Google SSO from a non-domain specific url

[Dave Perry]

We did something similar to Andy - setup a tinyurl that redirects to https://drive.google.com/a/hull-college.ac.uk (we aren't using gmail, just all the other google apps).
Then they go straight to our IdP page.

Dave

_________________________________________________
Dave Perry
eLearning Technologist, Hull College Group

Room L34 - Queens Gardens Library
Wilberforce Drive, Queen's Gardens, Hull, HU1 3DG
Extension 2230 / Direct Dial 01482 381930

* Need a fast reply? Try elearning at hull-college.ac.uk *

-----Original Message-----
From: users-bounces at shibboleth.net [mailto:users-bounces at shibboleth.net] On Behalf Of Andrew Morgan
Sent: 29 January 2015 18:24
To: Shib Users
Subject: Re: Google SSO from a non-domain specific url

On Thu, 29 Jan 2015, Andrew Cheung wrote:

> Hi. I have configured Shibboleth (version 2.4.3) to SSO to Google apps 
> using Shibboleth as IDP (the data store is eDirectory and integration 
> is done via LDAP).
> Our google domain is dev.mySiteA.ca. We also integrated Shibboleth as 
> our IDP for our intranet (our intranet website is based on dotCMS system).

Same here.

> The setup works in the following scenarios:
>
> 1. User loads the intranet website url in a browser and gets the 
> intranet login page. Upon entering his credentials, he logs into the 
> intranet. In the intranet website, he clicks on the link for google 
> mail(
> http://mail.google.com/a/dev.mySiteA.ca) and he can SSO to the google 
> email page.
>
> 2. If user enters in http://mail.google.com/a/dev.mySiteA.ca in a 
> browser, he is directed to the intranet login page. Upon entering his 
> credentials, he can SSO to the google email page.

Yep.

> The following is what DOES NOT work :
>
> User enters gmail.com as the url in the browser. He gets the google 
> login page. After entering his full emailaddress 
> (joesmith at dev.mysiteA.ca), he is directed to the intranet login page. 
> So this means that he has to do a "double-sign-on" if he starts with the generic gmail.com in a browser.

Same thing happens for us.  If you go to gmail.com, Google doesn't know which domain "you" belong to, so it asks you to login.  BTW, you don't have to enter your password here (assuming you set a Google password). 
Entering your google username (email address) is sufficient and will cause Google to redirect to your SSO system with a SAML Authn request.

> My question is : Is there a way to make SSO work in this scenario so 
> that user only needs to enter his credentials once?

If your user has already established an SSO session with your Shibboleth IDP, then they should bounce through Shibboleth and back to Google without prompting for credentials.  If they don't have an SSO session, then Shibboleth will ask for credentials.

There is no way to avoid passing through 2 login pages in this case. 
Google's login page establishes which Google domain to use.  Any password you enter on Google login form is simply ignored by Google when you have configured SSO.

At OSU, we configured a Google "portal" page with login links.  You can see it at http://oregonstate.edu/google.

 	Andy
--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net

**********************************************************************
This message is sent in confidence for the addressee
only. It may  contain confidential or sensitive
information.  The contents are not to be disclosed
to anyone other than the addressee.  Unauthorised
recipients are requested to preserve this
confidentiality and to advise us of any errors in
transmission.  Any views expressed in this message
are solely the views of the individual and do not
represent the views of the College.  Nothing in this
message should be construed as creating a contract.

Hull College owns the email infrastructure, including the contents.

Hull College is committed to sustainability, please reflect before printing this email.
**********************************************************************

TEXT