This article describes how to integrate Cloud Access Service (CAS) with Google Cloud Identity Platform using a SAML Relying Party.

Configure CAS

Perform these steps to configure CAS using a Relying Party.

Procedure

1. Sign in to the RSA Cloud Administration Console.

2. Click Authentication Clients > Relying Parties.

   

3. On the My Relying Parties page, click Add a Relying Party.

4. In the Relying Party Catalog, click Add for Service Provider SAML.

   

5. On the Basic Information page, enter a name for the application, and then click Next Step.

   

6. On the Authentication page, configure the following settings:

   1. Choose RSA manages all authentication.

   2. In 2.0 Access Policy for Authentication, select a previously configured access policy.

   3. Click Next Step.

   

7. On the Connection Profile page, under Data Input Method, choose Enter Manually.

8. In the Service Provider section, configure the following settings:

   1. Assertion Consumer Service (ACS) URL: Enter the authorization callback URL from the Google Cloud Identity Platform SAML provider. The URL typically uses the format https://<domain-name>/auth/handler.

   2. Audience (Service Provider Entity ID): Enter the service provider entity ID for the Google Cloud Identity Platform configuration. Use the same value in both systems.

   

9. In the SAML Response Protection section, choose IdP signs SAML assertions, and then click Download Certificate. Save the certificate for the Google Cloud Identity Platform configuration.

   

10. Expand Advanced Configuration. In the User Identity section, configure the following settings:

    1. Name ID Format: emailAddress

    2. User Attribute for SAML Response Subject: mail

    

11. In the Identity Provider section, make a note of the RSA Entity ID. You need this value when you configure Google Cloud Identity Platform.

12. Click Save and Finish.

13. Click Publish Changes, and wait for the operation to finish.
    After publishing, your application is enabled for SSO. 

      

Configure Google Cloud Identity Platform

Perform these steps to configure Google Cloud Identity Platform.

1. Sign in to the Google Cloud console with an administrator account.

2. In the search box, search for Identity Platform, and then open Identity Platform.

3. On the Providers page, click Add a provider.

   

4. Configure the identity provider:

   1. In Select a provider, select SAML.

   2. Turn on Enabled.

   3. In Name, enter a name for the RSA identity provider.

   4. In Entity ID, enter the RSA Entity ID.

   5. In SSO URL, enter the RSA Identity Provider URL.

   6. In Certificate, paste the contents of the certificate that you downloaded from RSA, including the BEGIN CERTIFICATE and END CERTIFICATE lines.

   

5. In Configure your SAML provider, copy the Authorization callback URL. Verify that this value matches the ACS URL in the RSA connection profile.

   

6. In the side pane, click Project settings.

7. In the Authorized domains section, click Add domain.

8. Enter the domain for your application, and then save it. For example, if the application sign-in URL is https://example.com/login, enter example.com.

The configuration is complete.