Wrong "Issuer" in the SAML auth token

[meandrii]

Describe your question/
I am trying to integrate google workspace as IDP to authentik with SAML. I've created custom SAML application in the Google Admin Console and SAML source in the authentik following this guide https://docs.goauthentik.io/docs/users-sources/sources/protocols/saml/. When i try to go through flow which has google's IDP as the source i receive google's 403 page with this error:
"Error: app_not_configured_for_user
Service is not configured for this user."
After further debugging i found that SAML token which being forwarded to google might not has correct issuer value.

<samlp:AuthnRequest xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:ds="http://www.w3.org/2000/09/xmldsig#" xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata" xmlns:xenc="http://www.w3.org/2001/04/xmlenc#" AssertionConsumerServiceURL="https://auth.MODERATED3.lan/source/saml/ps/acs/" Destination="https://accounts.google.com/o/saml2/idp?idpid=MODERATED1" ID="MODERATED2" IssueInstant="2024-10-22T23:00:09Z" ProtocolBinding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Version="2.0">

    <saml:Issuer>

        https://accounts.google.com/o/saml2?idpid=MODERATED1

    </saml:Issuer>

    <samlp:NameIDPolicy Format="urn:oasis:names:tc:SAML:2.0:nameid-format:persistent"/>

</samlp:AuthnRequest>

I think reason of that, because field "issuer" supposed to be authentik entity URL which I specified at the google custom app's configuration. Could someone help please understand why authentik doesn't work with google custom application by SAML?

Version and Deployment (please complete the following information):

• authentik version: 2024.8.3
• Deployment: original docker-compose