G Suite (Google)
This guide walks you through configuring your G Suite service as a SAML SSO identity provider (IDP) for the Pulumi Console.
Creating the SAML Application
In the administrator console for your G Suite domain, open the flyout menu in the upper-left corner and choose Apps > SAML Apps.
Click the + symbol in the lower-right corner to create a new SAML application.
In the first step, click Set Up My Own Custom App.
Next, choose Option 2: Download IDP Metadata to download an XML document that identifies and describes your G Suite domain as a SAML identity provider. You will need this document to complete the process of configuring your Pulumi organization. For now, note the location of the downloaded file, then click Next to continue.
Give your SAML application a name such as Pulumi Console and an optional description and logo, then click Next.
In step 4, for the required ACS URL and Entity ID fields, enter the fully-qualified URLs of the
metadataendpoints of the Pulumi API, adjusted for your Pulumi organization name.
The values you need to use are dependent upon your organization's name on Pulumi. Be sure to replace
acmecorpwith your actual organization name.
SAML Setting Value ACS URL
Name ID Format
Important: Do not change the value of Name ID Format value once your users have started using Pulumi—not even switching its value between
Leave the other fields as their default values, then click Next.
The final step—attribute mapping—is optional, but you may wish to specify proper first and last names for your Pulumi users, based on their Google account profiles. The Pulumi service expects to receive these fields as
Once you add them, click Finish and OK to confirm.
On the next screen, enable your newly created SAML application for your Google domain users:
Click Save to complete.
At this point, you’re done configuring G Suite, and can move on to completing SAML SSO setup in the Pulumi Console.
Configuring Your Pulumi Organization
The final step in the process consists of associating your Pulumi organization with your SSO identity provider.
Sign into the Pulumi Console where your SAML organization resides, then navigate to the Settings tab for that organization.
Scroll to the SAML SSO Settings section, click on the Identity Provider Metadata field, and paste the full contents of the XML IDP document you have previously downloaded.
Your Pulumi organization is now configured to use Google as a SAML SSO identity provider.
Signing into Pulumi with Google
Members of your G Suite can now sign into Pulumi. Navigate to https://app.pulumi.com/signin/sso/ and enter the name of your Pulumi organization.
If you have any trouble configuring G Suite, signing into Pulumi, or need additional assistance, contact us.