How to Configure Single Sign-On (SSO) for Druva Cloud Platform (DCP) using Google Workspace as IdP

❗ Important

Only a designated Druva Cloud administrator can set up Single Sign-On (SSO).

Configuration Scenarios

Determine the appropriate configuration workflow based on your organization's onboarding timeline:

New Druva Customers (Onboarded after July 14, 2018): Configure Single Sign-On directly using the Druva Cloud Platform Console.
Existing Phoenix & inSync Customers: Continue using your pre-existing Phoenix and inSync Single Sign-On settings as applicable.

Overview

This guide details the step-by-step process of integrating Google Workspace as your Identity Provider (IdP) for SSO access to the Druva Cloud Platform.

The setup consists of four core phases:

Configuring Druva Cloud Platform and Google IdP
Updating Schema and Authorization Values in Google IdP
Mapping the SSO Token to Individual Users
Configuring Attribute Mapping

Step 1: Configure Druva to Work with Google IdP

Sign in to the Google Admin Console ([https://admin.google.com](https://admin.google.com)).
Navigate to Apps from the quick launch bar, then select Web and Mobile Apps.
Click Add App > Add Custom SAML App.
Enter an App Name, Description, and upload an App Icon (optional). Click Continue.
Copy the provided SSO URL and download the Certificate. Keep this page open.
Open a new tab and sign in to the Druva Cloud Admin Page.
Click the Hamburger Menu > Druva Cloud Settings > Single Sign-On.
Click Edit, paste the copied SSO URL into the ID Provider Login URL field, paste the contents of the Certificate into the ID Provider Certificate box, and click Save.
Return to the Google Admin Page and proceed with custom app creation:
- Assertion Consumer Service (ACS) URL: [https://login.druva.com/api/commonlogin/samlconsume](https://login.druva.com/api/commonlogin/samlconsume)
- Entity ID: DCP-login
  - Note: Start URL and Signed Responses are not required.
Under Name ID, set the Name ID Format to Email and select Basic Information > Primary Email. Click Continue.
On the Attributes page, click Add New Mapping to map the required fields, then click Finish to publish the app.
Under User Access, set the application status to ON for everyone.

Step 2: Update Schema and Authorization Values for Google IdP

Because Google IdP does not natively support custom parameter fields within standard SAML setups, you must extend the user schema to pass Druva's required SSO authentication token.

📝 Note

You must possess Super Admin privileges in Google Workspace to update the API schema. The process will fail without proper administrator permissions.

Extending the Schema:

Open the Google Admin SDK Schemas: Insert API Explorer.
Enter my_customer in the customerId field.

In the Request Body, paste the following JSON payload:

{
       "displayName": "Druva", 
    "fields": [
          {
            "displayName": "Druva",

        "fieldName": "DruvaAuth",

            "fieldType": "STRING",
            "multiValued": false,
            "readAccessType": "ALL_DOMAIN_USERS",
      }
    ],
    "schemaName": "Druva"

Click Execute. A successful execution returns a 200 OK status code.

⚠️ Troubleshooting - Error 412 Entity Already Exists: resource.schemaName

If you encounter this error, the "Druva" schema already exists in your domain (often from a previously configured SAML app).

How to resolve:

Option 1 (Recommended): Skip this API execution step and proceed directly to Step 3: Map Token to User.
Option 2 (Fresh Setup): To recreate the schema, open Google Admin Console > Directory > Users > More (top right) > Manage Custom Attributes. Remove the existing Druva schema and re-run the API request above.

Step 3: Map Token to User

In the Druva Cloud Platform Console, go to Settings > Single Sign-On.
Click Generate SSO Token and copy the generated token.
Navigate to the Google Admin Home Page.
Go to Users and select the target user account.
Expand User Information and select the Druva custom attribute section.
Paste the copied token into the DruvaAuth field under the Druva schema.
Click Update User (or Save).

Step 4: Update Attribute Mapping

Log in to Google Admin Console as an administrator.
Go to Apps > SAML Apps and select the custom Druva SAML application created in Step 1.
Open Attribute Mapping and click Add New Mapping.
Configure the parameters as follows:
- Application Attribute: druva_auth_token
- Category: Druva
- User Field: DruvaAuth
Save the changes.
Note: Changes may take up to 24 hours to propagate across all global Google Workspace services.

Step 5: Enable SSO for Administrators

In the Druva Cloud Platform Console, navigate to Settings.
Under Single Sign-On Settings, click Edit.
Check Enable Single Sign-On for Administrators.
Ensure Failsafe for Administrators remains enabled (recommended).
💡 Tip: Enabling administrative failsafe allows admins to log in via standard DCP credentials if the IdP service encounters downtime.
Click Save.

Step 6: Enable SSO for End Users

Enable SSO for end users by updating existing profile settings or creating a dedicated SSO profile.

Phase 1: Configure Profile Settings

Create a New Profile: Log in to the inSync Management Console, navigate to Profiles, and create a profile with SSO enabled.
Modify an Existing Profile: Update the properties of an existing profile to enable SSO authentication.

Phase 2: Assign Users

Assign or reassign target users to the SSO-enabled profile to apply the single sign-on requirement.