Google Workspace: Imprivata Web SSO Setup

Configuring Imprivata Web SSO establishes trust between Imprivata as the Identity Provider (IdP) and Google Workspace (formerly G Suite) as the Service Provider (SP).

Imprivata Web SSO with SAML extends Single Sign-On functionality to SAML applications. Imprivata Web SSO uses SAML 2.0 federation standards.

Imprivata Web SSO provides single sign on and secure multi-factor authentication for web applications. Imprivata Web SSO provides a SAML 2.0 Identity Provider (IdP) web service, with which the SAML 2.0-ready applications will integrate. This service in the cloud acts as a front end, with a secure bi-directional connection to your on-premises Imprivata appliances, which in turn access Active Directory. Imprivata Web SSO provides identity management, authentication, and policy enforcement to your SAML applications inside your firewall, extending the Imprivata experience when users themselves access these applications from outside the firewall.

  1. The user points her browser to the application — the Service Provider (SP).

    You have configured the application to integrate with Imprivata as the Identity Provider (IdP).

  2. The application redirects the user's browser to the IdP, sending a SAML Authentication Request.

  3. The IdP executes Imprivata's login screen.

  4. The user supplies the necessary credentials to authenticate.

    NOTE:

    When the workstation has the Imprivata agent online and the user already logged into the workstation, the user is not prompted for their credentials. See Expected Endpoint Workflows.

  5. The IdP generates a digitally signed SAML assertion, and puts it in the HTTP response to the browser, along with instructions to POST the response back to the SP.

  6. The browser POSTS the signed SAML assertion to the SP, which validates that the SAML assertion has come from a trusted source.

  7. The SP grants access to the user, logging her into the application.

CAUTION:

In an Imprivata environment where applications are federated with Imprivata Web SSO IdP, all users need to be licensed for Imprivata Web SSO. As soon as the integration between Imprivata and the web application is completed, users not licensed for Imprivata Web SSO won’t be able to access the application. Imprivata does not support manual password authentication in this environment.

NOTE:

Imprivata Web SSO only supports Service Provider-initiated interactions. Identity Provider-initiated interactions, where the user points their browser to the IdP, are not supported.

Imprivata Web SSO only supports the following SAML standard bindings:

  • SP to IdP: HTTP Redirect binding; HTTP POST binding
  • IdP to SP: HTTP POST binding

Validate SAML integration settings on the Imprivata Admin Console:

Setting Required / Optional Imprivata Admin Console location
Imprivata Enterprise Access Management 7.0 or later Required Help menu
Imprivata Single Sign On is licensed Required Gear menu > License
Imprivata enterprise is provisioned and connected to the cloud Required Gear menu > Cloud connection
SAML applications are added and enabled in Imprivata Admin Console Required Applications > Single sign-on application profiles
SAML applications are deployed to selected set of users Required Applications > Single sign-on application profiles
Imprivata users are assigned to user policy enabled for Single Sign On Required Users > User policies
User policies are assigned to Remote Access workflow Optional; required for multi-factor authentication when the Imprivata agent is offline or not present Users > Workflow policy

Cloud Connection

Imprivata Services will enter the Enterprise ID and one-time cloud provisioning code required to establish trust between your Imprivata enterprise and the Imprivata cloud:

  1. If you're not on the Cloud Connection page already: In the Imprivata Admin Console, click the gear icon > Cloud connection.
  2. Services will enter your Enterprise ID and cloud provisioning code.
  3. Click Establish trust.
BEST PRACTICE:

The cloud connection must be established by Imprivata Services.

Cloud Connection Status

You can review the status of your enterprise's connection to the Imprivata cloud at any time. Status notifications are displayed on the Imprivata Admin Console, and the cloud connection status of every appliance at every site is also available:

  1. In the Imprivata Admin Console, go to the gear icon > Cloud connection.

  2. Every appliance host is listed with its status. If there are problems with a connection, recommendations for resolving the problem are displayed here.

Google Workspace: Verify Your Domain

Before you can start using Google Cloud services, you need to verify that you own your domain. Best Practice — add a text file containing a verification code to your domain so Google can confirm you own the domain:

  1. In the Google Admin Console, click to Get Started.

  2. Click Verify to verify your domain.

  3. Follow Google's instructions to create a TXT record. Place it in your domain or send it to the administrator who can do so.

  4. As soon as the text file is added to the domain, in the Google Admin Console, click Verify My Domain.

  5. If your users are located in more than one domain, add every domain. In the Google Admin Console, go to Domains > Manage Domains.

