Integration with Google Workspace#

If your company uses Google Workspace for identity management, the integration with NVIDIA can be based on SAML.

../../_images/ovc_google_workspace_overview.png

Using the SAML terminology, the NVIDIA identity federation system is the Service Provider (SP) while your Google Workspace is the Identity Provider (IdP).

App Registration#

On your Google Workspace admin console, go to Apps → Web and mobile apps and then select the option to add a custom SAML application.

../../_images/ovc_google_app_regisration_1.jpg

Select a name and enter a description for the application. Example:

../../_images/ovc_google_app_regisration_2.jpg

Download the IdP metadata file:

../../_images/ovc_google_app_regisration_3.jpg

Enter the Assertion Consumer Service (ACS) URL and the Entity ID of the NVIDIA identity federation system:

../../_images/ovc_google_app_regisration_4.jpg

Leave all the rest unmodified.

The NVIDIA identity federation system uses the following identifiers and URLs:

NVIDIA environment	Entity ID	Assertion Consumer Service URL
Production	`https://login.nvidia.com`	`https://login.nvidia.com/saml2/redirect`
Pre-integration tests	`https://stg.login.nvidia.com`	`https://stg.login.nvidia.com/saml2/redirect`

Please use the values for the production environment unless you have been instructed otherwise.

SAML Attribute Mapping#

Specify the attribute mappings that will be used for the primary email and for the group memberships. We recommend you use the attributes Email and Groups, respectively.

Sharing the group memberships with NVIDIA is useful because it allows you to indicate to certain NVIDIA services what authorizations/privileges/roles each of your users should have.

You can add or remove groups to the list that you share with NVIDIA at any time.

Configure User Access#

By default, Google Workspace creates the new SAML application without any user allowed to access it:

Select the application you have registered for NVIDIA, and go to the user access panel:

../../_images/ovc_google_configure_user_access_2.jpg

Select who should have access – e.g. your entire organization – and then save the change.

Information to be Provided to NVIDIA#

The following table specifies the information that NVIDIA needs to set up the integration.

Info	Comments
IdP metadata file	Refer to the Integration with Google Workspace > App Registration section for more details.
List of email domains in use at your company	NVIDIA will direct all the users with those email domains to log in with your identity management system. Refer to Integration via OpenID Connect > Email Domains for more details.
Attribute names used for the primary email and group memberships	Refer to the SAML Attribute Mapping section for more details. This is necessary only if the chosen attribute names are different from Email and Groups