Single Sign-On to Salto with Google Workspace

Note: SAML integration is available for enterprise customers (see salto.io/pricing (https://www.salto.io/pricing). To begin setup, contact support@salto.io.

- Identity provider (IdP)-initiated SSO - sign in to Salto by clicking the Salto app in your Google Apps launcher

- Service provider (SP)-initiated SSO - sign in by entering your email at https://app.salto.io

Contact support@salto.io to request SAML setup. Salto will provide you with a connection name - a unique identifier for your organization's connection (typically your domain with dots replaced by hyphens, e.g. acme.com becomes acme-com). You will use this connection name in the steps below, wherever CONNECTION_NAME appears.

Step 1: Create a custom SAML app in Google Workspace

1. Sign in to the Google Admin Console at https://admin.google.com

2. Go to Apps > Web and mobile apps

3. Click Add app > Add custom SAML app

4. Enter a name for the app (e.g. "Salto") and optionally upload a logo (https://salto-static.com/images/small-salto-logo.png), then click Continue

Step 2: Copy your Google IdP information

On the Google Identity Provider details screen:

1. Copy the SSO URL

2. Download the Certificate

3. Keep both handy - you will send them to Salto (see "What to Send to Salto" below)

4. Click Continue

Step 3: Fill in the Service Provider details

Enter the following, replacing CONNECTION_NAME with the connection name provided by Salto:

- ACS URL: https://auth.salto.io/login/callback?connection=CONNECTION_NAME

- Entity ID: urn:auth0:salto:CONNECTION_NAME

- Name ID format: EMAIL

- Name ID: Basic Information > Primary email

Click Continue.

Step 4: Add attribute mappings

Add the following mappings:

│ Google Directory Attribute │ App Attribute │

│ Primary email │ email │

│ Last name │ family_name │

│ First name │ given_name │

Important: Make sure the Primary email, First name, and Last name fields are populated for all users who will sign in to Salto. If any of these fields are missing for a user, their sign-in will fail.

Click Finish.

Step 5: Enable the app for your users

1. On the app's page, click User access

2. Select ON for everyone (or specific organizational units, as needed)

3. Click Save

Note: It may take up to 24 hours for changes to propagate to all users, though it's usually much faster.

Email the following to support@salto.io (or to any email address provided by Salto), requesting SAML enablement:

1. The SSO URL (from Step 2)

2. The Certificate file (downloaded in Step 2)

3. Your connection name

4. Whether you want IdP-initiated login, SP-initiated login, or both

Salto will complete the configuration on our side and confirm once your connection is ready.

Once Salto confirms the connection is enabled:

- IdP-initiated: click the Salto app in your Google Apps launcher to be taken directly into Salto

- SP-initiated: go to https://app.salto.io/login, enter your email address, and you will be redirected to your Google sign-in page

Troubleshooting

If you encounter access denied errors or configuration problems, contact support@salto.io. Note that an organization admin must invite users to Salto; SSO users who have not been invited will not be able to access the platform. See Inviting members to your organization (https://help.salto.io/) for more details.