# Set up single sign-on with Google

> Google: Set up SAML single sign-on between Talon.One and Google.

> For the complete documentation index, see [llms.txt](https://docs.talon.one/llms.txt).

This tutorial describes how to connect Talon.One to Google to allow users to sign in to Talon.One directly from their Google account using single sign-on (SSO).

Single sign-on allows users to access many service providers using a single username and
password by relying on a single identity provider.

In this tutorial, the service provider is Talon.One, and the supported identity provider
is Google. For more information about Google, see the Google [integration documentation][googlesso].

:::important
Before you start, ensure you have read [Set up single sign-on](/docs/product/account/account-settings/set-up-sso)
to understand how it impacts your organization.
:::

## Prerequisites

- You have a Google account with [super admin rights](https://support.google.com/a/answer/172176)
  for your organization.
- You have [admin rights](/docs/product/account/account-settings/manage-roles.md#admin-role)
  in Talon.One.

## Create a Talon.One app in Google

To connect Google to Talon.One, first create an app in Google:

1. Sign in to your Google account.
1. In the Admin console, open **Menu** > **Apps** > **Web and mobile apps**.
1. Click **Add app** > **Add custom SAML app**.
1. Choose a name for the app, for example `Talon.One`.
1. Enter other app details if needed, then click **Continue**.

A **Google Identity Provider details** page opens. Keep this page open in your browser.

## Configure Talon.One for single sign-on

Let's use some of the information provided by Google to configure Talon.One.

1. In a different browser tab, sign in to Talon.One and click <Account className="icon"/> **Account** > <Organization className="icon"/> **Organization** > **Single Sign-On**.
1. Type a name in the **Connection name** field, for example, `Google`.
1. Select either **Use a URL and a certificate** or **Use an identity provider (IdP) file**.
1. If you selected **Use a URL and a certificate**:
   - Copy the value of the **SSO URL** field provided by Google and paste it into the
     **Sign-on URL** field.
   - Copy the value of the **Entity ID** field provided by Google and paste it into the
     **Issuer URL** field.
   - Copy the value of the **Certificate** field provided by Google and paste it into the
     **SSO certificate** field.
1. If you selected **Use an identity provider (IdP) file**:
   - In Google, download the **IdP metadata** file.
   - In Talon.One, click **Choose XML** and select the XML file you downloaded in the
     previous step.
1. (Optional) Select the **Enforce single sign-on** checkbox to [enforce single sign-on](/docs/product/account/account-settings/set-up-sso.md#enforce-single-sign-on)
   for all users of your organization.

   :::important
Enforcing single sign-on is a permanent action. When single sign-on is enforced, users of
your organization can sign in to Talon.One only with the domains specified in the setup.

Enforce single sign-on only when you are sure that the setup is correct and signing in
works as expected.
:::

1. Click **Enable Single Sign-On**.

## Configure Google as an identity provider

To finish setting up single sign-on for the Talon.One app in Google:

1. On the **Google Identity Provider details** page, click **Continue**.
1. Copy the value of the **Assertion Consumer Service URL (ACS)** field provided by
   Talon.One and paste it into the following fields:
   - **ACS URL**
   - **Entity ID**
1. Select the **Signed response** checkbox to indicate that Talon.One requires the entire
   SAML authentication response to be signed.
1. Click **Continue** > **Finish**.

You can now [turn on the Talon.One app][googlesso] for all users of your organization to
allow them to connect to Talon.One with their Google account.

## Use single sign-on with Talon.One

To sign in to Talon.One directly from your Google account:

1. Open your Talon.One deployment.
1. At the bottom of the Talon.One sign-in page, click `Google`.

   :::note
The single sign-on button name on the Talon.One sign-in page matches the
**Connection name** that was entered while [configuring Talon.One for single sign-on](#configure-talonone-for-single-sign-on).
:::

1. On the Google page you are redirected to, sign in to your Google account.

After you sign in to your Google account, you are redirected back to Talon.One.

## Related pages

- [Set up single sign-on](/docs/product/account/account-settings/set-up-sso.md)

[googlesso]: https://support.google.com/a/answer/6087519