Overview
This guide walks you through connecting Galtea to Google Workspace using SAML 2.0. When complete, your team can sign in to Galtea through their Google Workspace accounts.
You will switch between the Google Admin Console and Galtea’s Organization Settings several times. Keep both browser tabs open.
Prerequisites
- Owner role in the Galtea organization, with an active Enterprise subscription.
- Super Admin role in your Google Workspace account.
Step 1 — Create a custom SAML application in Google
- Open the Google Admin Console.
- Navigate to Apps → Web and mobile apps.
- Click Add app → Add custom SAML app.
- Enter an app name (for example,
Galtea). Optionally upload a logo.
- Click Continue.
Step 2 — Copy IdP values from Google into Galtea
Google shows an IdP details screen with its own SSO information. Copy these values into Galtea’s Organization Settings → Advanced Options before continuing.
| Google field | Galtea field |
|---|
| SSO URL | Sign on URL |
- Click Download Certificate on this screen.
- Open the downloaded file in a text editor. You will see
-----BEGIN CERTIFICATE----- at the top.
- Copy the entire content and paste it into the Public Certificate field in Galtea.
Click Continue in the Google Admin Console to move to the next step.
Copy and save these values now. After clicking Continue you will move to a different screen and will need to go back to find them again.
On the Service provider details screen, fill in the following:
| Google field | Value |
|---|
| ACS URL | https://api.galtea.ai/auth/saml/callback |
| Entity ID | The SP Entity ID you entered in Galtea’s Organization Settings |
The SP Entity ID is a value you define. Use a unique identifier for your organization (for example my-company or my-company-prod). The exact same value must be entered in both Galtea and in the Google Entity ID field. In Galtea, enter this value in both the SP Entity ID and Issuer fields.
Step 4 — Attribute mapping (optional)
On the Attribute mapping screen, you can map additional Google profile fields to SAML attributes that Galtea reads.
| Google field | SAML attribute name |
|---|
| Basic Information → First name | given_name |
| Basic Information → Last name | family_name |
Step 5 — Grant user access in Google
After finishing the setup, the app is turned off for all users by default.
- In the Admin Console, click Web and mobile apps and open the Galtea app.
- Click User access.
- Enable the app for the relevant organizational units or groups.
- Click Save.
Google can take up to a few minutes to propagate access changes. If a user gets an access-denied error immediately after you save, wait a moment and try again.
Step 6 — Save and test in Galtea
- In Galtea, click Save to update the organization settings.
- Ask a user with access to the app to sign in using the organization’s Team Slug.
Troubleshooting
| Symptom | Likely cause | Fix |
|---|
| ”app_not_configured_for_user” from Google | User does not have access to the app | Grant user access in Google Admin → User access |
| ”Invalid ACS URL” from Google | ACS URL mismatch | Set the ACS URL in Google to exactly https://api.galtea.ai/auth/saml/callback |
| Signature validation fails in Galtea | Wrong certificate | Re-download the certificate from the Google IdP details screen and paste it again |
| Changes not visible yet | Google propagation delay | Wait 1–2 minutes and try again |
