Requirements
Admin access to your Google workspace
That’s it for requirements! All Ben instances are configured for SAML by default, so you just need to follow the rest of the guide to get up and running
Supported Features
Ben supports OIDC and SAML through Google. This guide is focused on configuring SAML SSO.
For Google, we support:
SP-initiated SSO
IdP-initiated SSO
Configuration Steps
⚠️ Enabling SAML will affect all users who use the Ben app.
Ben doesn't provide a backup sign-in URL where users can sign in using their regular username and password. If necessary, contact Ben Support to turn off SAML for your instance.
Go to the Google Admin console and head to the Web and mobile apps section.
Click
Add appand selectAdd custom SAML app
Set the name as
Benand add the app icon (we’ve included a file you can use as an icon), then pressContinue
Download the IdP metadata and send it to the Ben team working on your implementation, then hit
Continue
The Ben team will provide you with an ACS URL and Entity ID. They’ll look similar to the examples below:
ACS:
https://auth.thanksben.com/login/callback?connection=CompanyNameEntity ID:
urn:auth0:thanksben:CompanyName
You’ll want to paste the ACS URL into the Start URL box, and ensure that the Name ID format is set to
EMAIL, and hitContinueClick
Add Mappingto add a claim to the SAML response, and set it to be the primary email, with the following app attribute:http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress. With that added, hitFinish
Congrats! You’ve set up Ben for Google SSO.
SAML attributes
The recommended SAML claims are compiled in the table below:
Name | Value |
user.email | |
given_name | user.firstName |
family_name | user.lastName |
Thanks Ben Icon
This is an icon you can use for the Thanks Ben app.