Configure Google Workspace with Docubee

View our Pricing & Plans for a detailed list and comparison of features available in each plan.

Note: Service-Provider-initiated SSO is the only SSO implementation supported by Docubee.  Identity-Provider-initiated SSO is not offered at this time.

Configure Google Workspace with Docubee by completing the following:

1. Create your app in Google Workspace
2. Configure your app in Docubee
3. Configure your app in Google Workspace
4. Verify your connection & enable domains

Create Your App in Google Workspace

Although this article assumes the Customer’s Admin is familiar with setting up and using Google Workspace, we provide basic guidance.

• Docubee does not offer a prebuilt app for Google Workspace, so the Enterprise App must be added via the Admin Dashboard / Apps / Web and mobile apps / Add app / Add custom SAML app path.
• Docubee SSO (Single Sign-On) supports only SAML 2.0 apps.
• Users must be assigned to a Google group that is in turn assigned to the Workspace app to have access to Docubee.
• Google Workspace only supports assignments via groups.

Configure Your App in Docubee

Google Workspace provides all the information Docubee will need as part of the SAML App creation process on stage 2, Google Identity Provider details.

1. In Google Workspace:
   1. Google will provide a certificate that you must save as a .cer file.
   2. Copy the SSO URL value from Google Workspace.
2. In Docubee:
   1. Navigate to the Settings page for your SSO-enabled Docubee organization.
   2. Select General settings and scroll to the Single Sign-On section.
   3. Paste the SSO URL value (copied from Google Workspace) in the Identity Provider Log-in URL field in Docubee.
   4. Upload the saved .cer file in the Upload Certificate file picker.
   5. Click the UPDATE SSO CONFIGURATION button to save your settings.

Configure Your App in Google Workspace

During stage 3 of the SAML App creation process, Service Provider Details, Docubee provides three essential values that must be copied and pasted into the corresponding fields in Google Workspace.

1. Copy the following values from Docubee and paste them in Google Workspace:
   1. Copy the Audience value from Docubee and paste it in the Entity ID field in your Google Workspace app.
   2. Copy the Assertion Consumer Service (ACS) URL value from Docubee and paste it in the ACS URL field in your Google Workspace app.
   3. Copy the Recipient URL value from Docubee and paste it in the Start URL (Optional) field.
      Note: Even though Google marks this field as “optional”, Docubee expects it to be filled.

In Google Workspace:

1. On stage 3, Service Provider Details, configure the following:
   • Name ID format – Value: EMAIL
   • Name ID – Value: Basic Information > Primary email
2. On stage 4, Attribute Mapping, configure the following attributes:
   1. Google Directory attributes – Value: Primary email
   2. App attributes – Value: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress
   3. Though not required, Docubee also supports the following App Attributes:
      • http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname
      • http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname
   4. Choose the group you want to have access to the App and set the following
      • App Attribute – Value: Groups
3. After completing the app configuration, from the main App dashboard:
   1. 1. 1. Expand the User access section.
         2. Expand the Groups section on the left.
         3. Search for and select the group that should have access to the App.
         4. Dismiss the popup.
         5. Enable the Service status for the group and save.

Verify Your Connection & Enable Domains

After completing the configuration in both Docubee and Google Workspace, test the connection to verify it is working correctly and enable your required domains to ensure users can use Docubee through SSO.

Verify Connection

In Docubee:

1. Ensure all domains are DISABLED.
   • This helps prevent you from being locked out of your Docubee account if something went wrong.
2. Click UPDATE SSO CONFIGURATION button.
   • This saves the provided IDP Log-in URL and certificate.
3. In Docubee, click TEST SSO CONFIGURATION.
4. A Google window will pop up requesting authentication. Follow the on-screen instructions for authentication requirements.
   1. Once logged in to Google, look for a success notification at the bottom right of your screen in Docubee.

Enable Domains in Docubee

After the connection has been successfully verified, you may enable domains to use for this Docubee Organization and update the config again.

1. Once a domain is enabled, ANY and ALL users with a matching email domain component will be required to log in to the specified Docubee Organization with SSO regardless of a provisioned account in Docubee, Workspace, or the Enterprise App.
2. This domain can later be turned off and Auto-provisioned Accounts can set a password to log in to the Docubee Organization.

Related Information

Configure Single Sign-On
Additional Resources

Need more help getting set up? Contact us for assistance from our customer support team or register for Office Hours.