3

I'm trying to set up SAML SSO where G Suite is the identity provider for Office 365 (service provider).

Google's instructions are limited: https://support.google.com/a/answer/6363817?hl=en

But I found some great help here: http://www.viewds.com/blog/making-office-365-work-with-an-external-saml-identity-provider.html

I now believe I have the SAML requests going back and forth correctly, but I've run into a snag. From the Google instructions:

The default Name ID must match the requirements set by ImmutableID. Use an Active Directory sync to configure this. Multi-value input is not supported.

This seems straightforward enough, but Google sends email address as the default Name ID and AzureAD uses an apparent UUID as the ImmutableID.

Anyone have experience here who can give guidance about how to get the two systems talking to each other correctly? Do I have to change ImmutableIDs on AzureAD? Set some sort of custom field on the Google side?

thanks!

tplants
  • 31
  • 3

2 Answers2

0

Because the question never got an accepted answer and many things changed, here is the current documentation from Microsoft where they natively support Google as IdP: https://docs.microsoft.com/en-us/azure/active-directory/external-identities/google-federation

Agyss
  • 1
  • 1
0

I wrote a script that changed all ImmutableIDs on AzureAD to match their primary email at GSuite.

I don't think it's elegant but GSuite's SAML configuration only allows sending primary email, first name, or last name as the NameID field.

As long as NameID == ImmutableID everything works.

stackexchange_user
  • 1