SSO configuration with Google SAML with Google as IdP fails with "app_not_configured_for_user"

Steps to reproduce

1. Install the SSO & SAML authentication (v4.11) App in NextCloud 22.2.0

2. Create a Custom SAML Application in Google Workspace with the name Nextcloud:

Enabled for All users in Google Organization
ACS URL: https://example.nextcloud.domain/index.php/apps/user_saml/saml/acs
Entity ID: https://example.nextcloud.domain/index.php/apps/user_saml/saml/metadata
Start URL: Empty
Signed Response: Unticked
Certificate: Generated by Google (just copy out the cert data)
Name ID Format: EMAIL
Name ID: Basic Information > Primary Email
SAML Attribute Mapping: Basic Information > Primary Email = mail

3. Configure SSO & SAML Authentication in Next Cloud:

Only allow authentication if an account exists on some other backend. (e.g. LDAP): Unticked
Use SAML auth for the nextUC secure share desktop clients (requires user re-authentication): Ticked
Allow the use of multiple user back-ends (e.g. LDAP): Ticked
Attribute to Map the UID: mail
Optional Name: Specified
Identifier of IDP: https://accounts.google.com/o/saml2?idpid=CustomerID
URL Target of the IDP: https://accounts.google.com/o/saml2/idp?idpid=CustomerID
No Attribute Mappings
No Security Settings ticked

Expected behaviour

When a user logs in via the SSO button, they are able to login to their Google Account, finish the process and be handed back to NextCloud via any configured Start URL.

Actual behaviour

Users are directed to Google to Login and, after finishing the 2SV process, they receive an error from Google with the error:

403: app_not_configured_for_user

According to Google Documentation, it can be one of two things:

1. The SAML app is not enabled for all users in the Google Workspace admin console.
2. The SSO & SAML Authentication plugin is returning the wrong Entity ID resulting in Google returning the error.

We've verified that we've assigned the permissions for SAML to all Google users and that shouldn't be the problem. How do we troubleshoot what the SSO plugin is returning to Google?

Start with the SSO & SAML Authentication configuration and the Google Workspace Custom SAML Application settings, especially the ACS URL, Entity ID, and IdP target URL. Compare the Entity ID and ACS values sent during the login flow with the configured values. Done means identifying the mismatch or confirming the plugin configuration that causes Google's app_not_configured_for_user response.