  6. Select Add a Domain or a Domain Alias and follow the instructions to add another domain.

Google Workspace: Edit SP Metadata File

Create a file SP_metadata.xml with the following template. Enter your FQDN in two fields as follows:

<?xml version="1.0"?>

<md:EntityDescriptor xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata" entityID="google.com/a/YOUR_FQDN">

<md:SPSSODescriptor AuthnRequestsSigned="false" WantAssertionsSigned="false" protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol">

<md:NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified</md:NameIDFormat>

<md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="https://www.google.com/a/YOUR_FQDN/acs" index="0"/>

</md:SPSSODescriptor>

</md:EntityDescriptor>

Add Google Workspace as SAML Application

Only the superadmin role is able to configure Web SSO application profiles:

  1. In the Imprivata Admin Console, go to Applications > Single sign-on application profiles.

    All Single sign-on application profiles, including conventional Imprivata APG profiles, Mobile app profiles, and SAML application profiles, are all managed from this page.

  2. Click Add App Profile > Web application using SAML. The Add web application using SAML page opens.

  3. Give the application profile a name. This name is visible only to administrators.

    Give the application a user-friendly name. This is the name your users will see when they log in.

  4. Click Get SAML metadata.

  5. Select From XML and upload the XML file you edited previously.

  6. Click OK.

  7. In the Service Provider (SP) metadata section, the NameID format preference field is set to Unspecified.

  8. Set the Returned Attribute field to Email address (mail).

  9. Click View and copy Imprivata (IdP) metadata.

  10. In the Imprivata IdP Metadata window:

    • copy and save the SSO redirect URL;
    • copy and save the SLO redirect URL;
    • download the Imprivata IdP certificate.

  11. Close the Imprivata IdP Metadata window.

  12. Click Save SAML application.

Google Workspace: Set Up Single Sign On

  1. In the Google Admin Console, go to Security. On the Security page, click Set up single sign-on (SSO) with a third party IdP.

  2. On the Set up single sign-on (SSO) with a third-party IdP page:

    • Select Setup SSO with third-party identity provider

    • SSO redirect URL — enter the URL you saved from the Imprivata Admin Console.

    • SLO redirect URL — enter the URL you saved from the Imprivata Admin Console.

    • Verification Certificate — upload the IdP certificate you saved earlier.

    • To automatically map the username to the primary domain, select Use a domain specific issuer.

      NOTE:

      If you do not select Use domain specific issuer, Google sends the standard issuer (google.com) in the SAML request.

      If you select Use domain specific issuer, Google sends an issuer specific to your primary domain: google.com/a/YourDomain

  3. Click Save.
NOTE:

The IdP certificate for your Imprivata enterprise expires two years after it is enabled. You will receive an alert on the Imprivata Admin Console beginning 60 days before it expires. When the Service Provider or Relying Party certificate is expiring for a web app enabled for Web SSO, you will receive an alert 90 days in advance.

User Management

Google Workspace supports just-in-time (JIT) user provisioning. Manual user provisioning is not supported.

IT Pilot — Deploy to Select Users

Imprivata Web SSO application profiles offer flexible deployment options.

Deploy your profile to select users for testing:

  1. In the Imprivata Admin Console, go to Applications > Single sign-on application profiles, find your App Profile, and click Not Deployed.

  2. Click Deploy This Application?

  3. Un-check Deploy to All Users and Groups.

  4. Check the domain your test users are located in.

  5. Check These OUs, groups and users

  6. Specify your test users.

  7. Click Save.

  8. On the list of application profiles, check the box next to the profile and click Deploy.

Test WebSSO with Google Workspace

Sign in to Google Workspace using WebSSO:

  1. Go to https://workspace.google.com/ > Sign in

  2. Domain field — your FQDN

  3. Access to — Admin Console

  4. Click GO.

    Alternatively,

  5. Edit the following URL with a Google service and your FQDN. For example:

    https://gmail.google.com/a/YourDomain

    Other Google services you can enter in this URL:

    • calendar
    • docs
    • drive
    • sheets
    • sites
    • slides
  6. The Imprivata-powered graphical login screen should appear with username and password fields.

Deploy To Users and Groups

Imprivata Web SSO application profiles offer flexible deployment options.

Deploy your profile to specific OUs, users, and groups as needed:

  1. In the Imprivata Admin Console, go to Applications > Single sign-on application profiles, find your App Profile, and click Not Deployed or Not Deployed.
  2. Check Deploy This Application.
  3. You can Deploy to All Users and Groups, or uncheck this option and deploy to select OUs, users, and groups.
  4. Check the domain your users are located in.
  5. Select For All Users (in this domain) or check These OUs, groups and users
  6. Select specific OUs, groups, and users as needed.
  7. Click Save.
  8. On the list of application profiles, check the box next to the profile and click Deploy.

For complete details, see Deploying Application Profiles.

NOTE:

All Imprivata users synced to the same domain in Active Directory as the Service Provider or Relying Party users, who are licensed for Single Sign On with Imprivata, will immediately be able to log into the Web SSO app using their username and password authenticated by Imprivata Web SSO.

When the workstation has the Imprivata agent online and the user is already logged into the workstation, the user will not be prompted for their credentials.

For complete Web SSO workflow details, see Expected Endpoint Workflows.

Expected Endpoint Workflows

BEST PRACTICE:

Google Workspace does not support Single Log Out with Imprivata WebSSO. For best security, at the end of their session, users must log out of Google Workspace and close the browser. This will prevent a user from accessing another user’s session by mistake.

