SSO with Google Workspace

Teams

This guide walks you through setting up SAML Single Sign-On between Google Workspace and Lynkle.

Before you start

  • A Lynkle Teams subscription with organization owner role
  • Google Workspace super admin access
  • Access to your domain's DNS settings
  • Each SSO user invited to your Lynkle organization

Setup

  1. Get your Lynkle SP values

    In Lynkle, go to Settings > Security. Note the three values displayed below the identity provider configuration form:

    • SP Entity ID (Entity ID)
    • ACS URL (Assertion Consumer Service URL)
    • Metadata URL
  2. Create a custom SAML app in Google Workspace
    1. Sign in to the Google Admin console.
    2. Go to Apps > Web and mobile apps.
    3. Click Add app > Add custom SAML app.
    4. Enter "Lynkle" as the app name, optionally upload an icon, and click Continue.
  3. Copy the Google IdP values

    On the Google Identity Provider details page, copy the SSO URL, Entity ID, and Certificate values. You will enter them in Lynkle later.

    Click Continue.

  4. Configure the service provider details in Google

    On the Service provider details page, enter:

    • ACS URL: paste the ACS URL from Lynkle
    • Entity ID: paste the SP Entity ID from Lynkle
    • Name ID format: select EMAIL
    • Name ID: select Basic Information > Primary email

    Click Continue, then click Finish.

    Lynkle identifies users by email address. Make sure you set the Name ID format to EMAIL and the Name ID to Primary email.

  5. Turn on the app for your users

    After creating the app, you'll land on its settings page. By default the app is turned off for everyone.

    1. In the User access section, click Off for everyone.
    2. Select On for everyone (or choose specific organizational units).
    3. Click Save.

    Changes in Google Workspace can take up to 24 hours to propagate, but typically take effect within a few minutes.

  6. Configure Lynkle with the Google IdP values

    In Lynkle (Settings > Security), enter the identity provider details:

    • Entity ID: the Entity ID from the Google IdP details page
    • SSO URL: the SSO URL from the Google IdP details page
    • Signing Certificate: open the downloaded certificate file in a text editor and paste its contents

    Click Save Configuration.

    Invite each SSO user under Settings > People. Their first SAML login creates their Lynkle account if needed and activates the invited membership.

  7. Verify your domain in Lynkle
    1. In Lynkle (Settings > Security), scroll to the Verify Domains section.
    2. Enter your email domain (for example, yourcompany.com) and click Add Domain.
    3. Lynkle displays a DNS TXT record to add:
      • Host: _lynkle-sso.yourcompany.com
      • Value: the verification token shown in the dashboard
    4. Add this TXT record in your DNS provider.
    5. Once the DNS record has propagated, click Verify in Lynkle.
  8. Configure policies

    Optionally enable Require SSO for all team members to enforce SSO login for non-owner members.

    See SAML SSO for details on these policies.

Testing

Before enforcing SSO, test the connection:

  1. Open an incognito or private browser window.
  2. Go to the Lynkle login page and click Single Sign-On (SSO).
  3. Enter the email address of a user in your Google Workspace organization.
  4. You should be redirected to Google's sign-in page. After authenticating, you should be signed in to Lynkle.

If the test fails, check that the Name ID is set to Primary email and that the app is turned on for the user's organizational unit.

Troubleshooting

  • "SAML authentication failed" error: Verify that the Entity ID and ACS URL in Google Workspace exactly match the SP values shown in Lynkle. Also confirm the signing certificate hasn't expired.
  • User sees "app_not_configured_for_user" error from Google: The app is turned off for the user's organizational unit. Go to Apps > Web and mobile apps > Lynkle > User access and enable it.
  • User is authenticated but gets an error in Lynkle: Check that the Name ID format is set to EMAIL and maps to Primary email. Lynkle requires the email address to identify users.
  • Domain verification fails: DNS propagation can take up to 48 hours. Confirm the TXT record is set on _lynkle-sso.yourcompany.com (not the bare domain) with the exact verification token value.