# Single sign-on: Google Workspace

Source: https://parasend.com/docs/sso/google

Your staff sign in to Parasend with their Google work account. Setting it up takes about 15 minutes, but Google can
take up to 24 hours to give people access to a new app.

Google Workspace has no provisioning (SCIM) for custom apps. So Google can't tell Parasend when someone leaves. Read
"When someone leaves" below before you rely on it.

You need to be an admin in Parasend, on Plan 1–3 or Enterprise. In Google, you need to be a super admin.

## Before you start

- **Verify your e-mail domain** in Parasend under **Team → Domains**. Single sign-on can be turned on only once a
  domain is verified. When staff sign in with SSO and enter their work e-mail, the domain tells Parasend where to
  send them.
- **Open the Set up dialog** in Parasend under **Sign-in & SSO → Set up**, and choose **Google Workspace**. It shows
  the addresses to paste into Google, each with a copy button. Keep it open next to this guide.

## 1. Create the app in Google

1. In the Google Admin console, go to **Apps → Web and mobile apps → Add app → Add custom SAML app**. Name it, for
   example "Parasend", and continue.
2. On **Google Identity Provider details**, choose **Download metadata**. You get an XML file. Continue.
3. On **Service provider details**, paste these from Parasend's Set up dialog:
   - **ACS URL**;
   - **Entity ID**;
   - **Start URL**.
4. On the same page, set **Name ID format** to **EMAIL** and **Name ID** to **Basic Information → Primary email**.
   Continue.
5. Under **Attribute mapping**, you may map First name to `firstName` and Last name to `lastName`. Parasend only
   shows them. Finish.
6. Open the app's **User access** and turn it on for everyone, or for the organisational units or groups who should
   use Parasend.
7. In Parasend's dialog, paste the whole content of the XML file under step 3 and choose **Register provider**.

## 2. Test, then turn on

1. In Parasend, choose **Test with your own account**. You sign in at Google and come back to Parasend. If Google says
   you don't have access to the app, wait: access can take up to 24 hours.
2. Parasend shows whom Google signed in. If it is you, choose **Yes, this is me**. That Google account is then linked
   to your electronic ID.
3. Choose **Turn on** and confirm with your electronic ID.

From then on, staff choose **Use Microsoft, Okta, Google or SAML?** on Parasend's sign-in page and enter their
work e-mail, or open Parasend from the Google apps
menu. The first time, each person confirms who they are once with their electronic ID. After that, their Google
account is enough.

## How Google identifies people

Google tells Parasend only the person's primary e-mail address, and an address can later be given to someone else,
for example to the next person in the same job. So that a newcomer never gets into Parasend as the person who had the
address before:

- **Links last 90 days.** After that, the person confirms with their electronic ID again at their next SSO sign-in.
- **Removal ends the link.** When you remove someone from your team in Parasend, their link ends at once. Anyone who
  later gets the address must confirm with their own electronic ID.

## When someone leaves

Because Google can't tell Parasend, do these:

1. **Require SSO** (below). Then a person you suspend or delete in Google can't get into your Parasend account,
   because they can't sign in to Google.
2. **Remove them from the team** in Parasend: on the **Team** page, open the person and choose **Remove from the
   team**. Their deliveries and evidence stay.
3. **Roll the API keys** they created, on the **API keys** page.

## Require SSO

- **What it does:** when SSO is required, members get into your Parasend account only through Google.
- **If Google fails:** the owner and up to two admins you name can still sign in with an electronic ID.
- **Before you turn it on:** Parasend names the members who have never signed in through Google. Make sure Google
  gives them access.
- **API keys** keep working.

To turn it on, sign in with SSO, choose **Require SSO**, and confirm with your electronic ID.

## Certificates

- **Validity:** Google's SAML certificate is valid for five years.
- **Warnings:** Parasend e-mails your owner and admins 30, 14 and 7 days before it expires.
- **To rotate:** Parasend can't read Google's metadata by itself, because it was pasted. Switch the app to the new
  certificate in Google and download the metadata again. Then, in Parasend, choose **Replace metadata** on the
  connection and paste it. Sign-ins fail between these two steps, so do them together.

## If something goes wrong

- **Google says you don't have access:** check **User access** for the app, then wait. Changes can take up to 24 hours.
- **Parasend says the test failed:** the page explains why and gives a reason code. Check that the Name ID is the
  primary e-mail.
- **Locked out while SSO is required:** the owner and the admins you named sign in with their electronic ID on the
  usual sign-in page, and can stop requiring SSO.