Elastica cloud app

1. Sign in with a super administrator account to the Google Admin console.

   If you aren’t using a super administrator account, you can’t complete these steps.

2. Go to Menu  Security > Authentication > SSO with SAML applications .
3. On the Google Identity Provider details page:
   1. Next to Certificate 1, click Download to download the X.509 certificate.
   2. Click Download Metadatato save the identity provider metadata.
4. Open an Incognito browser window, go to the Elastica sign-in page , and sign in with your Elastica administrator account.
5. At the top, click User Account Settings.
6. For provider , select  Google.
7. In the appropriate field, paste the X.509 certificate that you downloaded.
8. Click Save.

1. Sign in with a super administrator account to the Google Admin console.

   If you aren’t using a super administrator account, you can’t complete these steps.

2. Go to Menu  Apps > Web and mobile apps .
3. Click Add app Search for apps.
4. For Enter app name, enter Elastica.
5. In the search results, point to Elasticaand click Select.
6. In the Google Identity Provider detailswindow, click Continue.
7. On the Service provider detailspage, for:
   • ACS URL, enter https://app.elastica.net/acs/.
   • Entity ID, enter https://app.elastica.net/.
   • Start URL, enter https://app.elastica.net/.
     If you're using the European Union (EU) cloud, replace app.elastica.netwith app.eu.elastica.net.
8. Leave the  Signed Response box unchecked.
   If you check this box, the entire response is signed. When unchecked, only the assertion is signed.
9. For Name ID, enter your primary email.
   Multiple emails are not supported. You can change the Name ID mapping to suit your requirements.
   Custom attributes of your user schema can also be used after creating them using Google Admin SDK APIs . The custom attributes must be created before setting up the Elastica app.
10. Click Continue.
11. In the Attribute Mappingwindow, click Select fieldand map the following Google directory attributes to their corresponding Elastica attributes. The Email Address, First Name, and Last Name attributes are required.

    Google directory attribute	Elastica attribute
    Basic Information >Email Address	email_attribute_name
    Basic Information >First Name	name_attribute_name
    Basic Information >Last Name	last_name_attribute_name

12. (Optional) To add additional mappings, click Add Mappingand select the fields that you need to map.
13. (Optional) To enter group names that are relevant for this app:

    1. For Group membership (optional), click Search for a group, enter one or more letters of the group name, and select the group name.
    2. Add additional groups as needed (maximum of 75 groups).
    3. For App attribute, enter the corresponding groups attribute name of the service provider.

    Regardless of how many group names you enter, the SAML response includes only groups that a user is a member of (directly or indirectly). For more information, go to  About group membership mapping .

14. Click Finish.

1. Sign in with a super administrator account to the Google Admin console.

   If you aren’t using a super administrator account, you can’t complete these steps.

2. Go to Menu  Apps > Web and mobile apps .
3. Click Elastica.
4. Click  User access.

5. To turn a service on or off for everyone in your organization, click  On for everyoneor  Off for everyone, and then click  Save.

6. (Optional) To turn a service on or off for an organizational unit:

   1. At the left, select the organizational unit.
   2. To change the Service status, select  Onor  Off.
   3. Choose one:
      • If the Service status is set to  Inherited and you want to keep the updated setting, even if the parent setting changes, click Override.
      • If the Service status is set to  Overridden, either click Inheritto revert to the same setting as its parent, or click  Saveto keep the new setting, even if the parent setting changes.
        Learn more about organizational structure .
7. (Optional) To turn on a service for a set of users across or within organizational units, select an access group. For details, go to Use groups to customize service access .
8. Ensure that your Elastica user account email domains match the primary domain of your organization’s managed Google Account.

Elastica supports both identity provider-initiated and service provider-initiated SSO.

Verify identity provider-initiated SSO

1. Sign in with a super administrator account to the Google Admin console.

   If you aren’t using a super administrator account, you can’t complete these steps.

2. Go to Menu  Apps > Web and mobile apps .
3. Click Elastica.
4. In the Elasticasection, click Test SAML login.

   The app should open in a separate tab. If it doesn’t, troubleshoot the error message and try again. For details on troubleshooting, go to SAML app error messages .

Verify service provider-initiated SSO

1. Close all browser windows.
2. Go to the Elastica sign-in page and sign in with your administrator account.
   If you're using the EU cloud, replace app.elastica.netwith app.eu.elastica.net.
3. Click Elastica.
4. Enter your Google Workspace email address and click Elastica.
   You should be redirected to the Google sign-in page.
5. Select your account and enter your password.

After your credentials are authenticated, the app should open.