Setting up Single Sign-On (SSO) with Google Workspace

Objective

The purpose of this article is to provide guidance in setting up Single Sign On with Google Workspace for Outreach.

Applies To

• Outreach Admins
• Google Workspace Admins
• SSO

Requirements

In order to set up Okta SSO with Outreach, first ensure you:

1. Admin privileges in Outreach
2. Admin privileges in Google Workspace
3. During this procedure, you will have to navigate between the Google Workspace and Outreach applications several times. It is recommended to have each open in separate browser tabs for convenience.
4. This procedure will take 30 minutes to an hour. 

Need to just update expiring or expired certificates? 

1. Go to Google Workspace Admin Console
2. Go to Apps -> Web and mobile apps
3. Find the existing Outreach SSO application 
4. Click on Service provider details -> Manage Certificates -> Add Certificate
5. Download the new certificate
6. Refresh the page, and select the newly created Certificate in the certificate dropdown.
7. Upload the active certificate on the Outreach side (Step 5: Enable SSO inside Outreach settings in the procedure below).

Procedure

Step 1: Setting up Google Workspace

1. As a Google Workspace admin, go to https://admin.google.com/
2. Go "Apps" category -> Web and mobile apps -> Add app -> Add custom SAML app. 
3. Name the Custom app "Outreach_SSO" or similar -> Continue to next page
4. On the next page, you will be provided values which is needed later into this guide. Once saved, continue to next page. 
   1. SSO URL
      
      • Copy this into a Google Doc or notepad so you may paste this into Outreach settings later.  
   2. Entity ID
      
      • Copy this into a Google Doc or notepad so you may paste this into Outreach settings later.
   3. Certificate 
      • Download this certificate into your device to upload into Outreach settings later.
5. On the this page, input the following. Then "Continue".  
   1. ACS URL: https://placeholder.com
      1. You will update this later into the guide. 
   2. Entity ID: _placeholder_ 
      • You will update this later into the guide.
   3. Name ID format: UNSPECIFIED
   4. Name ID: Basic Information > Primary Email
6. Keep attribute mapping page unchanged and select "Finish" 

Step 2: Setting up Outreach 

1. Click Administration > User management > Sign-in.
2. Click Edit.
3. On the next page, select Add Identity Provider
   
4. Add the requested identity information that was retrieved from Google Workspace. 
   1. Name: This can be "Google_Workspace_SSO" 
   2. Sign In URL: This is the SSO URL from Step 1.4
   3. Issuer (Identity Provider Entity ID): This is the Entity ID from Step 1.4 
   4. Certificate: This is the certificate you downloaded from Step 1.4
      • Choose File and select the downloaded file.
5. You should be redirected back to "SSO Settings". Within that page, select "Edit"
6. Now find the “Setup Info” section. There are two important fields you will need to copy later in Step 3 (ideally you should have this tab open as you go through to Step 3) 
   1. Assertion Consumer Service (ACS) URL
      
      • Copy this into a Google Doc or notepad so you may paste this into Outreach settings later.  
   2. Service Provider Entity ID / Audience URI
      
      • Copy this into a Google Doc or notepad so you may paste this into Outreach settings later. 

Step 3. Update Google Workspace custom SAML application

1. Go back to the custom SAML application. Go "Apps" category -> Web and mobile apps -> Select the application. In this guide, we named it "Outreach_SSO". Within the application's overview page click the "Service Provider details" section.
2. Within the "Service providers details" input the below, then go all the way down and select "Save"
   1. ACS URL: This will be the Assertion Consumer Service (ACS) URL retrieved from Step 2.5 
   2. Entity ID: This will be the Service Provider Entity ID / Audience URI retrieve from Step 2.5
3. Depending on your organization's security Google Workspace policies, you will likely need to assign users and groups to the application. Go back to the application's overview page and select the "User access" section. Ensure in the next page, the appropriate group is attached to the application and it is "On" for those respective groups.
   • Note: As the admin, you will need to test the configuration so you will need to give yourself access to this application. It will take a few minutes for the configuration take effect.

Step 4. Enable SSO inside Outreach Settings 

1. Return to Outreach's SSO settings if you did not not have the settings already opened. 
2. Select "Single Sign On", then hit "Edit". Here, double check all your settings are properly configured. Please confirm the below values are matching respectively in Outreach or Okta:  
   1. Sign In URL: Matches the value from Google Workspace (Step 1.4)
   2. Issuer (Identity Provider Entity ID): Matches the value from Google Workspace (Step 1.4) 
   3. Certificate: Confirm it is the same downloaded certificate from Google Workspace (Step 1.4)
   4. Assertion Consumer Service (ACS) URL: Saved within Google Workspace settings (Step 3.2)
   5. Service Provider Entity ID / Audience URI: Saved within Google Workspace settings (Step 3.2)
3. Once you have confirmed all values are matching, then go back within Outreach's SSO Settings, and select "Enable".
   • Important Note: It is required to enable to test out the setup. 
     1. Your users will not be instantly signed out. 
     2. You should have already assigned yourself to the application in Step 3.3
     3. You should receive "{"success":true}" 
     4. In the event of a the failure of Step 4.4, you can go back to this page to uncheck "enable".
4. Select "Test" and a new tab should popup with "{"success":true}". This indicates the SSO connection works and the setup was successful. 

Congrats! SSO is now enabled!