Connect Google Workspace

Available onEnterprise

Who can do thisWorkspace owners in Infyva, and a Google Workspace super admin

Google Workspace connects to Infyva through a custom SAML app in the Google Admin console. That is the setup we recommend. If you would rather use OpenID Connect, there is a second option at the end of this page that uses a Google Cloud OAuth client.

Before you start

• Your workspace is on Enterprise. Single sign-on is not part of Starter, Pro or the Pro trial.
• You are a workspace owner in Infyva. Admins can open the page and choose the role new teammates get, but only owners can connect a provider, verify domains or turn SSO on.
• You can add a DNS TXT record for your company email domain, or you know who can.
• You can open Infyva's SSO page: in the sidebar click Settings, then Single sign-on (under Security). If the page shows Set up single sign-on with Coming soon, single sign-on is not switched on for your workspace yet. Email support@infyva.ai.
• Keep a second browser window, or a private window, for testing. Stay signed in to Infyva as an owner in the first one until SSO works.

Values to copy from Infyva

Open Settings > Single sign-on in Infyva and choose the SAML tab. Copy these with the Copy buttons.

In Infyva	Paste into	Value
ACS URL (reply URL)	ACS URL	https://sso.infyva.ai/api/oauth/saml
Entity ID (audience)	Entity ID	https://sso.infyva.ai
Our metadata	Service provider metadata (if your provider can import it)	https://sso.infyva.ai/.well-known/sp-metadata

Step 1: Add the custom SAML app

1. Sign in to the Google Admin console as a super admin.
2. Open Menu > Apps > Web and mobile apps.
3. Click Add app > Add custom SAML app.
4. Set App name to Infyva and click Continue.
5. On Google Identity Provider details, under Option 1, click Download Metadata. Keep the file. Click Continue.

Google's guide: Set up your own custom SAML app.

Step 2: Paste Infyva's values

On Service provider details:

1. ACS URL: paste Infyva's ACS URL (reply URL).
2. Entity ID: paste Infyva's Entity ID (audience).
3. Start URL: optional. Set it to https://www.infyva.ai/auth/login so the Infyva tile in Google's app launcher opens the Infyva sign-in page.
4. Leave Signed response unticked.
5. Under Name ID, set Name ID format to EMAIL and Name ID to Basic Information > Primary email.
6. Click Continue.

Step 3: Map the attributes

On Attribute mapping, click Add mapping three times. The app attribute names are case-sensitive.

Google Directory attribute	App attribute	Used by Infyva for
Basic Information > Primary email	email	Email (required)
Basic Information > First name	firstName	First name
Basic Information > Last name	lastName	Last name

Leave Group membership empty. Infyva does not use groups. Click Finish.

Step 4: Turn the app on for your users

1. On the Infyva app's page, click User access.
2. Choose ON for everyone, or pick an organisational unit or group and set it to ON.
3. Click Save.

Google can take up to 24 hours to apply this, though it is usually much quicker.

Step 5: Save the connection in Infyva

1. In Infyva, on the SAML tab, drop the metadata file from Step 1 on Upload the metadata XML file, or click it to choose the file.
2. Click Save connection.

You see Identity provider connected.

Verify your email domain in Infyva

Only people whose email address is on a verified domain can sign in with SSO.

1. In Infyva, on the Single sign-on page, go to 2 Verify your email domain.
2. Type your domain, for example northwindlabs.com, and click Add domain.
3. Copy the Name and Value with their Copy buttons and add them as a TXT record at your DNS provider.
4. Click Check now. When the badge changes from Waiting for DNS to Verified, you are done.

DNS changes can take a few minutes, sometimes longer. Details and limits: Verify your domain.

Turn on SSO and test it

Infyva has no separate test button. You test by signing in.

1. Go to 3 Turn it on. Switch on Allow sign-in with SSO.
2. Under New teammates join as, choose Recruiter or Viewer. This is the role a person gets the first time they sign in with SSO.
3. Click Save.
4. In a private window, open the Infyva sign-in page.
5. Type your work email in the email field, then click Sign in with SSO. Do not type a password.
6. Sign in at your identity provider. You come back to Infyva and land in your workspace.

