Company Sign-In with Google Workspace

Set up TagLogger company sign-in with Google Workspace

Before You Start

In TagLogger, open Settings, Company sign-in, pick Google Workspace (SAML), and choose Start setup. Or open the setup link your TagLogger owner sent you.
Verify your email domains first. See Company Sign-In.
You need a Google Workspace super administrator, or an administrator who can manage SAML apps.

Create the App

In the Google Admin console, open Apps, Web and mobile apps, and choose Add app, then Add custom SAML app.
Name it TagLogger and continue.
On the Google identity provider details page, choose Download Metadata and continue.
Under Service provider details, paste the values TagLogger shows:

ACS URL          https://taglogger.com/__/auth/handler
Entity ID        https://taglogger.com/sso/saml/<connection ID>
Name ID format   EMAIL
Name ID          Basic Information > Primary email

Under Attribute mapping, map Primary email to email, then finish.

Leave Start URL empty. See The App Launcher below.

Connect TagLogger to Google

In TagLogger, under Identity provider, choose Metadata file and upload the file you downloaded. Or choose Enter manually and paste the SSO URL, entity ID, and certificate from Google.
In the Google Admin console, open the TagLogger app, open User access, and turn it on for the organizational units or groups who should use TagLogger. Google says this can take up to 24 hours.
In TagLogger, choose Test sign-in and sign in as one of those users. When the test passes, the owner turns the connection on.

The App Launcher

TagLogger accepts sign-ins that start from TagLogger. Choosing TagLogger in Google’s app launcher, or Test SAML login in the Admin console, starts the sign-in at Google, and Google shows an error page. Test with Test sign-in in TagLogger. Users sign in at the TagLogger login page or open the sign-on URL TagLogger shows, https://taglogger.com/login?sso=<connection ID>. To put it in their browser, add it as a Chrome managed bookmark.

Adding Members

Google Workspace does not offer directory sync for custom SAML apps, so choose On first sign-in under Provisioning. People with access to the TagLogger app become members when they first sign in.

Certificate Renewal

Google’s SAML certificate lasts five years. Before it expires, add the new certificate in Google, add it in TagLogger under Identity provider next to the old one, switch Google to the new one, then remove the old one in TagLogger. TagLogger emails the owner 30, 7, and 1 days before the last certificate expires.