SSO with Google Workspace

This guide connects Plenix to Google Workspace, so your team can click Sign in with Google on the Plenix login page. It uses a Google custom SAML app.

You need to be an administrator in Plenix and a super administrator in Google Workspace.

1. Copy the SAML details from Plenix

1. In Plenix, go to Settings → SSO.
2. Keep this tab open. You'll copy the Assertion Consumer Service (Reply) URL and the Entity ID (Identifier / Audience) in step 3.

2. Create the custom SAML app in Google

1. Go to admin.google.com.
2. Open Apps → Web and mobile apps.
3. Click Add app → Add custom SAML app.
4. App name: Plenix. You can upload the Plenix logo as the icon if you like. Click Continue.
5. On Google Identity Provider details, copy and keep:
   • SSO URL
   • Entity ID
   • Certificate: click Download certificate, or copy the certificate text. Then click Continue.

3. Service provider details

Fill in:

• ACS URL: the Plenix Assertion Consumer Service (Reply) URL.
• Entity ID: the Plenix Entity ID.
• Start URL: leave empty.
• Signed response: leave unticked. Google signs the assertion, which is what Plenix needs.
• Name ID format: EMAIL.
• Name ID: Basic Information → Primary email.

Click Continue.

4. Attribute mapping (optional)

To have new users' names filled in, add:

• Basic Information → First name → app attribute givenName
• Basic Information → Last name → app attribute surname

Click Finish.

5. Turn the app on for your users

New custom apps start OFF.

1. On the Plenix app page, click User access.
2. Choose ON for everyone, or turn it on for specific organisational units or groups.
3. Click Save. Google can take a few minutes, occasionally up to 24 hours, to apply this.

6. Connect it in Plenix

1. In Settings → SSO, click Connect identity provider.
2. Protocol: SAML 2.0.
3. Button label: Google.
4. Google doesn't provide a metadata URL, so leave IdP metadata URL empty and fill in:
   • Sign-on URL (if no metadata URL): the Google SSO URL.
   • IdP entity ID / issuer (optional): the Google Entity ID.
   • Signing certificate (if no metadata URL): open the downloaded certificate file in a text editor and paste everything, including the -----BEGIN CERTIFICATE----- and -----END CERTIFICATE----- lines.
5. Set Allowed email domains (your Google Workspace domains) and choose whether to auto-provision new users. See who can sign in.
6. Switch on Enable single sign-on and click Save.

7. Test

Open a private browser window, go to https://<your-workspace>.plenix.cloud/tenant-login, click Sign in with Google, and sign in with a Google Workspace account that has the app turned on.

If Google shows "app_not_configured_for_user" or "Service is not enabled for this user", the app isn't switched on for that person yet (step 5).

When Google's certificate changes

Google's SAML certificates last five years. Before it expires, Google lets you add a new certificate in the app's Manage certificates area. Download the new one, paste it into Settings → SSO → Edit → Signing certificate in Plenix and save. Then make the new certificate active in Google.

Where to go next

• The full setup guide → Single Sign-On (SSO): Complete Setup Guide
• SSO with Microsoft Entra ID (Azure AD)
• SSO with Google Workspace
• SSO with Okta
• Rolling Out SSO and Fixing Sign-In Problems
• See where this fits in the bigger picture → Integrations Overview — What You Can Connect