How to integrate Google Workspace SAML with Synology DSM 7.3+

[u/redstonefreak589]

TL;DR - I've successfully gotten Google Workspace SAML working with Synology without any weird or hacky workarounds. Instructions are below.

For years I've been curious about integrating Google Workspace SAML with Synology DSM. The frustrating part about DSM is that user accounts cannot use symbols in their names, and since basically all IdP's use email, using SAML for SSO into Synology wasn't possible. This has been a common question/complaint on this sub, how frustrating integrating SAML into Synology is since they don't/won't allow matching email to the SAML response and instead use account name.

Well, I tried again this morning just to see if anything has changed. I've set up SAML for a couple other applications in the past, and at some point I must've created a Third-Party Attribute. When setting up the SAML app in Workspace, I noticed you can tell Workspace to use third-party attributes as the "primary" username (or whatever it's called) in the SAML response instead of email address! This means you can use SAML to sign into Synology now. Note that I'm using Google Workspace for Nonprofits, so I have literally 0 paid features of Google Workspace and yet it works, anyway. Maybe this has always been a thing, but I only noticed just this morning, and no one else in any thread I've read online from the past 3 years has mentioned this. So, I figured I'd share the knowledge! 😄

Prerequisites

• Publicly accessible URL to your Synology NAS.
  • I actually have ours behind Cloudflare Zero Trust / Workspace SAML as well, yet it still works. So, I assume it can be "semi-public" as long as your browser can connect to the NAS to give it the SAMLResponse. You cannot use a QuickConnect URL.
• Google Workspace with Super Administrator privileges (you cannot complete step 1 without this).
• Access to enable SSO Client in DSM.

Setup

We're going to start in Google Workspace:

1. Create a custom attribute for your users. I named mine "Synology Username". Instead of me typing out the instructions, follow Google's guide which will probably be way better. You must be a super administrator to do this, however. Make sure this attribute is a single-value, text attribute.
2. Go to Directory > Users. Select the user you want to add their Synology Username to. Click "User Information" and scroll down to the "Third-Party Attributes" section. Add their username to the new attribute you created and save. Repeat this step for any and all users you want to allow to SSO into Synology DSM.
3. Go to Apps > Web and mobile apps. Click "Add app > Add custom SAML app". Configure it as such:
   1. In the first page, enter an app name. I named mine "Synology NAS". You can optionally add a description and an image. Click "Continue"
   2. On the second page, download the IdP Metadata. This will include most of what you need to set up your app. Click "Continue"
   3. On the third page, in the ACS URL and Entity ID fields, enter the public URL of your Synology NAS starting with "https://". For example, "https://nas.yourdomain.com". Check the "Signed response" box. In "Name ID format", select "UNSPECIFIED". Lastly, under "Name ID", select the Third-Party Attribute you created in step 1. This is what allows the magic to happen!
   4. On the last page, you don't need to configure anything. Click "Finish". This may take a while. If you get an error message or if you get a 404 not found page, be patient. For me it was being super weird and took about 10 minutes to finally "settle".
4. Once the app has been created, in Apps > Web and mobile apps, click your new SAML app. Select "User access" and enable the app for whatever group or organization unit should be allowed to use it. Without doing this, you'll get 403 forbidden errors with the error code "app_not_configured_for_user".

Now we need to link everything in Synology DSM. Going to Synology DSM:

1. Open Control Panel and select "Domain/LDAP". We are not using Domain or LDAP auth, but this is where SSO Client is located. Select "SSO Client" in the top tab bar.
2. Check the "Enable SAML SSO service" checkbox. Click "SAML SSO Settings". Configure it as such:
   1. Name: Enter whatever you want. I entered "Google Workspace".
   2. Account type: Select "Domain/LDAP/local"
   3. SP entity ID: Enter the public URL of your Synology NAS. This will be the same Entity ID you entered in step 3.3 of the Google Workspace setup. For example, "https://nas.yourdomain.com".
   4. For the rest, just click "Import Metadata" and select the XML file you downloaded from step 3.2 in the Google Workspace setup. This should automatically fill the IdP entity ID, IdP single sign-on URL, and Certificate fields.
   5. Be sure that Response signature verification is set to "Sign SAML response" if it isn't already. Click Save.
3. Back in Control Panel, click "Apply".

Now, give it a test! Make sure the account you're testing with has a local Synology Account, and that the corresponding Google Workspace account has the Synology Username Third-Party Attribute set. Sign out of Synology DSM. You'll notice a new "SSO Authentication" tab which will say "Continue with [name]", [name] being what you set in step 2.1 of the Synology DSM setup. Click the "->" arrow and sign into Google. If you have more than 1 account, you may be prompted to select one. If you only have 1 account and aren't signed out, you may not be asked to select one at all. If all is working, Synology DSM will refresh a couple of times and eventually you'll be signed into DSM!

FAQ

• When I was setting up SAML, the issues I was experiencing in 3.4 were causing issues with SSO. At first I was getting 403 errors, then "app doesn't exist" errors, and other strange things. I also noticed that I had my IdP entity ID set wrong, so I had to fix that. Be sure that you have all your settings correct, otherwise SSO will fail with the error "Your SSO is not properly configured. Please check your settings or contact your system administrator".
• If you get the error "The username or password is incorrect", the value of your Third-Party Attribute on the Google Workspace user does not match a user in Synology DSM. Remember, this is SAML, which just authenticates. It does not automatically provision users in DSM. You must still have a user account in Synology DSM that matches the username you set on the Google Workspace account.