How to connect Mattermost to GSuite SAML?

paulrothrock · March 25, 2019, 10:18pm

I’m trying to figure out how (or if) Mattermost can be set up with Google’s GSuite SAML system, and it’s asking for two things I’m not sure of.

ACS URL - currently set to https://chat.example.com/login/sso/saml
Entity ID - set to https://chat.example.com/api/v4/saml/metadata

When I try to log in via SAML I get the app_not_configured_for_user error, which Google says means this:

If an SP sends a NAMEID parameter in the SAMLRequest, then this parameter must be the same as the one configured on the IdP side. Otherwise the SAMLRequest fails with this error.

My questions:

Is there a way to capture the SAML request to see what Mattermost is generating?
Has anyone gotten Google SAML working?

Thanks!

cdn1-support · June 4, 2019, 4:20pm

We have experienced the exact same behavior, but only when initiated from the service provider (Mattermost). Exact same configuration with the exact same error.

Interestingly enough, when initiated from the identity provider (from within Gsuite) we are able to log in to Mattermost just fine. There is definitely something strange Mattermost is doing with their Entity ID they are sending to Gsuite.