This guide outlines how to configure a custom SAML 2.0 connection to enable single sign-on (SSO) for Qualified using Google Workspace as your identity provider. Once SSO is enabled, your team signs in to Qualified with their Google accounts.
Prerequisites
- A Google Workspace super administrator account.
- Access to Qualified's Enterprise Single Sign-On and the Admin user role.
- Your organization's Company ID from Qualified.
- A basic understanding of SAML 2.0 configuration.
Google SSO is set up in three parts: you create the Qualified app in your Google Admin console, your Qualified Success Architect (QSA) connects it to your Qualified org, and then you verify the connection and enable SSO in Qualified.
Create the custom SAML app
Follow these steps within your Google Admin console to initiate the connection:
-
Log in to your Google Admin console.
-
From the Home page, navigate to Apps > Web and mobile apps.
-
Click Add App > Add custom SAML app.
-
Enter a name for the application (e.g., "Qualified") and click Continue.
-
You will see the Google Identity Provider details. Click Continue.
Provide service provider details
In the Service Provider Details window, enter the following information exactly as shown to ensure your users can authenticate correctly:
-
ACS URL:
https://app.qualified.com/auth/saml/XXXX-
Note: Replace XXXX with your Company ID, found on your Qualified SSO settings page.
-
-
Entity ID:
https://app.qualified.com -
Signed Response: Ensure this is unchecked.
-
Name ID Format: Select EMAIL.
-
Name ID: Select Basic Information > Primary email.
Click Continue once these fields are populated.
Map attributes
On the Attribute Mapping screen, click Add Mapping to connect your Google directory attributes to the corresponding Qualified app attributes.
| Google Directory Attribute | App Attribute |
| First Name | first_name |
| Last Name | last_name |
| Primary Email | saml_id |
Enable the app and export metadata
To finalize the setup, you must activate the application and provide the configuration file to Qualified.
Turn on the app
By default, new applications are set to Off for everyone. In the Qualified app settings within Google, click User Access and change the service status to ON for everyone (or select specific groups or organizational units) and click Save.
If you turn the app on for specific groups or organizational units, make sure they include every existing Qualified user, including yourself. Google notes that access changes can take up to 24 hours to apply.
Download metadata
-
On the Qualified app settings page in Google, click Download Metadata.
-
Select the Download Metadata option to save the XML file to your computer.
Finish the connection in Qualified
Your QSA completes the connection on the Qualified side. Once they confirm it's in place, you verify the connection and enable SSO.
-
Send the downloaded Metadata XML file to your QSA.
-
When your QSA confirms the connection is ready, go to Settings → Organization → Single Sign-On in Qualified.
-
Click Verify Configuration to test the connection.
-
Before enabling single sign-on, make sure every existing Qualified user (including yourself) has access to the Qualified app in Google, as they will no longer be able to access Qualified with their password once SSO is enabled.
-
Existing users will receive an email to bind their accounts.
-
-
When you're ready, click Enable single sign-on for this org.
Binding email process for existing users
After enabling SSO, all existing Qualified users receive an email from app@qualified.com with a unique binding link.
Users must click the link within 72 hours to bind their Qualified account to their Google account. If the binding link expires, an admin can resend it from Settings → Organization → Users in Qualified, using the Send SAML binding email link in that user's row.
Adding new users
Follow these steps to add a new user to Qualified once SSO is enabled:
-
Give the user access in Google: Make sure the user has access to the Qualified app in your Google Admin console. If the app is on for specific groups or organizational units, add the user to one of them.
-
Invite the user in Qualified: Invite users from Settings → Organization → Users in Qualified. For details, see How to manage users in Qualified.
-
The user accepts the invite: Invited users receive an email with a button to link their account and access Qualified.
Disconnecting SSO
If you'd like to disconnect your company's SSO, you can do so at any time.
-
Go to Settings → Organization → Single Sign-On.
-
Click Disable SSO for this team.
-
Users will receive an email to create a new password and log in using their email addresses.
.svg)
