This is an example using Google Workspace (formerly G Suite) of how to set up a custom SAML resource so that you can log in using the hosted version of OpenAthens.
- A Google Workspace domain
- Access to the Google Workspace admin dashboard
- Access to the OpenAthens administration area at the domain level
Set up the custom SAML resource in OpenAthens
- Access the administration area as the domain administrator and navigate to the catalogue (Resources > Catalogue).
- Switch to the custom tab and click on the Add button
- Select the SAML option
Enter the google apps metadata address
- Click the create button
This will create the basic custom resource. We can come back and add details later if we need to.
Add Google Workspace to your release policy
- Still in the administration area navigate to the release policy page (Preferences > Attribute release)
- Add a resource policy via the button
- Start typing the name you gave the SAML resource. This will be 'Google' unless you have changed it.
- Select it from the list of any options to add a policy
- Click the advanced button to access the NameID settings:
- Set the SAML NameID format and attributes from the drop down boxes as:
- NameID format -
- NameID attribute:
- NameID format -
- Click done and then save changes
This will now release the email attribute that Google are expecting as the username. This will only release it to Google. The email address on the OpenAthens account will need to match up with the email addresses stored at the Google end.
Access Google Workspace SSO settings
Access the SSO settings on the Google Workspace dashboard. At the time of writing this was under the security section.
The section you are looking for is to do with setting up SSO with a third party identity provider - you will need to fill in the following fields:
|Sign-in page URL|
|Sign-out page URL|
|Change password URL|
<OPENATHENSDOMAIN> can be looked up on your organisation summary. It is usually the same as the internet domain used as your scope
You will need to upload the x509 certificate that is published in your metadata by copying it into a file then topping and tailing it as follows:
You can access your SAML2 metadata for this at.
Save the details and you are ready to test.
Once both ends are set up, you can try access at https://mail.google.com/a/<GSUITEDOMAIN> (www.google.etc will always use the google account rather than redirecting so you need to use one of the apps' subdomains). Unless you already have an active google session you should be directed to your organisation's OpenAthens sign in location - see about the authentication point.
The email address stored on OpenAthens accounts you sign in with must match up with the email addresses in Google Workspace or no access is given.
Toggle use on and off via Google's settings until you are ready to go live.
Once the basic resource exists, that is all the system needs to work unless you are using restrictive mode (see below).
If you want specific app target resources to appear in MyAthens for your users you can add regular (non-SAML) custom resources with links to the various app pages - e.g. https://drive.google.com/a/yourdomain.com, etc.
All types custom resources can be made available to sub-organisations by opening the detail view and changing the setting on the visibility tab:
If you are running in restrictive mode, the SAML resource MUST be included in at least one of the permission sets used by anyone who should gain access. If not then OpenAthens will block access at the authentication point.
If you have sub-organisations you MUST ALSO set the visibility setting described above and allocate it to permission sets under those sub-organisations. The cascade option may be useful.