Google Apps Authentication - WebHelpDesk

This is great, I have had multiple requests for this in the past, lets hope SW make this standard within the Product, could open up more sales into schools.

Yes it is set to that and on for everyone. Works now! Thanks. Must have been a propagation thing on googles end. It always says "may take x amount of time" and its usually instant so I am trained to ignore that.

What are you using as the Sign-on page URL in WHD? Is the WHS SAML app "turned on for everyone" in G-suite?

Awesome explanation amizos907, i wasn't able to get it to work though when I visit my help desk instance i get redirected to a google page that says Error: not_a_saml_app. Maybe having WHD sitting behind NGINX is my problem somehow.

This is a really old thread, but for those future Googlers who are looking for an answer, I have one.

1. Create custom SAML app in G-Suite, download the certificate, name it, enter the details, then finish. And turn the app on for everyone.
   
2. Click on the WHD SAML app in G-Suite to open settings. Collect the "Sign-in page URL" from the WHD SAML app in G-Suite by "launching the app". You will need to quickly screenshot to see the URL in the browser address bar before you are forwarded to a Google error page. The image below shows the URL format you are hoping to catch (i.e. https://accounts.google.com/o/saml2/initsso?idpid......).
   
   
3. In WHD, disable LDAP sync until you finish the procedure (if you are using it).
   
4. Under Setup-->General-->Authentication, change to SAML 2.0. Enter URL collected from previous step, upload certificate you downloaded in step 1, enter the logout URL from the image below, and SAVE the changes.
   
5. Now comes the hard part. G-Suite does not recognize the "username" or "SAM-Account-Names" format... only email address. If it isn't already so, need to change the usernames of all the Clients in your WHD from "usernames" to full email addresses. I only had 80 users to change so I didn't mess with a SQL script, but you could use one to make all the changes automagically if it is going to be a hassle the manual way.
   
6. The last thing is to re-enable LDAP syncing (if you are using it) and to make some changes so that all your hard work from step 5 isn't overwritten. The biggest of those changes is making the Username attribute map to "mail".
   
   

Good Luck!