Connect Google Workspace to Cargo Marshal as a custom SAML app, verify your email domain, and let your team sign in with their Google work accounts.
Single sign-on (SSO) lets people with an email on your company domain sign in to Cargo Marshal through Google Workspace. Their first sign-in adds them to your organization as members, as long as a seat is free.
Before you start
You need the Enterprise plan, the owner or admin role in your Cargo Marshal organization, a Google Workspace super admin account, and access to your domain's DNS settings.
In Cargo Marshal, open Settings → Single sign-on and keep SAML selected. Copy the ACS URL and the Entity ID.
In the Google Admin console, go to Apps → Web and mobile apps → Add app → Add custom SAML app and name it "Cargo Marshal".
On Google Identity Provider details, copy the SSO URL and the Entity ID, and download the Certificate. Click Continue.
On Service provider details:
Click Continue, then Finish.
Back in Settings → Single sign-on, enter your email domain (for example acme.com). Paste Google's SSO URL into IdP single sign-on URL, Google's Entity ID into IdP entity ID (issuer), and the certificate file's contents into IdP signing certificate. Click Connect.
Cargo Marshal shows a TXT record. Add it at your DNS provider, then click Verify domain. DNS changes can take a while to appear. Sign-in through SSO starts working once the domain is verified.
In the app's User access, turn it ON for everyone or for the organizational units that use Cargo Marshal. Changes can take a few minutes in Google. People then sign in at the Cargo Marshal login page with Sign in with SSO and their work email.
Once the domain is verified and you have signed in through SSO yourself, you can turn on Require SSO. Everyone on the domain is signed out, except you, and can then only sign in through Google Workspace. Signing in with the Google button on the login page also stops working for them. If Google Workspace is ever unavailable, see SSO break-glass access.
Single sign-on with Microsoft Entra ID
Connect Microsoft Entra ID (Azure AD) to Cargo Marshal over SAML, verify your email domain, and let your team sign in with their Microsoft work accounts.
SSO break-glass access
What happens when your identity provider is down while SSO is required, and how Cargo Marshal support restores access.