G-Suite Apps

Pre-Requisites

Gsuite Admin Console Access.
Accops HySecure Gateway with Public DNS name and valid SSL Certificate.
Managenent console of HySecure Gateway using Secirity Officer Account.
Shell Access to Hysecure Gateway.

Configurations

Steps to setup G-Suite in Accops (Identity Provider)

Step 1: Login with a digital certificate in Accops HySecure Gateway using Security Officer Account.

Step 2: Go to "Access Management >> Applications >> Add" .

Step 3: Click on Add button to create new application as "google" for GMail.

Type : HTTPS
Name: GMail
Discription: Gsuite
Application Server Address: account.google.com
Application Port: 443
Protocol: TCP
Web URL:  https://account.google.com/a/onaccops.com
Use Reverse Proxy: No
Hidden Application: No
Hide Access Pop-up : No
Enable App Tunnling : Yes
Enable L3 VPN Tunneling : No
Enable Single Sign-on : Yes
Authentication Type : SAML Based
Preconfigured Service Provider : google
Service Provider Login URL: https://www.google.com/a/onaccops.com/acs
Service Provider Logout URL : https://www.google.com/a/onaccops.com/saml2/sp/slo
Audience : https://mail.google.com/a/onaccops.com
Issuer : https://sso.accops.cloud (HySecure Gateway Address)

Step 4: Add google app into New/Existing Application Groups.

Step 5: Create/Update an "Application Access" in New/Exisitng "Access Controls"

Step 6: Verify SAML SSO Certificate in Accops HySecure Gateway.

Please ensure below files availability in Accops HySecure Gateway.

Certificate Path: /home/fes/fescommon/certs/

-rw-r--r-- 1 apache fes    2029 Mar 11 11:08 SAML_Signing_Certificate
-rw------- 1 apache fes    2498 Mar 11 11:09 SAML_Signing_Private_Key

Note

If above files are not present then, Create it using below command after changing the Working Directory to "/home/fes/fescommon/certs/"


[root@sso1 ~]# cd /home/fes/fescommon/certs/

openssl x509 -inform PEM -in "sslcert.cer" -out SAML_Signing_Certificate

openssl rsa -in "sslcert.pem" -out SAML_Signing_Private_Key

Step 7: Copy the content of SAML SSO Certificate SAML_Signing_Certificate form Accops Gateway.

Warning

Please ensure while copying the content there aren't any new line in SAML SSO Certificate

cat /home/fes/fescommon/certs/SAML_Signing_Certificate

Steps to setup Accops in G-Suite (Service Provider)

Step 1: Go to Google Admin Console https://admin.google.com/u/1/?pli=1 and login with Admin Access.

Step 2: Select Security from Google Admin Console.

Step 3: Select Set up single sign-on (SSO) with a third party IdP.

Step 4: Configure Accops IdP Server Details as below and Click on Save.

Sign-in Page URL : https://sso.accops.cloud/saml-sso/G-Suite

Sign-out page URL: https://sso.accops.cloud/saml-slo/G-Suite

Upload IdP SSL Certificate : SAML_SSO_Certificate.cer

Select *Use a domain-specific issuer*

Go to Accops Workspace Portal (https://sso.accops.cloud)
Here you have to enter the sAMAccountName of the user"

For Example:
```
Username: pravind.kumar
Password: xxxxxx
Domain: onaccops.com
```
Enter Your Login Credentials, Choose domain from dropdown and click on Sign In.
Verify yourself using Multi-Factor Autentcication by choosing the type of MFA from dropdown.
Post successful Autentication and Authorization User will will be redirected to Accops Workspace Portal.
Click on G-Suite icon to launch Single Sign On access to Gmail.

Go to to Gmail https://mail.google.com and select Login using Accops SSO
Autentication request will be redirected to Organization Sign in Page (Accops IDP Login Portal), Enter Authentication details and click on Sign-In.
Here you have to enter the sAMAccountName of the user"

For Example:
```
Username: pravind.kumar
Password: xxxxxx
```
On Below Screen, Accops IDP Server will Prompt More Authenication required, Choose Send Push to Mobile/Desktop and Authorize the Desktop Push to Login.
Access G-Suite Portal.

G-Suite Apps

Pre-Requisites

Configurations

Steps to setup G-Suite in Accops (Identity Provider)

Steps to setup Accops in G-Suite (Service Provider)

Sign in to your G-Suite

Using IDP initiated login

Using SP initiated login