Google SSO from a non-domain specific url

[Andrew Morgan]

On Thu, 29 Jan 2015, Andrew Cheung wrote:

> Hi. I have configured Shibboleth (version 2.4.3) to SSO to Google apps
> using Shibboleth as IDP (the data store is eDirectory and integration is
> done via LDAP).
> Our google domain is dev.mySiteA.ca. We also integrated Shibboleth as our
> IDP for our intranet (our intranet website is based on dotCMS system).

Same here.

> The setup works in the following scenarios:
>
> 1. User loads the intranet website url in a browser and gets the intranet
> login page. Upon entering his credentials, he logs into the intranet. In
> the intranet website, he clicks on the link for google mail(
> http://mail.google.com/a/dev.mySiteA.ca) and he can SSO to the google email
> page.
>
> 2. If user enters in http://mail.google.com/a/dev.mySiteA.ca in a browser,
> he is directed to the intranet login page. Upon entering his credentials,
> he can SSO to the google email page.

Yep.

> The following is what DOES NOT work :
>
> User enters gmail.com as the url in the browser. He gets the google login
> page. After entering his full emailaddress (joesmith at dev.mysiteA.ca), he is
> directed to the intranet login page. So this means that he has to do a
> "double-sign-on" if he starts with the generic gmail.com in a browser.

Same thing happens for us.  If you go to gmail.com, Google doesn't know 
which domain "you" belong to, so it asks you to login.  BTW, you don't 
have to enter your password here (assuming you set a Google password). 
Entering your google username (email address) is sufficient and will cause 
Google to redirect to your SSO system with a SAML Authn request.

> My question is : Is there a way to make SSO work in this scenario so that
> user only needs to enter his credentials once?

If your user has already established an SSO session with your Shibboleth 
IDP, then they should bounce through Shibboleth and back to Google without 
prompting for credentials.  If they don't have an SSO session, then 
Shibboleth will ask for credentials.

There is no way to avoid passing through 2 login pages in this case. 
Google's login page establishes which Google domain to use.  Any password 
you enter on Google login form is simply ignored by Google when you have 
configured SSO.

At OSU, we configured a Google "portal" page with login links.  You can 
see it at http://oregonstate.edu/google.

 	Andy