Skip to main content

Google SSO Integration

This guide walks IT administrators through configuring Google Workspace (or Cloud Identity) SAML SSO for Bicycle.

Prerequisites

You need a Google Workspace or Cloud Identity admin account that can manage Directory → Groups and Apps → Web and mobile apps.

For Entity ID, ACS URL, and Bicycle Admin fields, see SAML Integration.

Step 1: Create groups​

Go to the Admin dashboard: https://admin.google.com/ac/groups.

Bicycle has three roles — Admin, Editor, and Viewer — so you can either:

  • Create one group for each of the three roles, or
  • Create groups for Admin and Editor only, and have Bicycle treat any other user who can sign in as Viewer

Create a group​

  1. Select Directory → Groups, then click Create group.

Create group in Google Admin

  1. Enter a group name (for example, BicycleAdmins), email, and optional group owners.

Enter BicycleAdmins group name and email

  1. Configure access types according to your policy.

Configure group access types

  1. Add member restrictions if needed, then click Create group.

Member restrictions for the group

Group created confirmation

  1. Repeat for each group you need (for example, BicycleEditors, BicycleViewers).

Assign people to groups​

  1. Go to Directory → Groups (https://admin.google.com/ac/groups).
  2. Open the group (for example, BicycleAdmins).

Select the BicycleAdmins group

  1. Add the people who should have that Bicycle role.

Add members to BicycleAdmins

Groups are now ready for Bicycle.

Step 2: Create a SAML app for Bicycle​

  1. Go to the Admin dashboard: https://admin.google.com/ac/apps.
  2. Select Apps → Overview, then open Web and mobile apps.

Web and mobile apps in Google Admin

  1. Click Add app → Add custom SAML app.

Add custom SAML app

  1. Enter the app name (and optional description), then click Continue.

Enter Bicycle app name

Share SAML IdP details with Bicycle​

On the Google Identity Provider details page, share either:

  • The IdP metadata, or
  • SSO URL, Entity ID, Certificate, and SHA-256 fingerprint

Google IdP SSO URL, Entity ID, and certificate

Configure service provider details​

Enter the values provided by Bicycle:

FieldValue
ACS URLhttps://app.bicycle.ai/api-proxy/api/tenants/auth/login/saml/callback
Entity IDhttps://app.bicycle.ai
Start URL(optional) tenant login URL from Bicycle, for example https://app.bicycle.ai/{tenant}/login
Name ID formatEMAIL
Name IDBasic Information → Primary email

Service provider details and Name ID

Group membership​

  1. In Group membership, add an app attribute named groups.
  2. Select the Bicycle groups created earlier (and any default Viewer group, if you use that option).

Map Bicycle groups to the groups attribute

  1. Click Finish to add the app.

Step 3: Turn on access for the SAML app​

  1. Go to Apps → Overview → Web and mobile apps (https://admin.google.com/ac/apps).
  2. Open the Bicycle app → User access.
  3. Select the appropriate groups or organizational units and set Service status to ON.

Turn on user access for the Bicycle SAML app

Artefacts to share with Bicycle​

ArtefactSource
SSO URL (Login URL)Google IdP details
Entity ID (Issuer)Google IdP details
CertificateGoogle IdP details (Base64)
Group namesExact Directory group names
Email domainYour Workspace primary domain

Bicycle completes configuration under Admin → Authentication. See Configure SSO in Bicycle.

Need help?​

Contact your Bicycle implementation team or email support@bicycle.ai.