# SSO with Google Cloud Identity

Google Cloud Identity can be used as an SSO provider for your Buildkite organization. To complete this tutorial, you will need admin privileges for both Google Cloud Identity and Buildkite.

<div class="Docs__note">
  <p>See the <a href="/docs/integrations/sso/sso-setup-with-graphql">SSO Setup with GraphQL Guide</a> for instructions on how to manually set up SSO yourself using GraphQL.</p>
</div>

### Step 1. Add Buildkite in Google Cloud Identity

<div class="Docs__note">
<p class="Docs__note__heading">Before starting your provider setup</p>
<p>Email the Buildkite team at support@buildkite.com to request your unique SSO service URL, you will need this during set up.</p>
</div>

Log into your Google Admin Console, and follow these steps:

1. In the 'Apps Settings' area of the console, select 'SAML Apps'
1. Click the + button to open the Enable SSO for SAML Application modal 
1. Choose 'Setup my own custom app'
1. Copy down the SSO URL and Entity ID, and download the Certificate 
1. Give your application a name, for example 'Buildkite'
1. ACS URL = the URL provided by Buildkite support, Entity ID = https://buildkite.com

### Step 2. Email Buildkite Support

Send an email to support@buildkite.com with the following 5 fields:

<table>
    <tr>
        <td>Domain name</td>
        <td>
          The domain you use with Google Cloud Identity for which you want to enable SSO. This must match one of the emails you have verified with your Buildkite account.
        </td>
    </tr>
    <tr>
        <td>Organization slug</td>
        <td>
          The Buildkite organization for which you want to enable SSO.  
        </td>
    </tr>
    <tr>
        <td>SAML 2.0 Endpoint (HTTP)</td>
        <td>
            The SSO URL you copied down during step 4 above.
        </td>
    </tr>
    <tr>
        <td>Issuer URL</td>
        <td>
            The Entity ID that you copied down during step 4 above. 
        </td>
    </tr>
    <tr>
        <td>X.509 certificate</td>
        <td>
            The public key certificate generated for you by Google Cloud Identity that you downloaded during step 4 above. You'll need the whole file, not just a link to the file. 
        </td>
    </tr>
</table>

When we receive your email, Buildkite support will set up SSO in test mode and reply with instructions for performing a test login.

### Step 3. Perform a Test Login

Follow the instructions sent by Buildkite support to perform a test login. Performing a test login will verify that SSO is working correctly, before it is activated for all your organization members.

### Step 4. Buildkite Support will Activate SSO

Once you've performed a test login, reply to the previous email and Buildkite support will activate SSO via Google Cloud Identity for your entire Buildkite organization. Activating SSO will log out all of your organization’s members, to ensure that all data access is authorized through Google Cloud Identity.
Add unfinished cloud identity draft
Add unfinished cloud identity draft
