Google: Workspace SAML single sign-on with a third-party identity provider

Problem

Google Workspace can delegate sign-in to a third-party SAML identity provider through SSO profiles: each profile has its own entity ID and ACS URL under https://accounts.google.com/samlrp/, "SAML authentication requests issued by Google Sign-In are never signed", Google "implements ... SAML 2.0 HTTP POST binding", "SAML assertions must be signed" with RSA-SHA256, and IdP-initiated sign-on is not supported (https://docs.cloud.google.com/architecture/identity/single-sign-on). The NameID is "the user's primary email address" and "is case-sensitive", Recipient is the ACS, Audience the entity ID, and Destination, if set, the ACS (https://support.google.com/a/answer/6330801). Profiles apply to organizational units or groups, not to single users, and super administrators are not covered by the newer profiles (https://knowledge.workspace.google.com/admin/apps/setting-up-sso, https://knowledge.workspace.google.com/admin/apps/super-administrator-sso). The Google emulator has no SAML, so an OAuth consent that must go through a company's identity provider cannot be tested.

Proposal

• SSO profiles in seed config (sign-in page URL, one or two verification certificates, the users they apply to), an unsigned AuthnRequest posted to the IdP when a covered user signs in, and POST /samlrp/:id/acs validating the signed response as documented.
• A Google web session for 14 days, the documented default, after which OAuth consent authorizes the signed-in user; users without a profile and super administrators keep the existing sign-in.

Implementation

A working version with tests and docs is on a fork branch: https://github.com/Unchallenged-com/emulate/tree/google-workspace-saml. Happy to open a pull request for it.