The Status panel on the right now shows On and the time of the Last SSO sign-in. The sign-in is also in your audit log.

Start sign-in from Infyva

Infyva supports sign-in that starts on the Infyva sign-in page. Sign-in that starts from a tile in your provider's app launcher, or from a provider's own Test button that signs in from the provider side, is not supported. Point the tile at https://www.infyva.ai/auth/login, or hide it.

Require SSO

Once one SSO sign-in has worked, you can make SSO the only way in for your verified domains.

1. On the Single sign-on page, switch on Require SSO. The switch stays greyed out until the first successful SSO sign-in.
2. Click Save.

From then on:

• People on your verified domains can no longer sign in with a password. They see Your workspace requires single sign-on. Use "Sign in with SSO" instead.
• Password sessions that were already open for those people end. Someone already signed in is asked to sign in again when their current session runs out.
• Workspace owners keep password sign-in, so an owner can still get in if your identity provider is down. Read Require SSO and the owner fallback before you turn this on.

To also protect links you send to hiring managers, see Require SSO on hiring-manager links.

Roll back

• To pause SSO, switch off Allow sign-in with SSO and click Save. Everyone signs in with passwords again.
• To remove it completely, click Turn off and remove SSO in the Status panel. People keep their Infyva accounts.
• If you click Replace and save a new connection, Infyva turns Require SSO off until someone signs in with SSO again. This stops a broken connection from locking your team out.

Troubleshooting Google Workspace

What you see	Likely cause	Fix
Google: 403 app_not_configured_for_user	The Entity ID in Google does not match Infyva's, or the app is off for this person	Paste the Entity ID (audience) again, and check User access
Google: 403 app_not_enabled_for_user	The app is OFF for this person's organisational unit or group	Turn it on in User access and wait for it to apply
Infyva: Your identity provider did not complete the sign-in. Please try again.	No email was sent	Check that Primary email maps to email and that Name ID format is EMAIL
Infyva: <email> is not on a verified domain for this workspace.	The person's primary email is on a secondary domain you have not verified	Verify that domain in Infyva too. You can verify up to 10 domains.

Google's list of errors: SAML app error messages. More: Troubleshooting SSO.

Option: Google with OIDC

Use this only if your team prefers OpenID Connect. It uses Google's own sign-in, and Infyva lets in only people whose email is on a domain you verified.

1. In the Google Cloud console, pick or create a project that belongs to your Workspace organisation.

2. Set up the OAuth consent screen with the user type Internal, so only accounts in your organisation can use it.

3. Go to APIs & Services > Credentials > Create credentials > OAuth client ID.

4. Choose Web application, name it Infyva, and under Authorized redirect URIs paste Infyva's Redirect URL from the OIDC tab.

   In Infyva	Paste into	Value
   Redirect URL	Authorized redirect URIs	https://sso.infyva.ai/api/oauth/oidc

5. Click Create and copy the Client ID and Client secret.

6. In Infyva, on the OIDC tab, enter:

   • Discovery URL: https://accounts.google.com/.well-known/openid-configuration
   • Client ID and Client secret from step 5.

7. Click Save connection, then verify your domain and test as described above.

Google's guides: Manage OAuth clients and OpenID Connect.

Limits in this release

• No SCIM. Infyva does not receive user or group updates from your provider. Accounts are created the first time someone signs in. When someone leaves, block them in your provider and choose Suspend account in Settings > Team and roles. Remove alone is not enough: a removed person who can still sign in at your provider joins again on their next SSO sign-in.
• No group or role mapping. Everyone who joins through SSO gets the role set in New teammates join as. Change roles afterwards in Team and roles.
• Sign-in starts from Infyva. Sign-in started from your provider's app tile is not supported.
• One identity provider per workspace. Saving a new one replaces the old one.
• Metadata is read once. If you give a metadata URL, Infyva reads it when you click Save connection. After a certificate change at your provider, save the connection again.
• Team members only. Candidates never sign in with SSO.

Next steps

• Require SSO and the owner fallback
• Accounts, roles and limits