Skip to main content

How to: Set up Single Sign-On (Google)

Updated

This guide explains how to set up Single Sign-On (SSO) on the Karat platform using the SAML 2.0-compliant identity provider (IdP) Google. Follow the steps below to configure your IdP, enable SSO in Karat, and manage user provisioning and permissions.

Prerequisites

Before configuring SSO for your organization, ensure the following prerequisites are met:

  • You have an admin user account on the Karat platform.
  • You have access to a SAML 2.0-compliant identity provider IdP available with Karat.

User provisioning and permissions

The Karat platform supports Just-In-Time (JIT) provisioning of users from the IdP. When a new user authenticates with SAML for the first time, an account is automatically created for them. By default, they are assigned the 'Team Member' user type with the standard role access permissions for their group. See How To: Manage Karat Users (RBAC) to learn about user types and role access permissions.

If the user already has an account in Karat, their existing permissions remain unchanged when logging in via SSO.

If a client wants to set a new team member's user type or role access permissions, they can either wait until the new team member has logged in with SSO and their user has been JIT provisioned, or they can create a user account with the desired permissions manually in Karat before adding the user in their IdP.

Warning: Karat does not support Single Logout (SLO) or user deprovisioning via the IdP. Users signed out of the IdP will remain logged into Karat until their session has been idle for 8 hours. If a user is removed from the IdP, they will be unable to log in to Karat if the organization's SAML policy is set to "Required". To fully disable a user, see How To: Manage Karat Users (RBAC) guide.

Karat includes a setting for its 'Organization' called "SAML New User Type." This determines the default user type assigned to new accounts created via SSO. By default, the setting is configured to "Team Member," but it can be adjusted to "Admin," "Limited Team Member," or "External Team Member" based on your preferences.

We recommend utilizing this setting to ensure newly created users do not automatically gain access to sensitive areas of the Karat platform, providing an additional layer of control and security. To modify this setting, contact the Karat support team.

Karat doesn't support System for Cross-domain Identity Management (SCIM).

Note:  If your organization has enabled Single Sign-On (SSO) on the Karat platform using SAML 2.0-compliant identity providers (IdPs), avoid setting up Two-Factor Authentication (2FA). Users authenticated through SSO will not require 2FA.

Setting up SSO

To set up SSO, configure your identity provider (IdP) using the details below. Terminology may vary across IdPs—refer to IdP-specific instructions in this guide for additional help.

Enter the following configuration details into your IdP:

  • ACS URL (replace client-name with your subdomain): https://client-name.karat.io/users/auth/saml/callback
  • Entity ID: Karat
  • Metadata document (replace client-name with your subdomain): https://client-name.karat.io/users/auth/saml/metadata
  • The email attribute is required. 
  • Additionally, you must provide either full_name or both first_name and last_name. If full_name is provided, it will take precedence. Some IdPs only support first_name and last_name.
  • Attribute mappings:

<md:RequestedAttribute FriendlyName="Email address" Name="email" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic"/>

<md:RequestedAttribute FriendlyName="Full name" Name="name" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic"/>

<md:RequestedAttribute FriendlyName="Given name" Name="first_name" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic"/>

<md:RequestedAttribute FriendlyName="Family name" Name="last_name" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic"/>

After the identity provider is set up, email the following details to a Karat internal user to enter into Central, Karat's platform:

  • IdP URL
  • IdP certificate in PEM format

Set up your own custom SAML app

  1. Sign to the Admin console Home page.
  2. Go to Apps.
  3. Click Web and mobile apps.

  1. Click Add App.
  2. Click Add custom SAML app.

  1. On the App Details page:
    1. Enter the name of the custom app.
    2. Optional: Upload an app icon. The app icon appears on the Web and mobile apps list, on the app settings page, and in the app launcher. If you don't upload an icon, an icon is created using the first two letters of the app name.

  1. Click Continue.
  2. On the Google Identity Provider details page, get the setup information needed by the service provider using one of these options:
    • Download the IDP metadata.
    • Copy the SSO URL and Entity ID.
    • Download the Certificate (or SHA-256 fingerprint, if needed).
    • Optional. In a separate browser tab or window, sign in to your service provider and enter the information you copied into the appropriate SSO configuration page, then return to the Admin console.

  1. Click Continue.
  2. In the Service Provider Details window, enter an ACS URL, Entity ID, and Start URL (if needed) for your custom app. These values are all provided by the service provider. 

Note: The ACS URL has to start with https://

  1. Optional. On the Attribute mapping page, click Add another mapping to map additional attributes. You can define a maximum of 1500 attributes over all apps. Because each app has one default attribute, the total amount includes the default attribute plus any custom attributes you add.
    • Under App attributes, enter the corresponding attribute for your custom SAML app.

  1. Optional. If you want to send a user’s group membership information in the SAML response, enter the group names that are relevant for this app in the Group membership field.
    • Under App attribute, enter the service provider’s corresponding groups attribute name. Regardless of how many group names you enter, the SAML response will only include groups that a user is a member of (directly or indirectly. For more information, see About group membership mapping.

  1. Click Finish.

Configure SAML

  1. Go the Admin console Home page.
  2. Go to Apps.
  3. Click Web and mobile apps.
  4. Select your SAML app.
  5. Click User access.

  1. To turn on or off a service for everyone in your organization, click On for everyone or Off for everyone, and then click Save.

  1. Optional. To turn a service on or off for an organizational unit:
    1. At the left, select the organizational unit.
    2. To change the Service status, select On or Off.
    3. Choose one:
      • If the Service status is set to Inherited and you want to keep the updated setting, even if the parent setting changes, click Override.
      • If the Service status is set to Overridden, either click Inherit to revert to the same setting as its parent, or click Save to keep the new setting, even if the parent setting changes.
      • For more information, see organizational structure.
  2. To turn on a service for a set of users across or within organizational units, select an access group. For more details, see turn on a service for a group.
  3. Make sure that the email addresses your users use to sign in to the SAML app match the email addresses they use to sign in to your Google domain.

Verify that SSO is Working with your App

IDP Initiated

  1. Go the Admin console Home page.
  2. Go to Apps.
  3. Click Web and mobile apps.
  4. Select your custom SAML app. 
  5. At the top left, click Test SAML login. Your app should open in a separate tab. If it doesn’t, use the information in the resulting SAML error messages to update your IdP and SP settings as needed, then retest SAML login.

Was this article helpful?

0 out of 0 found this helpful
Return to top