Skip to main content
reroutehq
Get Started
SAML SSO guides

Identity provider

Connect Google Workspace

Add a custom SAML app in the Google Admin console, download the IdP metadata XML, and paste it into ReRoute using the Metadata XML option (Google does not host a metadata URL for custom apps).

Prerequisites

  • Enterprise plan and the workspace owner role.
  • The sign-in email domain is already an approved domain under Dashboard → Settings → Team.
  • The ACS URL and SP Entity ID / metadata URL from Dashboard → Settings → Single Sign-On — copy them from there; do not hardcode values from this page.
  • Super Admin (or equivalent) access in Google Workspace Admin.
  1. 1

    Add a custom SAML app

    At admin.google.com go to Apps → Web and mobile apps → Add app → Add custom SAML app. Name it ReRoute HQ.
  2. 2

    Download Google IdP metadata

    On the Google Identity Provider details screen, Download metadata — Google provides an XML file, not a hosted metadata URL. Keep that file for the final ReRoute step.
  3. 3

    Service provider details

    Enter:
    • ACS URL = the ACS URL from ReRoute.
    • Entity ID = the SP Entity ID / metadata URL value from ReRoute.
    • Name ID format = EMAIL.
    • Name ID = Basic Information → Primary email.
  4. 4

    Turn the app on for users

    Finish the wizard, then in the app's User access panel turn the app ON for everyone or for the right organizational units.
  5. 5

    Enable SSO in ReRoute with metadata XML

    In ReRoute go to Dashboard → Settings → Single Sign-On, pick the email domain, switch the metadata input to Metadata XML, paste the contents of the downloaded XML file, and choose Enable SSO.

Test the connection

  1. Open an incognito or private window (or a browser where you are not already signed in to ReRoute).
  2. Go to https://reroutehq.com/login, choose Sign in with SSO, and enter a work email on the connected domain whose organizational unit has the app turned on.
  3. Complete Google authentication. On first successful SSO sign-in, a ReRoute account is created and joined to the workspace automatically (just-in-time provisioning).

Sign-in is SP-initiated only. Do not rely on a Google app launcher tile to launch ReRoute; point any tile at https://reroutehq.com/login or hide it.

Notes and troubleshooting

  • 403 app_not_configured_for_user means the app is not turned on for that user's organizational unit. Open User access and turn the app ON for the right OUs (or for everyone).
  • Google supplies metadata as a downloaded XML file. In ReRoute you must use the Metadata XML input, not a metadata URL.
  • One SAML connection per workspace. A domain can belong to only one workspace's connection.
  • Google Workspace only auto-provisions apps in its own catalog; a custom SAML app cannot push SCIM to a custom endpoint. For this connection, remove members in Team settings, or they lose sign-in when the app is turned off for them. SCIM directory sync is available with Okta and Microsoft Entra ID.
  • Disabling SSO in ReRoute removes the identity provider; members fall back to email/password. Only the owner can disable.