dsshubserverconfig Public_Host=<em>fully-qualified-hostname</em>

• Configure with password:

  dsshubserverconfig Saml_SP_Public_Certificate=@saml-sp.pub_cert Saml_SP_Private_Key=@saml-sp.priv_key Saml_SP_Private_Key_Password=<em>password</em>
  

• Configure using a new key pair and certificate:

  1. Generate a new key pair and certificate using the dsssslgen command:

     dsssslgen saml-sp dsshubserver-saml
     

     Sample output:

     dsssslgen saml-sp dsshubserver-saml
     dsssslgen: Data Source Solutions DSS 6.2.6/0 (linux_glibc2.17-x64-64bit)
     dsssslgen: Generating SSL key pair...
     dsssslgen: Generating SSL key pair completed.
     dsssslgen: Certificate subject: 'DSS dsshubserver-saml'
     dsssslgen: Certificate contains 2048 bit RSA Public Key.
     dsssslgen: Certificate valid from Jan  6 18:03:18 2025 GMT
     dsssslgen: Certificate valid until Jan  1 18:03:18 2045 GMT
     dsssslgen: Public Certificate written to 'saml-sp.pub_cert'.
     dsssslgen: Private key written to 'saml-sp.priv_key'.
     dsssslgen: Private key password: rEscC7Lo3GihLb4HODNhX9xIJPR3yD6RCQU+JsJ/
     dsssslgen: Example to configure High Volume Agent: dssagentconfig Agent_Server_Public_Certificate=@saml-sp.pub_cert Agent_Server_Private_Key=@saml-sp.priv_key Agent_Server_Private_Key_Password=rEscC7Lo3GihLb4HODNhX9xIJPR3yD6RCQU+JsJ/
     dsssslgen: Example to configure Hub Server: dssreposconfig Agent_Client_Public_Certificate=@saml-sp.pub_cert Agent_Client_Private_Key=@saml-sp.priv_key Agent_Client_Private_Key_Password=rEscC7Lo3GihLb4HODNhX9xIJPR3yD6RCQU+JsJ/
     <strong>dsssslgen: Example to configure SAML to Hub Server: dsshubserverconfig Saml_SP_Public_Certificate=@saml-sp.pub_cert Saml_SP_Private_Key=@saml-sp.priv_key Saml_SP_Private_Key_Password=rEscC7Lo3GihLb4HODNhX9xIJPR3yD6RCQU+JsJ/</strong>
     dsssslgen: Finished. (elapsed=0.238508s)
     

  2. From the dsssslgen command's output, copy the example command line after Example to configure SAML to Hub Server and execute it:

     dsshubserverconfig Saml_SP_Public_Certificate=@saml-sp.pub_cert Saml_SP_Private_Key=@saml-sp.priv_key Saml_SP_Private_Key_Password=<em>password</em>
     

Download SP Metadata

Retrieve the SP metadata file, which contains essential configuration details, to use in the Google Workspace setup.

To download the SP metadata file, use the URL - https://fully-qualified-hostname:https_port/auth/latest/saml/metadata

{% tabs %}

{% tab label="Web Browser" %}

Enter the URL https://<em>fully-qualified-hostname</em>:<em>https_port</em>/auth/latest/saml/metadata in the address bar of your browser.

{% /tab %}

{% tab label="CLI" %}

Run the wget Linux command with the URL:

wget https://<em>fully-qualified-hostname</em>:<em>https_port</em>/auth/latest/saml/metadata

If you are using a self-signed HTTPS certificate, use --no-check-certificate to ignore the Self-signed certificate encountered error.

wget --no-check-certificate https://<em>fully-qualified-hostname</em>:<em>https_port</em>/auth/latest/saml/metadata

{% /tab %}

{% /tabs %}

Get Entity ID and ACS URL

Extract key identifiers from the SP metadata file, such as the Entity ID and Assertion Consumer Service (ACS) URL, which are required for configuring the SAML application in Google Workspace.

1. Open the downloaded SP metadata file in a text viewer.

2. Make a note of the following values, they are required for creating a custom SAML application in the Google Workspace (step 2.1.8):

   • The entityID attribute of the EntityDescriptor element. This is the Entity ID in Google Workspace.

     

   • The Location attribute of the AssertionConsumerService element with Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST". This is the ACS URL in Google Workspace.

     

Set Up Google Workspace

Create and configure a custom SAML application in Google Workspace to integrate with DSS.

Create a Custom SAML Application

Add a new custom SAML application for DSS in Google Workspace and configure its basic details.

1. Log in to your Google Admin account and go to Apps ▶ Web and mobile apps.

   

2. In the panel, click Add App.

   

3. Click Add custom SAML app.

   

4. Enter a name for the application (e.g., DSS).

5. Click Continue to switch to the Google Identity Provider details page.

   

6. Click DOWNLOAD METADATA to download the IdP metadata file and save it as saml-idp-metadata.xml.

   

   This file required to set the Saml_IDP_Metadata hub server property, while completing the DSS configuration (step 3.1).

7. Click Continue.

8. Under Server provider details, in the ACS URL and Entity ID fields, enter the values that you had noted down in step 1.4.

9. Leave the Start URL empty and the Signed response checkbox clear.

   

10. Set the Name ID format to UNSPECIFIED.

11. Set the Name ID to Basic Information > Primary email.

    

12. Click Continue to switch to the Attribute mapping page.

13. Click FINISH.

Enable User Access to the Custom SAML Application

Grant access to the custom SAML application for DSS users in Google Workspace.

1. By default, the custom SAML application created for DSS isn't accessible to users. Click OFF for everyone.

   

This example assumes that you are enabling the application access for everyone. To learn about applying policies to different users, refer to the Google's documentation.