This article describes how to integrate Cloud Access Service (CAS) with Google Cloud Workforce Identity using SAML My Page. 

Configure CAS

Perform these steps to configure CAS.

Procedure

1. Sign in to the RSA Cloud Administration Console and go to Applications > Application Catalog.

2. Click Create From Template. For SAML Direct, click Select.

   

3. On the Basic Information page, configure the application:

   1. Click Cloud.

   2. Enter a name for the application.

   3. Optionally, enter a description and application owner email address.

   4. Click Next Step.

   

4. On the Connection Profile page, configure the SAML workflow:

   1. In the Initiate SAML Workflow section, choose IdP-initiated.

   2. Under Data Input Method, choose Enter Manually.

5. In the Service Provider section, configure the values that you copy from Google Cloud Workforce Identity:

   1. Assertion Consumer Service (ACS) URL: Enter the Google Cloud Workforce Identity Redirect URI (for example, https://domain-name/auth/handler).

   2. Audience (Service Provider Entity ID): Enter the Google Cloud Workforce Identity Identifier (Entity ID).

   

6. In the Identity Provider section, make a note of the RSA Identity Provider URL. You need this value for the Google Cloud Workforce Identity configuration.

7. In the SAML Response Protection section, choose IdP signs assertion within response, and then click Download Certificate.

   

8. Expand Connection Profile Advanced Configuration. In the User Identity section, configure:

   1. Name ID Format: emailAddress

   2. User Attribute for SAML Response Subject: mail

   

9. In the Statement Attributes section, add the following attributes:

   1. SAML Attribute Name: lastname
      Attribute Source: Identity Source
      User Attribute/Value: Last Name, or the equivalent last-name attribute in your identity source

   2. SAML Attribute Name: firstname
      Attribute Source: Identity Source
      User Attribute/Value: First Name, or the equivalent first-name attribute in your identity source

   3. SAML Attribute Name: email
      Attribute Source: Identity Source
      User Attribute/Value: Email, or the equivalent email attribute in your identity source

   

10. Click Next Step.

11. On the User Access page, in 2.0 Access Policy for Authentication, select the access policy that determines which users can access the application.

12. Click Next Step.

    

13. On the Portal Display page, configure how the application appears in My Page, and then click Next Step.

    

14. On the Fulfillment page, configure the fulfillment settings for your deployment, or leave fulfillment disabled.

15. Click Save and Finish.

16. Click Publish Changes, and wait for the operation to finish.

17. Export the RSA IdP metadata:

    1. Open the application.

    2. In the Edit menu, click Export Metadata.

    3. Save the metadata file for the Google Cloud Workforce Identity provider configuration.

    

Configure Google Cloud Workforce Identity

Perform these steps to configure Google Cloud Workforce Identity.

Procedure

1. Sign in to the Cloud Workforce Identity Admin console with an administrator account, and in the search window, search for IAM & Admin/ Workforce identity pools.

2. Go to IAM & Admin > Workforce Identity Federation, and then click Create pool.

   

3. Create the workforce pool:

   1. Enter a name for the pool.

   2. Click Next.

   

4. Create the SAML provider:

   1. In Select a Provider vendor, select the applicable provider vendor.

   2. Under Select an authentication protocol, select SAML.

   3. Enter a name for the provider.

   4. Click Browse, and upload the RSA IdP metadata file.

   5. Click Continue.

   

5. Under Share your provider information with IdP, copy the following values:

   1. Identifier (Entity ID): Use this value as the RSA service provider entity ID.

   2. Redirect URI: Use this value as the RSA ACS URL.

   3. Click Continue.

   

6. In Enable detailed audit logging, keep detailed logging disabled unless your organization requires it, and click Submit.

   

7. Configure the attribute mappings:

   1. google.subject: assertion.subject

   2. google.email: assertion.mail

   3. google.firstname: assertion.firstname

   4. google.lastname: assertion.lastname

   5. Optionally, configure an attribute condition.

   6. Click Save and exit.

   

The configuration is complete.