, choose Yes, this is me. That Google account is then linked

    to your electronic ID.

  3. Choose Turn on and confirm with your electronic ID.

From then on, staff choose Use Microsoft, Okta, Google or SAML? on Parasend's sign-in page and enter their work e-mail, or open Parasend from the Google apps menu. The first time, each person confirms who they are once with their electronic ID. After that, their Google account is enough.

How Google identifies people

Google tells Parasend only the person's primary e-mail address, and an address can later be given to someone else, for example to the next person in the same job. So that a newcomer never gets into Parasend as the person who had the address before:

  • Links last 90 days. After that, the person confirms with their electronic ID again at their next SSO sign-in.
  • Removal ends the link. When you remove someone from your team in Parasend, their link ends at once. Anyone who

    later gets the address must confirm with their own electronic ID.

When someone leaves

Because Google can't tell Parasend, do these:

  1. Require SSO (below). Then a person you suspend or delete in Google can't get into your Parasend account,

    because they can't sign in to Google.

  2. Remove them from the team in Parasend: on the Team page, open the person and choose **Remove from the

    team**. Their deliveries and evidence stay.

  3. Roll the API keys they created, on the API keys page.

Require SSO

  • What it does: when SSO is required, members get into your Parasend account only through Google.
  • If Google fails: the owner and up to two admins you name can still sign in with an electronic ID.
  • Before you turn it on: Parasend names the members who have never signed in through Google. Make sure Google

    gives them access.

  • API keys keep working.

To turn it on, sign in with SSO, choose Require SSO, and confirm with your electronic ID.

Certificates

  • Validity: Google's SAML certificate is valid for five years.
  • Warnings: Parasend e-mails your owner and admins 30, 14 and 7 days before it expires.
  • To rotate: Parasend can't read Google's metadata by itself, because it was pasted. Switch the app to the new

    certificate in Google and download the metadata again. Then, in Parasend, choose Replace metadata on the connection and paste it. Sign-ins fail between these two steps, so do them together.

If something goes wrong

  • Google says you don't have access: check User access for the app, then wait. Changes can take up to 24 hours.
  • Parasend says the test failed: the page explains why and gives a reason code. Check that the Name ID is the

    primary e-mail.

  • Locked out while SSO is required: the owner and the admins you named sign in with their electronic ID on the

    usual sign-in page, and can stop requiring SSO.