G-Suite

Enable passwordless, biometric login for your Google Workspace users using 1K as a SAML 2.0 Identity Provider. Once connected, users authenticate with Touch ID, Face ID, or LiveID.

---

Prerequisites

Before starting, make sure you have:

• AdminX portal — Admin access to your 1Kosmos AdminX tenant.

• Google Cloud Platform (GCP) — Admin access to create projects and service accounts.

• Google Admin Console — Admin access to configure domain-wide delegation and SSO settings.

• 1Kosmos mobile app — Installed and enrolled on iOS or Android. (Android · iOS)

  • Biometrics (Touch ID / Face ID or LiveID) must be enrolled before testing.

---

Step 1 — Create a GCP Service Account

Note: These steps are performed by your Google Cloud administrator.

1. Sign in to your Google Cloud Platform console.

2. Click the project dropdown next to the Google Cloud Platform heading and select NEW PROJECT.

3. Enter a Project Name, select your Organization and Location, then click Create.

4. Once created, select the new project from the Notifications panel.

5. Go to Navigation menu → IAM & Admin → Service Accounts.

6. Click Create Service Account, enter a name and description, then click Done.

7. Click on the newly created service account and copy and save the Email and Unique ID — you'll need both in AdminX.

---

Step 2 — Add Domain-Wide Delegation

Note: These steps are performed by your Google Admin Console administrator.

1. Sign in to your Google Admin Console.

2. Go to Security → API Controls → Manage Domain Wide Delegation.

3. Click Add new and enter the following:

   Field	Value
   Client ID	The Unique ID of your service account (from Step 1)
   OAuth Scopes	https://apps-apis.google.com/a/feeds/domain/

4. Click Authorize.

---

Step 3 — Generate a Private Key for the Service Account

Note: These steps are performed by your Google Cloud administrator.

1. In GCP, go to IAM & Admin → Service Accounts and open your service account.

2. Click the Keys tab → Add Key → Create new key.

3. Select JSON as the key type and click Create. The key file downloads automatically.

4. Open the JSON file and save the private key value — you'll need it in AdminX.

---

Step 4 — Connect Google Workspace in AdminX

Note: These steps are performed by your AdminX administrator.

1. Sign in to the AdminX portal and go to Applications → Add Application.

2. Under Pre-built integrations, click Add Integration on the Google Workspace card.

3. Fill in the following fields:

   Field	Value
   Application Name	A display name for this integration
   Google Workspace Domain	Your domain without http:// or https:// (e.g., yourorganization.org)
   Service Account Email	The service account email saved in Step 1
   Admin Email	The GCP admin Gmail address used to create the project
   Service Account Private Key	The private key value from the JSON file in Step 3

4. Click Connect.

AdminX automatically generates the SAML SP configuration in Google Workspace and enables the integration.

---

Step 5 — Export the IDP Signing Certificate from AdminX

1. In the AdminX portal, go to Settings → IDP Configuration.

2. Copy the certificate from the Signing Certificate section.

3. Save it as a .cert file — you'll upload this to Google Admin Console in the next step.

---

Step 6 — Configure SSO in Google Admin Console

Note: These steps are performed by your Google Admin Console administrator.

1. Sign in to your Google Admin Console.

2. Go to Security → Settings and click Set up single sign-on (SSO) with a third party IdP.

3. Enter the SSO details generated by AdminX:

   • Sign-on Page URL — from AdminX IDP Configuration

   • Sign-out Page URL — from AdminX IDP Configuration

   • Verification certificate — upload the .cert file exported in Step 5

4. Save your settings.

---

Step 7 — Test the Connection

Note: These steps should be performed by a Google Workspace domain user.

1. Open a browser and go to your Google Workspace domain URL.

2. You'll be redirected to the 1Kosmos AdminX login screen with a QR code.

3. On the 1Kosmos mobile app home screen, tap Scan QR.

4. Scan the QR code. When prompted, select Allow only while using the app.

5. Tap Authenticate and complete biometric verification (Touch ID, Face ID, or LiveID).

6. On success, you'll be logged in to your Google Workspace account.