I've been trying to setup SSO with Google Identity as the Service Provider and ADFS as the IdP.
I believe I've got ADFS configured correctly and Cloud Identity at least partially correct, as I can successfully login with ADFS SSO to Google Drive and Google Groups when using the explicit organisation URLs of service.google.com/a/domain.com, so I believe the SAML request/responses are working fine. I can also determine this is a successful SSO login because I can immediately access the other services as the same user. eg, accessing https://drive.google.com/a/domain.com, going through SSO, then accessing https://console.cloud.google.com works straight away, no further login required.
However when accessing any service directly via its login page(https://accounts.google.com or https://console.cloud.google.com) results in being prompted for a Google username (expected behaviour) and then for a Google password (not expected, as domain.com has 3rd party SSO enabled).
The documentation and watching the demo this user posted a couple of years ago shows the behaviour I'd expect:
- Access https://console.cloud.google.com
- Enter username/email
- Get redirected to SSO page
Step 3 instead prompts for the Google ID password.
I've tried unsuccessfully using test users that aren't Super Admins to rule out anything to do with that special role.
Has anyone else experienced this behaviour?