Configure Google Single Sign-On (SSO) with Twilio Flex
Twilio is launching a new Console. Some screenshots on this page may show the Legacy Console and therefore may no longer be accurate. We are working to update all screenshots to reflect the new Console experience. Learn more about the new Console.
Have you already configured SSO using the
preview.twilio.com endpoint? Learn how to update your existing configuration with the Flex SSO Migration Guide. Additionally, Twilio does not yet support SP-Initiated SSO flows with Google SSO. Only IdP-Initiated SSO flows are supported at this time.
Google SSO (Single Sign-On) allows users to use their existing Google account to authorize third-party applications. This allows users to easily login to applications without needing to set up a new account, or create a new set of credentials. In this guide, you will learn how to configure Google SSO with Twilio Flex.
Prepare your Google App environment
Before we connect Google to your Flex Instance, you have to configure a few steps in the Google Admin Console to ensure your app runs smoothly.
To log in a Flex user, you must pass three mandatory attributes to Flex in the SAML. Google provides email as an attribute out of the box but does not provide the roles or full_name attributes. You will need to configure these attributes yourself.
- Navigate to the User Schema page in your Google Admin Console.
- Click on ADD CUSTOM ATTRIBUTE.
- Enter “Flex Details” for Category.
- Create the "Roles" and "Full Name" attributes below.
- Click Add to save your custom attributes.
Optionally, you can add more attributes to accommodate the attributes needed by WFO (Workforce Optimization).
Create a custom SAML app
SAML apps allow you to use Single Sign-On to authenticate once with a single set of credentials. You can then access different secured applications without needing to authenticate with different credentials each time.
- Navigate to Google Admin Console and click on Apps.
- Click Web and mobile apps
- Click on Add app > Add custom SAML app
- Enter the App name, then click Continue.
- Copy your
Entity IDand save them somewhere - you’ll need these later.
- Download your Certificate.
- Click Continue to proceed over to the Service provider details step.
Service Provider details
Next, we need to set up the Service Provider Details. Twilio Flex is the Service Provider in this instance.
Make sure to replace the Account SID (ACxxxx) with your real Account SID.
Make sure to replace the Account SID (ACxxxx) with your real Account SID!
This Login Link is available on the Twilio Console SSO configuration page.
|Name ID Format|
|Name ID||Basic Information > Primary Email|
Now we need to add attributes that will be passed from the SAML to Flex. Create the three required attributes (case sensitive) to pass to Flex and map them to the appropriate fields.
Note You need to ensure that you configured the Full Name and Roles attribute from Prepare your Google App environment. Otherwise, these attributes will not appear under the Google Directory attributes.
Add the mapped roles to your G Suite Users
- Navigate to Google Admin Console and click on Users.
- Select a user and click on their User information section
- Scroll to Flex Details, the category name you set for the custom attributes during Step 4 in Prepare your Google App environment.
- Click on the edit icon and add your roles. The current options are
Complete the setup
Now that you’ve configured your app, you must:
- Verify your domain if you haven’t already. See Verify domain ownership.
- Enable your SAML app. See the Turn on your SAML app section on Set up your own custom SAML application.
Configure Flex with your Google SSO settings
Grab the URLs you copied from Step 5 in Create a custom SAML app, and configure SSO on the Flex Console Single Sign-on settings page. Be sure that the Twilio SSO URL field matches the value you provided in Google for ACS URL. To learn more about migrating from the
preview.twilio.com URL to
iam.twilio.com see our migration guide.
|Friendly Name||Anything you want|
|x.509 Certificate||Open the .pem file you downloaded above in your favorite text editor and copy/paste the entire contents of the file including all dashes.|
|Identity Provider Issuer||Google's Entity ID (see above)|
|Single Sign-On URL||Google's SSO URL (see above)|
|Default Redirect URL||
This Login Link is available at the top of the active SSO configuration page.
Immediately after you’ve configured your IDP to use the
iam.twilio.com URL you should update the Twilio SSO URL for your account by selecting the
USES IAM.TWILIO.COM radio button.
Additional SSO configuration
Our Configuring SSO page has additional details on how to initiate login from your Identity Provider, how to login to a self-hosted domain, and details on attributes that can be defined for each identity.
Testing Google SSO
Navigate to the Google SSO IdP URL (see above) in incognito mode, login, and you should be redirected to Flex.
Congrats! You now know how to configure Google SSO with Twilio Flex. You can now authenticate yourself into Twilio Flex using your Google account!
Need some help?
We all do sometimes; code is hard. Get help now from our support team, or lean on the wisdom of the crowd by visiting Twilio's Stack Overflow Collective or browsing the Twilio tag on Stack Overflow.