This article describes how to integrate Cloud Access Service (CAS) with Google Cloud Workforce Identity using SAML Relying Party. 

Configure CAS

Perform these steps to configure CAS.

Procedure

1. Sign in to the RSA Cloud Administration Console.

2. Click Authentication Clients > Relying Parties.

   

3. On the My Relying Parties page, click Add a Relying Party.

4. In the Relying Party Catalog, click Add for Service Provider SAML.

   

5. On the Basic Information page, enter a name for the application, and then click Next Step.

   

6. On the Authentication page, configure:

   1. Choose RSA manages all authentication.

   2. In 2.0 Access Policy for Authentication, select a previously configured access policy.

   3. Click Next Step.

   

7. On the Connection Profile page, under Data Input Method, choose Enter Manually.

8. In the Service Provider section, configure the values that you copy from Google Cloud Workforce Identity:

   1. Assertion Consumer Service (ACS) URL: Enter the Google Cloud Workforce Identity Redirect URI.

   2. Audience (Service Provider Entity ID): Enter the Google Cloud Workforce Identity Identifier (Entity ID).

   

9. In the SAML Response Protection section, select IdP signs SAML assertions, and then click Download Certificate.

   

10. Expand Advanced Configuration and add the following attributes.:

    1. SAML Attribute Name: lastname
       Attribute Source: Identity Source
       User Attribute/Value: Last Name, or the equivalent last-name attribute in your identity source
    2. SAML Attribute Name: firstname
       Attribute Source: Identity Source
       User Attribute/Value: First Name, or the equivalent first-name attribute in your identity source
    3. SAML Attribute Name: email
       Attribute Source: Identity Source
       User Attribute/Value: Email, or the equivalent email attribute in your identity source

    

11. Click Save and Finish.

12. Click Publish Changes, and wait for the operation to finish.

13. Export the RSA IdP metadata:

    1. Open the relying party.

    2. In the Edit menu, click Export Metadata.

    3. Save the metadata file for the Google Cloud Workforce Identity provider configuration.

    

Configure Google Cloud Workforce Identity

Perform these steps to configure Google Cloud Workforce Identity.

Procedure

1. Sign in to the Cloud Workforce Identity Admin console with an administrator account, and in the search window, search for IAM & Admin/ Workforce identity pools.

2. Go to IAM & Admin > Workforce Identity Federation, and then click Create pool.

   

3. Create the workforce pool:

   1. Enter a name for the pool.

   2. Click Next.

   

4. Create the SAML provider:

   1. In Select a Provider vendor, select the applicable provider vendor.

   2. Under Select an authentication protocol, select SAML.

   3. Enter a name for the provider.

   4. Click Browse, and upload the RSA IdP metadata file.

   5. Click Continue.

   

5. Under Share your provider information with IdP, copy the following values:

   1. Identifier (Entity ID): Use this value as the RSA service provider entity ID.

   2. Redirect URI: Use this value as the RSA ACS URL.

   3. Click Continue.

   

6. In Enable detailed audit logging, keep detailed logging disabled unless your organization requires it, and click Submit.

   

7. Configure the attribute mappings:

   1. google.subject: assertion.subject

   2. google.email: assertion.mail

   3. google.firstname: assertion.firstname

   4. google.lastname: assertion.lastname

   5. Optionally, configure an attribute condition.

   6. Click Save and exit.

   

The configuration is complete.