12.6. Configuring Google Apps as a Remote Service Provider

OpenAM can serve as the identity provider when you use Google Apps as a service provider, allowing users to have single sign-on with their Google Apps account.

In order to use this service, you must have a Google Apps account for at least one of your domains, such as example.com.

Procedure 12.10. To Integrate With Google Apps

  1. If you have not yet done so, set up OpenAM as described in Procedure 12.1, “To Create a Hosted Identity Provider”, using a signing certificate that is needed by Google Apps.

    See the procedure To Change the Signing Key for Federation for details regarding the signing certificate.

  2. On the OpenAM console Common Tasks page, click Configure Google Apps.

  3. On the first Configure Google Apps for Single Sign-On page, add your domain name(s) such as example.com to the list, and then click Create.

  4. On the second Configure Google Apps for Single Sign-On page, save the OpenAM verification certificate to a text file, such as OpenAM.pem.

  5. Follow the instructions under To Enable Access to the Google Apps API before clicking Finish.

    1. Access the Google Apps administration page for the first of your domains in a new browser tab or window.

    2. Login as Google Apps administrator.

    3. Select Enable Single Sign-On.

    4. Copy the URLs from the OpenAM page into the Google Apps setup screen.

    5. Upload the certificate file you saved such as OpenAM.pem as the Google Apps Verification Certificate.

    6. Select Use a domain specific issuer.

    7. Save changes in Google Apps setup.

    8. Repeat the steps above for each domain you have configured.

    9. Click Finish to complete the process.