Single Sign-On with Google

Step 1: Open the Single Sign-On Settings

1. In the Platform sidebar, click on your user, then click Organization settings.
2. Under Organization, in the Users & access group, click Single sign-on. The values that CloudQuery gives to your identity provider use the domain you host CloudQuery Platform on, such as https://cloudquery.example.com:

Step 2: Create a SAML app in Google Admin

1. In a new tab, open https://admin.google.com/
2. Click Apps → Web and mobile apps → Add app → Add custom SAML app

Step 3: Complete App Details

1. In the App Name field, enter a name to identify your application with. CloudQuery is a good choice in most cases.
2. (Optional) Enter a description
3. (Optional) Provide an App icon for your users. You can use this icon: (Right-click on the image → Save Image As… → Save to your drive. Then upload it in the Google interface.)
4. Click Continue

Step 4: Download & Upload Metadata

1. On the next page, click Download Metadata:

This will download a GoogleIDPMetadata.xml file onto your drive. Click Continue.

2. On the CloudQuery single sign-on settings page, under Map information from Identity Provider, keep Metadata file selected and click Upload metadata file:

Step 5: Enter ACS URL and Entity ID

Back in the Google Admin interface, enter the value for ACS URL and Entity ID. Copy both values from Map information in Identity Provider on the CloudQuery single sign-on settings page: Single sign-on URL is the ACS URL, and Audience URI (SP Entity ID) is the Entity ID:

Copy these values into the highlighted fields:

When done, click Continue on the Google page.

Step 6: Set Attribute Mappings

Next, enter some basic attribute mapping information:

1. First name → first_name
2. Last name → last_name
3. Primary email → email

Step 7: Configure Group Membership

On the same screen, configure group membership so that CloudQuery Platform can assign roles based on your Google Workspace groups.

1. In the Group membership section of the Google SAML app, add the groups you want to map to CloudQuery Platform roles. Set the App attribute to the name you want to use as the group claim (e.g., groups).

2. In the CloudQuery single sign-on settings, under Role mapping, set the Group attribute field to the same value as the App attribute you configured in Google (e.g., groups). Then click Add new group, enter the Google group in Group name, and pick the CloudQuery roles for it.

3. Click Continue in the Google UI.

You can map multiple groups to different roles in CloudQuery Platform. For the full configuration, including default roles for users not in any group and multiple group-to-role mappings, see Map Groups to User Roles.

Step 8: Enable User Access

Now, click on the User access section.

Select ON for everyone. Then click SAVE.

Step 9: Save and Test

1. On the CloudQuery single sign-on settings page, turn on Enable single sign-on in the Single sign-on status card at the top of the page:

2. The switch is part of the form, so nothing is stored until you submit it. The button at the bottom of the page now reads Save and enable. Click it to save the configuration and turn single sign-on on:

On the Google Admin page, click TEST SAML LOGIN.

If everything is set up correctly, you should now be logged into CloudQuery Platform with your Google account.

Next Steps

• Map Groups to Roles - Map Google groups to platform roles
• Certificate Rollover - Manage certificate updates
• User Management - Manage users and roles