Google Workspace

Cube Cloud supports authenticating users through Google Workspace, which is useful when you want your users to access Cube Cloud using single sign on. This guide will walk you through the steps of configuring SAML authentication in Cube Cloud with Google Workspace. You must be a super administrator in your Google Workspace to access the Admin Console and create a SAML integration.

<Note>

Available on Enterprise plan.

</Note>

Enable SAML in Cube Cloud

First, we'll enable SAML authentication in Cube Cloud. To do this, log in to Cube Cloud and

1. Navigate to Admin → Settings.
2. On the Authentication & SSO tab, enable SAML.
3. For a new integration, replace any prefilled Audience (SP Entity ID) value with the Single Sign-On URL shown directly above it.

Take note of the Single Sign-On URL and Audience (SP Entity ID) values. You will need them when you configure the SAML integration in Google Workspace.

Create a SAML Integration in Google Workspace

Next, we'll create a SAML app integration for Cube Cloud in Google Workspace.

1. Log in to admin.google.com as an administrator, then navigate to

   Apps → Web and Mobile Apps from the left sidebar.

2. Click Add App, then click Add custom SAML app:

<Frame> </Frame>

3. Enter a name for your application and click Next. You can optionally add a description and upload a logo for the application, but this is not required. Click Continue to go to the next screen.

<Frame> </Frame>

4. Take note of the SSO URL, Entity ID and Certificate values here, as we will need them when we finalize the SAML integration in Cube Cloud. Click Continue to go to the next screen.

<Frame> </Frame>

5. Enter the following values for the Service provider details section and click Continue.

Name	Description
ACS URL	Use the Single Sign-On URL value from Cube Cloud.
Entity ID	Use the Audience (SP Entity ID) value from Cube Cloud.

6. On the final screen, click Finish.

7. From the app details page, click User access and ensure the app is ON for everyone:

<Frame> </Frame>

Complete SAML configuration in Cube Cloud

In this step, we'll finalise the configuration by entering the values from our SAML integration in Google into Cube Cloud.

1. Return to Admin → Settings → Authentication & SSO → SAML.
2. Confirm that Audience (SP Entity ID) still matches the Single Sign-On URL exactly.
3. Enter the following values in the SAML Settings section:

Name	Description
Entity ID / Issuer	Use the Entity ID value from Google Workspace.
SSO (Sign on) URL	Use the SSO URL value from Google Workspace.
Certificate	Use the Certificate value from Google Workspace.

4. Enable Auto-provision new users if you want users to be automatically created in Cube on their first login via this SAML provider. New users are assigned the Viewer role by default — see Default role for new users to choose a different role. Enable this if you are not using SCIM provisioning.

5. Click Apply to save the changes.

<Note>

Existing working Google Workspace integrations with a blank Audience do not need to change immediately. A blank Audience disables audience validation. To enable validation, update the Google Entity ID and Cube Audience (SP Entity ID) together, keep another authentication method enabled, and test SAML sign-in before you disable the fallback method.

</Note>

Default role for new users

By default, users auto-provisioned via SAML receive the Viewer role. To assign a different role, expand the Advanced section of the SAML configuration form and pick from Default role for new users:

• Developer, Explorer, or Viewer — Cube Cloud's default roles.
• Any custom role defined in your account, listed below the divider.

The selected role applies only when a user is first created. Existing users are not modified on subsequent SSO logins. It is applied in addition to any roles your identity provider sends via the role attribute (subject to the rolesMap).

<Info>

Admin status is not assignable through this picker — Admin is controlled separately. To grant admin permissions, update the user's role manually under Admin → Users.

</Info> <Warning>

If the selected role is later renamed or deleted, new users will fall back to the Viewer role until you pick a valid role here. The Viewer fallback applies whenever the configured default cannot be resolved — whether that's because no default is set or the configured role no longer exists.

</Warning>

Test SAML authentication

To start using SAML authentication, use the single sign-on URL provided by Cube Cloud (typically <YOUR_CUBE_CLOUD_URL>/sso/saml) to log in to Cube Cloud.