I started down this path to flesh out a proof of concept for a related task. However, the Single Sign-On provider that we use is difficult to get access to and not worth the time to try to get permission to use it. So instead, I thought I’d just use my personal Google domain as the identity provider so I can get it done faster. So I’ve decided to document my journey and hopefully help someone else set this up.

Prerequisites

Before you can start, you must have My Domain configured and setup.

1. Navigate to Setup ⇨ Domain Management ⇨ My Domain
2. Choose your domain name
3. Click Check Availability
4. Click Register Domain
5. After you’ve tested your domain, you MUST deploy your domain to users by clicking Deploy to Users
6. From this page, remember / copy the Your domain name is **** since we'll be using that in lots of steps moving forward

Setup the Single Sign-On Configuration

I’ve found the easiest way to do this requires a bit of jumping back and forth between the Google admin console and Salesforce setup. So I recommend keeping each open in their own tab and switching back and forth between them

Google Admin Console

1. Open the SAML Apps page
2. Click + to add a new App
3. Filter Apps for “Salesforce”
4. Choose the correct service for production or sandbox
5. Under Option 2 click Download next to IDP metadata
6. Click Next

Salesforce Setup

1. Navigate to Setup ⇨ Security Controls ⇨ Single Sign-On Settings
2. Click Edit
3. Check SAML Enabled
4. Click Save
5. Click New from Metadata File
6. Choose the GoogleIDPMetadata XML file downloaded from above
7. Click Create
8. Choose Assertion contains the Federation ID from the User object
9. Optionally change the Name and API Name field. This will be displayed on the login page
10. Click Save

Google Admin Console

1. Starting on Step 3 of 4
2. Click Next
3. Replace {domain specific} in all fields with your **** from the my domain settings
4. Copy the Login URL from your SAML Single Sign-On Settings page from the step above into the ACS field. This will contain your org Id at the end of the URL
5. IMPORTANT Make sure your Entity ID _field matches _EXACTLY_ the _Entity ID field in your SAML configuration in Salesforce. By default the Google one will have a trailing slash while Salesforce will not.
6. Click Next
7. Navigate back to your SAML Apps listing page
8. Click the three dots to the left of your Salesforce Application
9. Click ON for everyone
10. Click TURN ON FOR EVERYONE (NOTE: This may take up to 24hrs to propagate)

Enable the Authentication Service

1. Navigate to Setup ⇨ Domain Management ⇨ My Domain
2. Click Edit in the Authentication Configuration Section
3. Check the box next to your SAML Service created above
4. Click Save

Configure Your Users

1. Navigate to Setup ⇨ Manage Users ⇨ Users
2. Click Edit next to a user
3. Modify the Federation ID to be the Google email address of that user
4. Click Save

Testing

1. Navigate to your My Domain URL
2. Under the Username and Password box there should now be an option to Or log in using with the name of your SAML Service. Click the name
3. Login with your Google credentials