SSO with multiple Google domains

[Andrew Morgan]

On Thu, 2 Nov 2017, Knape, Dean M. wrote:

> Hello,
>
> We're a G Suite for Education customer and are exploring supporting a setup
> consisting of a primary domain and multiple secondary domains, where a user
> may exist in one or more of the domains simultaneously and the user's
> username would be common across domains.
>
> Unfortunately, Google is not able to issue domain specific authentication
> requests for this type setup.  The ACS URL and Issuer are based on the
> primary domain in all cases.
>
> Google is suggesting using the relay state of the authentication request to
> derive domain information which can then be used to build the appropriate
> email address for the SAML response.  Is this something that can be done in
> the IdP?
>
> Are there other options/recommendations?
>
> dean

Dean,

Do you have multiple instances of G Suite or one instance with multiple 
domains registered?

We have both, actually, because we have a test instance of G Suite and a 
production instance of G Suite.  In both of those instances, our users 
have multiple domains on their accounts, all with the same username 
(left-hand of at-sign).

When we auth for the production instance, we always assert the primary 
domain back to Google.  Let me give you a concrete example...

My Google account:

   User: morgan at oregonstate.edu
   Aliases: morgan at onid.oregonstate.edu

I can type either of these usernames into Google's login form and they 
will redirect me to our IDP.  In the SAML assertion back to Google, we 
assert the NameID with a value of "morgan at oregonstate.edu".

Internally, we implemented this by creating a new attribute in LDAP named 
"googlePrincipalName".  We store the user's Google username in that 
attribute, and Shibboleth resolves it to generate the NameID value. 
Perhaps you can use this method to store the correct mapping to Google 
username for each user.

Thanks,
 	Andy