This guide connects Backvera to Google Workspace with SAML single sign-on. You need admin access to both your Backvera workspace and Google Workspace. Open the Backvera SSO wizard first (Settings > SSO) and keep it open – you will copy values between the two tabs. For the full Backvera side, see Set up SSO (SAML).
1. Create the SAML app in Google Workspace
- In the Google Admin console, go to Apps > Web and mobile apps.
- Click Add app > Add custom SAML app.
- Name it Backvera and continue.
2. Enter Backvera’s details in Google
On the “Service provider details” step, set:
- ACS URL = Backvera’s ACS (Reply) URL.
- Entity ID = Backvera’s SP Entity ID.
- Name ID format = EMAIL, with Name ID = Basic Information > Primary email.
- (Optional) Add a group membership attribute so Backvera can map Google groups to roles.
3. Copy Google’s details into Backvera
On the “Google Identity Provider details” step, get:
- IdP SSO URL = Google’s SSO URL.
- IdP Entity ID = Google’s Entity ID.
- X.509 certificate = download Google’s Certificate.
4. Map groups and enable
Back in the Backvera SSO wizard, paste the three values above. Then, in Group mappings, add a mapping for each group: type the IdP group name (an exact, case-sensitive match to your group claim) and pick the Backvera role to grant – Admin, Global view, or Project (admin or view per project). The roles are a pick-list, so there is nothing to guess. Save and enable, then in Google, turn the app on for the right organisational units or groups.
5. Sign in
Members sign in from the Sign in with SSO page by entering your workspace slug, then authenticate with your identity provider. A successful sign-in lands them in your workspace with the role you mapped. If sign-in is rejected, double-check the X.509 certificate, that Name ID is the user’s email, and that your group names match the mappings exactly.
Still need help? Email our team at [email protected].