The SDO service allows users secure, password-free access to Google's G-suite service.  Users are able to log into the console by authorizing the connection through an app on their phone.  This article provides the steps needed to enabled the SDO service for GSuite. 


Enabling SDO for GSuite


  1. 1. In the Control Panel, click on My Services from the left-hand menu.

  2. Click on the Secret Double Octopus vendor band to expand it.
  3. Under the expanded vendor band, click on the Services tab.
  4. Click on the Edit button for Microsoft Office 365
  5. Select your primary domain from the Domain drop-down field.
  6. Click the Activate Microsoft Office365 button.

  7. Click on the Service Metadata tab.
  8. The Service Metadata page will show the Login and Logout URLs for your SDO authentication connection.  Record these URLs, as they will be used to set up Office 365 for SDO access.

  9. Copy the contents of the X.509 Certificate text box.
  10. Open a text editor such as Notepad and paste the copied X.509 Certificate text.
  11. Under the File menu, select Save As, and save the file with a to .pem file extension
  12. Save the file to an easily found location on your computer (a drive root will be the easiest to reference).



Setting up the G-Suite account for SDO Authentication.


  1. Log into your G Suite Admin account

  2. From the Google Admin menu, click on Security.

  3. In the Security page, click on "Set up single sign-on (SSO) with a third party IdP"

  4. Check the box labelled Set up SSO with third-party identity provider.

  5. In the Sign-in page URL, enter the Login URL you recorded in step 8 of the previous section.

  6. In the Sign-out page URL, enter the Logout URL you recorded in step 8 of the previous section.

  7. Click the Upload Certificate link

  8. Navigate to and select the .pem file you saved in step 12 of the previous section, and click Open.

  9. Click Save at the bottom of the page.

  10. Return to the Control Panel, and click the Configuration tab in the Secret Double Octopus Configuration window.

  11. Enter your GSuite domain name in the G Suite Domain field.

  12. Enter the SSO URL field in the format "https://www.google.com/a/<your GSuite domain>/ServiceLogin?continue=https://mail.google.com"

  13. Click the Save button


The GSuite service is now enabled for authentication through SDO.  When a user logs into the GSuite/Gmail portal with their username, they will be automatically redirected to the SDO Authentication page, which will trigger login authorization through the SDO Authenticator app.


Important Note: Users that are designated with Super Administrator permissions in GSuite will automatically bypass all Single Sign-On configurations.  As a result, all Super Administrators will need to log in with their normal GSuite usernames and passwords, and will not use SDO for authentication.