Single sign-on (SSO) lets your employees log in to Ben with their normal company login instead of a separate Ben password — one less password to lose or reset, and it keeps sign-in within your organisation's own security controls.
This guide covers setting up SSO for Ben using Google with SAML.
A note for admins
As the admin for your Ben portal, you may not be the person who sets up SSO — the steps below are technical and are usually handled by your organisation's IT or Security team. We recommend you send this article to them so they have what they need.
Once they've done the setup, you can let your employees know they can log in to Ben with SSO.
If you're weighing up SAML against OIDC, see SAML vs OIDC — but which one is right for your organisation is a decision for your IT or Security team. Ben also has Google OIDC preconfigured; to use that instead, see Setting up Microsoft or Google SSO for your employees (OIDC).
Information for your IT or Security team
Requirements
Admin access to your Google workspace
That’s it for requirements — you’ll set up the connection together with the Ben team by following the steps below.
Supported Features
Ben supports OIDC and SAML through Google. This guide is focused on configuring SAML SSO.
For Google, we support:
SP-initiated SSO
IdP-initiated SSO
Configuration Steps
⚠️ Enabling SAML will affect all users who use the Ben app.
Once it’s enabled, everyone at your company signs in to Ben through SAML. If you need to change this, contact Ben Support.
Go to the Google Admin console and head to the Web and mobile apps section.
Click
Add appand selectAdd custom SAML app
Set the name as
Benand add the app icon (we’ve included a file you can use as an icon), then pressContinue
Download the IdP metadata and send it to the Ben team working on your implementation, then hit
Continue
The Ben team will provide you with an ACS URL and Entity ID. They’ll look similar to the examples below:
ACS:
https://auth.thanksben.com/login/callback?connection=CompanyNameEntity ID:
urn:auth0:thanksben:CompanyName
You’ll want to paste the ACS URL into the Start URL box, and ensure that the Name ID format is set to
EMAIL, and hitContinueClick
Add Mappingto add a claim to the SAML response, and set it to be the primary email, with the following app attribute:http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress. With that added, hitFinish
Congrats! You’ve set up Ben for Google SSO.
SAML attributes
The recommended SAML claims are compiled in the table below:
Name | Value |
user.email | |
given_name | user.firstName |
family_name | user.lastName |
Ben icon
This is an icon you can use for the Ben app.