Looking for a way to add Incident IQ to your Google SAML app to your G-Suite? Here are the steps:
Initial Configuration
To set a custom Incident IQ application link/icon within your G Suite installation as an administrator, you will want to perform the following steps:
Download an Incident IQ app icon from the following link from within your browser and save the file to a place on your computer: https://iiqstorage.blob.core.windows.net/public/emails/iiq-app-icon.png
Log in to G-Suite Admin Console using an administrator account located at: https://admin.google.com/ac/home
You should see a section titled "Admin Console" and a series of icons, one of which is "Apps"
If you do not see an icon titled "Organizational Units," then you may not be logged on as an administrator
If so, log out of all Google accounts and then sign in only as the administrator account
Click "Apps," then click "Web and mobile apps."
In the upper left corner, click "Add App" and then "Add custom SAML app" to add a new app - named “Incident IQ”
Next, click the App icon blue circular image button, to upload an app icon.
When the file selector displays, choose the "iiq-app-icon.png" file you downloaded previously and accept that image file
Click the "Continue" button below the App icon field to continue
Under "Option 1," click the "Download Metadata" button next to the label titled "Download IdP metadata."
Save the download file to your disk for later transmission to Incident IQ so we can authorize your application setup
Click "Continue" once more and enter: "https://<yourdomain>.incidentiq.com/apps/saml2Sso/API/googleSaml/authorization/callback" for the "ACS URL"
Make sure to replace "<yourdomain>" with your Incident IQ custom domain
Enter "http://<yourdomain>.incidentiq.com" for the "Entity ID"
Make sure to replace "<yourdomain>" with your Incident IQ custom domain
Please note, sometimes, when configuring the information console, the entity ID may differ from <yourdomain>.incidentiq.com. In this case, you will receive an error that:
"The service is not configured to meet the given audience restriction..."
In this case, you should download the "Service Provider Metadata" from the "Google G Suite Single Sign On for SAML" and locate the entityID variable in this data. Changing the entityID in the user console to match this value will resolve this error.
Finally, enter "http://<yourdomain>.incidentiq.com" for the "Start URL."
Make sure to replace "<yourdomain>" with your Incident IQ custom domain, just like in the fields above
Leave the fields under "Name ID" defaulted to their present values ( no changes )
Then click "Continue," and then when prompted with the Attributes screen, click "Finish."
After a few moments, you should see the newly created "Incident IQ" app on your screen.
Before you can proceed to the Activation Step, you need to send the following information to our Customer Success Manager or Implementation Specialist:
The "IDP metadata" file you downloaded previously as part of this process
The "ACS URL" you entered in a previous step
Once your application is configured/authorized iiQ team member will contact you to indicate it's ready for activation. Without the proper configuration, login error messages will display on the screen for users who attempt to use the application.
Activation
To enable/activate your custom Incident IQ application link/icon within G Suite:
Log in to G-Suite Admin Console using an administrator account located at https://admin.google.com/ac/home
You should see a section titled "Admin Console" and a series of icons, one of which is "Apps."
If you do not see an icon titled "Organizational Units," then you may not be logged on as an administrator
If so, log out of all Google accounts and then sign in only as the administrator account
Click "Apps," then click "Web and mobile apps."
Locate the "Incident IQ" app created previously in "Custom Incident IQ App Setup Instructions" and click on that application row.
The row should be highlighted with a light grey background on the mouseover of the "Incident IQ" app
Next, click on the grey drop-down arrow in the upper right corner of "User access".
You may now check the toggle "ON for everyone" to enable the app
You can defer enabling the custom app until a later time if needed
Let me know if there is anything else I can help you with
Click "Save" to commit your changes, and then click on the grey "Web and mobile apps" link in the top navigation bar to return to your applications list
To test, click on the Application Menu in the upper right corner of the blue Google header search bar ( the infamous "waffle" icon ) and scroll down to the end of the application icon list
There, you should see the "Incident IQ" application within the list.
Click the icon, and the application should open in a new tab within your browser
If all is working as expected, your existing Google credentials ( if in sync with Incident IQ ) will automatically authenticate the current user and automatically log in to Incident IQ
Alternatively, if the currently logged-in Google user is not in sync with Incident IQ with a matching user record, then users should see the standard login screen
Finally, if any errors due to configuration or otherwise present themselves on the login screen, please contact your Incident IQ account representative and report any details relating to the error message
Congratulations on your custom application setup!
Certificate Expiration
The Google-generated SAML certificate has a limited life span, so you may need to renew the certificate. When this happens, here are your steps:
Locate the iiQ app in the Google Console:
Log in to G-Suite Admin Console using an administrator account located at: https://admin.google.com/ac/home
You should see a section titled "Admin Console" and a series of icons, one of which is "Apps"
If you do not see an icon titled "Organizational unit," then you may not be logged on as an administrator
If this is the case, you may need to log out of all Google accounts and then sign in only as the administrator account
Click "Apps," then click "Web and mobile apps."
Click the app titled “Incident IQ.”
Expand the Service Provider Details section by clicking it.
Click the Manage Certificate button.
The screen will now show a screen similar to the one below, indicating Certificate 1 has expired.
Click the Add Certificate button. This will replace the expired certificate with a new certificate.
Click the "Download Metadata" button under the heading "IdP metadata" (at the bottom of the page). You will need to send this to iiQ in a later step.
Click the white “x” in the blue header of the page to close the SAML Certificate configuration screen.
In the “Choose certificate” dropdown, select the certificate that was just generated.
Scroll to the bottom of the page and click “Save.”
Please send to your account representative:
The "IDP metadata" file you downloaded previously as part of this process
Once your application is configured/authorized, your account representative will get in touch with you to indicate it's now ready for testing/go-live
Please do not proceed with enabling/activating your custom application without awaiting confirmation, as without the proper configuration, login error messages will display on the screen for users who attempt to use the application
---
Kathryn Carter - Community Moderator