The expected Imprivata Web SSO workflow has the following variations:

Imprivata Agent Online

  1. The user logs into desktop with Imprivata Enterprise Access Management.

  2. The user provides the URL for an app enabled for Imprivata Web SSO.

  3. The app opens. The user does not need to log into it manually.

    Subsequent apps are automatically authenticated within the same browser and the same session.

    If the user closes an app without logging out of the app, he can return to the app during the same session without logging in again.

Imprivata Agent Not Present or Unavailable

  1. The user provides the URL for an app enabled for Imprivata Web SSO.

  2. The user is prompted to log in:

    • If the enterprise does not have an Imprivata Enterprise Access Management Remote Access license, he will be prompted to authenticate with username and password.
    • If the user is included in a user policy associated with the MFA Remote Access Log In workflow, he will be prompted to complete the Log In workflow.
    • If the user is not included in a user policy associated with the MFA Remote Access Log In workflow, he will be prompted to authenticate with username and password.

  3. The app opens.

    Subsequent apps are automatically authenticated within the same browser and the same session.

    If the user closes an app without logging out of the app, he can return to the app during the same session without logging in again.

Imprivata Web SSO on an Unsupported Browser

The expected Imprivata Web SSO workflow on an unsupported browser is the same as when the Imprivata agent is not present or unavailable:

  1. The user provides the URL for an app enabled for Imprivata Web SSO.

  2. The user is prompted to log in:

    • If the enterprise does not have an Imprivata Enterprise Access Management Remote Access license, he will be prompted to authenticate with username and password.
    • If the user is included in a user policy associated with the MFA Remote Access Log In workflow, he will be prompted to complete the Log In workflow.
    • If the user is not included in a user policy associated with the MFA Remote Access Log In workflow, he will be prompted to authenticate with username and password.

  3. The app opens.

    Subsequent apps are automatically authenticated within the same browser and the same session.

    If the user closes an app without logging out of the app, he can return to the app during the same session without logging in again.

For complete details on supported browsers, see Imprivata Enterprise Access Management Supported Components

When Another User Logs In

When a subsequent user logs into a workstation, the Imprivata agent terminates the IdP session of the previous user.

Imprivata Web SSO cannot terminate user sessions:

  • In browsers other than Microsoft Edge or Google Chrome;
  • On workstations where the Imprivata agent is not present or unavailable;
  • For applications not enabled for Imprivata Web SSO;
  • For SAML applications that track the SP session with a persistent cookie.
CAUTION:

In an Imprivata environment where applications are federated with Imprivata Web SSO IdP, all users need to be licensed for Imprivata Web SSO. As soon as the integration between Imprivata and the web application is completed, users not licensed for Imprivata Web SSO won’t be able to access the application. Imprivata does not support manual password authentication in this environment.

BEST PRACTICE:

Implement Single Log Out for your Web SSO-enabled applications (where supported);

Turn off persistent cookies for Relying Parties; this prevents a user from accessing another user's session after a Fast User Switch.

Manually log out of applications where Imprivata Web SSO cannot terminate the user session;

Close browser windows.

Optional — Web Login Customization

Configure the appearance of the web login application screens with the logo and color of your enterprise, and set a custom session log out value:

  1. In the Imprivata Admin Console, go to the gear icon > Web app login configuration

    • Select a background color for the login screen (hexidecimal value);
    • Upload a PNG, GIF, or JPG logo (200 x 150 pixels, 250 KB max)
  2. User sessions are logged out after 2 hours by default. Turn off this automatic logout, or select a value between 30 minutes and 4 days.
  3. Click Save.

Troubleshooting

Verify proper integration of Imprivata Web SSO (IdP) with the Relying Party (RP).

  • Imprivata IdP configuration (accessed through Imprivata Admin Console);

  • Relying Party SSO configuration (Relying Party administration)

  • Endpoint (device from which the user accesses the Relying Party application).

Validate endpoint configuration:

Setting Value
Endpoint is able to reach RP site Check connection to RP host
Endpoint has Internet connection and can reach IdP site Open in browser:
https://idp.cloud.imprivata.com/<...>/saml2
Browser supports/allows cookies  

Validate configuration for an endpoint with an Imprivata agent:

Setting Location/Value
Imprivata 23.2 or later agent is installed Agent icon in Windows system tray
Imprivata agent is connected and logged in Agent icon in Windows system tray
Single Sign On is enabled Agent icon in Windows system tray
User uses supported browser Google Chrome and Microsoft Edge
Imprivata browser extension is enabled Google Chrome and Microsoft Edge

Replacing Expiring Certificates

NOTE:

The IdP certificate for your Imprivata enterprise expires two years after it is enabled. You will receive an alert on the Imprivata Admin Console beginning 60 days before it expires. When the Service Provider or Relying Party certificate is expiring for a web app enabled for Web SSO, you will receive an alert 90 days in advance.