# Google SAML Setup This page provides instructions on how to integrate Squirro with Google’s Single Sign-on offering. ## Configure Google Apps 1. Open the [Google Admin console](https://admin.google.com/). 2. Click **Apps**. 3. Click **SAML apps**. 4. Create a new SAML app using the plus button at the bottom right. 5. Select **Setup my own custom app** [](https://s3.amazonaws.com/download.squirro.net/docs/migrated-attachments/184943017/184811803.png) 6. Download the IDP metadata file - this is required for Squirro later 7. Fill out the basic information: - Application Name: Squirro - Upload logo. [](https://s3.amazonaws.com/download.squirro.net/docs/migrated-attachments/184943017/184811812.png) 8. Fill in the service provider details: 1. ACS URL: `https://SQUIRRO/sso/callback` (URL of your Squirro installation plus the path `/sso/callback`) 2. Entity ID: `https://sso.squirro.com/o/saml2/entity` 3. Keep other settings as is [](https://s3.amazonaws.com/download.squirro.net/docs/migrated-attachments/184943017/187170919.png) 9. No mapping need to be defined. 10. Finish the process and close the resulting dialog. 11. Now enable the Squirro app for everybody, by clicking on the hamburger menu and clicking **ON for everyone** [](https://s3.amazonaws.com/download.squirro.net/docs/migrated-attachments/184943017/187203671.png) ## Configure SAML Metadata To configure SAML Single Sign-On with the federation metadata file, go to the **Server** space in Squirro and in the navigation on the left select **Single Sign-On (SAML)**. Press the orange plus icon on the top right. Fill out the form: - Domain: `*` - Enabled: Check - Metadata file: upload the `GoogleIDPMetadata-squirro.com.xml` file that was downloaded from Google earlier - User group: Select a user group which should be assigned to all SSO users [](https://s3.amazonaws.com/download.squirro.net/docs/migrated-attachments/184943017/184811820.png) ### Enable SSO For security reasons, the final configuration needs to be done directly on the server. Log into the server using SSH or similar means and edit the file `/etc/squirro/frontend.ini`. Then append the following lines at the end: ```python [security] sso_enabled = true sso_endpoint = http://localhost:81/studio/extauth_saml/extauth ``` ### Reduce HTTP Session With Single Sign-On enabled, Squirro recommends reviewing the session expiration parameters. See [Reducing Session Lifetime](../configuration/secure-config-guide.md#session-lifetime) for information.