In this article, you'll learn how to set up SAML SSO with Google Workspace, allowing you to:
- Control in Google Admin who has access to Productboard.
- Enable your users to automatically sign in to Productboard with their Google accounts.
- Manage your accounts in one central location – in Google Admin.
- Change the default role for users managed in Google Workspace, from contributor to admin, maker, or viewer.
In this article:
- Configure SAML SSO in Google Workspace
- Turn on your SAML app and grant access to Google users
- Configure SAML SSO in Productboard
- Change the default role for new users
- Create a new user and assign a custom user role
- Disable SAML SSO
- Troubleshooting
Configure SAML SSO in Google Workspace
1. Sign in to your Google Admin console. The Admin console is where administrators manage Google services for people in an organization. Click Apps.
2. From the Apps page, select SAML apps.
3. Select: Add App → Add custom SAML app.
4. Fill in the App details. We recommend typing "Productboard", as this name will be shown in the list of your SAML apps in the Google Admin console.
5. On this screen, you will see metadata. Click Continue - we will return to this screen later.
6. You can use the details below to fill in the Service provider details:
- In the ACS(Assertion Consumer Service) URL field, type a URL using the following format.
https://<YOUR_WORKSPACE_NAME>.productboard.com/users/auth/saml/callbackNote: ⚠️ Don't forget to update the URL with your actual workspace name.
- In the Entity ID field, type:
productboard
- For Name ID Format, select:
EMAIL -
NameID should be pre-selected with:
Basic Information > Primary Email - Select Continue
7. For Attribute Mapping, you'll need to add two mappings - First name and Last name mappings. These two mappings are mandatory and you can't skip this step.
Note: The default user role for new users will be Contributor. To change the role, see Change the user role for new users.
Examples of the attribute names we support.
| First Name | Last Name |
| givenname | surname |
| FirstName | LastName |
| first_name | last_name |
| firstname | lastname |
| firstName | lastName |
| User.FirstName | User.LastName |
8. Select Finish! 🎉
Turn on your SAML app and grant access to the organization
1. From the Admin console Home page, go to Apps → SAML apps.
2. Select your SAML app Productboard.
3. Select User Access to turn ON or OFF the access for everybody in the organization.
4. Select On for everyone and click Save.
5. Make sure you have added Users to the organization (or granted permission to yourself/ an admin who is setting SAML SSO in Productboard) in Google Admin → Directory → Users/Groups before moving on to configure SAML SSO in Productboard.
Configure SAML SSO in Productboard
1. Select your Avatar —> Settings —> Enforce SAML SSO —> Manual configuration. (As of the time of writing, it's only possible to set the SSO manually, so make sure you have selected Manual Configuration!)
2. In a separate tab, open up your Google Admin console. Select Apps —> SAML Apps —> Productboard app.
- Then select: Download Metadata
- You will see a popup window with the SSO URL and Certificate that you will need to copy-paste into Productboard.
3. Here is how the filled configuration in Productboard should look.
- For the Name field, we recommend typing Google workspace, since that name will be shown on the Productboard login page.
- You can use either the Certificate or the Certificate Fingerprint, but you will not need both.
4. Save & authorize the SAML SSO.
5. You will be automatically logged out and asked to log in using Google workspace.
6. Sign in using your Google account and check that everything is working as expected!
Note: Productboard members will be able to access Productboard uninterrupted during the SSO configuration process. Once the configuration is finalized, all members will automatically be logged out and prompted to log in via SSO.
Change the default role for new users
The default role for new users is Contributor, but you can switch the role to Viewer, Admin or Editor by following the steps below. (For more information about Productboard access roles, see here.)
1. Go to Users —> More —> Manage custom Attributes.
2. Select Add Custom Attribute.
3. Fill in the custom attribute with the details from the screenshot. The example above is for Viewer.
4. Now you need to go back to the App settings and add the Attribute mapping. Select SAML Attribute Mapping.
5. Select Add Mapping.
6. Select Viewer (or Admin or Editor) for the Productboard role. For the App attribute, type pb_role. Click Save.
Create a new user and assign a custom user role
1. From the Admin console Home page, go to Users → Add new user. Add the required personal information and click Add new user.
2. On the screen with the user password, select More actions → Edit user.
3. You will see a screen with all of the user details. Scroll down until you see the custom user role attribute you created (see above).
4. You need to type viewer and save the changes. Now the new user will have viewer access when he/she signs up in Productboard. If you don't type viewer in that field the user role will be the default one which is a contributor.
That's it! 🎉 Your new user has the access role you specified.
Note: You must perform this workflow every time you create a new user. If you do not manually assign a role in this custom field, the user will be created with a contributor access role.
Disable SAML SSO
You can disable the SAML SSO integration at any time in your Productboard Settings, which you can access via the avatar menu in the bottom left corner.
The next time members log in, those who haven't set a Productboard password will be required to reset their password to receive login instructions via email.
If you wish to delete the Productboard application from Google Workspace, you can do it from here:
Troubleshooting
My certificate expired and I lost access to Productboard. How can I update the new certificate?
Let us know here, or email us at support@productboard.com. We can disable the SAML for you. Then you will be able to log in and update the certificate manually.
I've authorized SAML SSO, but I forgot to add any users in my IdP — what should I do?
If you feel you aren't ready and need to turn off your authorized SAML SSO settings from the space, the owner of the space can contact our Support team and we'll remove it for you. However, we need an admin who has ownership of the space to request this.
How can I learn more about Google Workspace SAML SSO?
See Google Workplace's documentation here.
Comments
Article is closed for comments.