Gemini for Windows SSO Fix: Seamless Sign-in for Google Workspace Users

Gemini for Windows SSO Fix: Seamless Sign-in for Google Workspace Users

For organizations leveraging Google Workspace with third-party SAML Identity Providers (IdPs), a recent issue with the Gemini for Windows application caused significant sign-in hurdles. Users attempting to access Gemini via SSO would experience a broken authentication flow, leading to failed logins. Fortunately, this critical problem has been addressed in a recent update.

The Initial Problem: Broken SAML SSO Hand-off

Initially, users of the Gemini for Windows app (version 1.10.5 and earlier) encountered a persistent sign-in failure when their Google Workspace account utilized a third-party SAML IdP. The core of the issue lay in the application's handling of the authentication flow:

• External Browser Hand-off: Partway through the SAML authentication process, the Gemini app would unexpectedly hand off the sign-in to the system's default browser.
• Split Session State: This hand-off created a critical problem by splitting the authentication flow across two independent cookie stores. The session and pending authorization requests initiated within the in-app WebView were inaccessible to the external browser.
• Lost POST Requests: More critically, when the hand-off occurred on a POST navigation, the request body—which typically contains the SAML assertion—was not carried over. This resulted in the SAML assertion being lost, leading to an HTTP 405 error and authentication failure. This affected various IdPs, including Okta, and was reproducible 100% of the time.

The original investigation, while later corrected in some specifics, accurately identified the symptom: the app remained signed out despite successful authentication completing end-to-end through the IdP.

The Resolution: Gemini for Windows Version 1.11.4

The good news arrived with the release of Gemini for Windows version 1.11.4. According to user reports, this update completely resolves the SAML SSO sign-in issue. After updating, the authentication process now completes entirely within the Gemini app window, eliminating the problematic external browser hand-off.

Users on version 1.10.5 could observe specific log entries indicating the hand-off:

Starting Gemini v1.10.5
[window_manager] External navigation intercepted: 
[security] Opening external URL in system browser: 

In version 1.11.4, these lines no longer appear, confirming that the app now retains the authentication flow internally. This correction ensures that the SAML assertion is preserved and the session state remains intact throughout the sign-in process.

Why This Matters for Google Workspace Administrators

For Google Workspace administrators, ensuring seamless access to productivity tools like Gemini is paramount for user adoption and operational efficiency. Issues like broken SSO can lead to significant user frustration and support tickets. Monitoring the health and accessibility of all your Google Workspace services is a continuous task.

Where Workalizer Helps:

Workalizer provides critical insights for managing your Google Workspace environment. Our Google Workspace Dashboard offers a centralized view of service health, user activity, and potential issues across your organization. You can also leverage the Gemini Usage Report to track adoption and identify any lingering access challenges, ensuring your team can effectively utilize AI capabilities.

Beyond Gemini, Workalizer helps you keep an eye on broader Workspace metrics, such as google storage usage across your Drive accounts and google meet duration 2022 and beyond, ensuring optimal resource allocation and productivity across all services.

Recommendations for Administrators

• Update Gemini for Windows: Ensure all users are running Gemini for Windows version 1.11.4 or newer to benefit from the fix.
• Utilize Browser/PWA: As a workaround for any persistent issues, users can access Gemini directly via the web at gemini.google.com or install it as a Progressive Web App (PWA) through Chrome.
• Submit Client Logs: If issues persist, guide users to submit feedback with system diagnostics via the Gemini app (Profile icon > Help & feedback > Send feedback).
• Escalate via Workspace Support: For critical enterprise-wide issues, have your Google Workspace Administrator open a priority support case through the Google Admin console with reproduction logs.