The steps listed below will allow you to enable SAML on the Kace SMA and configure it to work with Google G Suite as the identity provider.

Step 1: Create new SAML app in G Suite and download metadata file

1. Sign in to the Google admin console as a super administrator for the G Suite account you are setting up.
   (note: this account does not end in @gmail.com)
2. Within the G Suite admin console home page, go to Apps → SAML apps.
3. Click Add App → Add Custom SAML App
4. In the App details page, type a name for the app (e.g. KACE SMA 1) and click Continue
5. Click Download Metadata to download the IDP metadata file
6. Click Continue
   

Step 2: Configure SMA to use SAML and then get the SP identifier URLs from the appliance

1. In a separate browser window, log in to the SMA as administrator
   
2. Within the SMA admin UI, navigate to Settings→Control Panel→SAML Configuration
   
3. Check the checkbox for Enable SAML Service Provider
4. Check the checkbox for IdP Does not Support Passive Authentication
5. Under the Identity Provider Settings, click the button for Enter XML Data
6. Copy and paste the text from the downloaded G Suite metadata file into the textbox and click Import IdP Metadata
   (The XML data will be parsed and the SMA SAML settings will be automatically populated from that data)
7. Scroll to the bottom of the page to the Local Service Provider Settings and click the button for View Metadata
   (notate the URLs for "SP Entity Identifier (url)" and "SP Assertion Consumer Service (url)", as these identifier URLs will be inputted into the G Suite setup in the next step)
8. Click Save

Step 3: Enter the service provider identifier URLs from the SMA into G Suite

1. Back in the Google admin console, in the text field for ACS URL, paste the "SP Assertion consumer Service" URL from the SMA
   
2. In the text field for Entity ID, paste the "SP Entity Identifier" URL from the SMA
3. For NameIDFormat, select EMAIL
4. For NameID, select Basic Information > Primary Email
5. Click Continue

Step 4: Specify the Google Directory attributes you would like to map to SAML attributes in G Suite

1. Click Add Mapping
   
2. In the dropdown list, choose the Google Directory attribute you would like to map
3. To the right of this field (under App attributes), for each Google Directory attribute type a custom attribute name
   Examples:
   Primary Email → email
   Last Name → lastname
   Department → department
4. Once you have entered all the attributes you would like to map, click Finish

Step 5: Specify the SAML attributes you would like to map in SMA and specify roles

1. On the SMA SAML configuration page, scroll to the IdP Attribute Mappings section and click the radio button for Use SAML
2. In the column for SAML Claim, type in the custom attribute names you created in G Suite. You can reuse the custom attribute names for multiple SMA user fields (e.g. a custom attribute "email" can be used for both the SMA Login and SMA Primary email)
   Note: SMA user fields for "Login" and "Primary Email" both require custom attributes, and typically the custom email attribute is used for both fields
   
3. Role mapping is optional and un-mapped users will be assigned the default role. It is generally good practice to specify a default role (such as Administrator) for unmatched users
   
4. Click Save
   

Step 6: Enable the SAML app in G Suite

1. Back in the Google admin console, select the SAML app you just created
2. Press the down carat to expand the "User Access" section
3. Click on the radio button for On for everyone
4. Click Save