Google secops SAML SSO Setup with okta

The first link is a legacy document for standalone SOAR instances.  For a SIEM + SOAR instances you would use Workforce Identity Federation (WIF) as the the second link.

The caveat would be unless you had setup Google Cloud Directory Services to sync Okta identities into Cloud Identity, in which case you can use native Google Authentication.

Thanks ​@cmmartin_google for your response. 

I am following the second article link as mentioned by yourself and it says that “If you have an existing Chronicle SecOps tenant, provide your Chronicle account team or Chronicle Partner the WORKFORCE POOL ID and WORKFORCE PROVIDER ID so they can complete the final part of the setup process”

Is it the respective google TAM team who supports us or what ?

The process is now self service, so you can follow - https://docs.cloud.google.com/chronicle/docs/onboard/configure-authentication - and there is no dependency on Google to complete the setup anymore.

I’ll update my blog (as that’s a few years old now).

You set up the SSO on the google admin page.

For Okta follow this;

Okta user provisioning and single sign-on  |  Cloud Architecture Center  |  Google Cloud Documentation

Then pull in / synchronize the groups you want to give access, you then grant these rights via IAM on the google project workspace.

I am doing something similar, but then with Entra ID.

Below are my Entra ID groups, that are synced to Google Org.