Google Workspace

To configure Google Workspace as Idenity Provider in Central NAC, you will need the following information:

• Customer ID
• Google Workspace Domain
• Administrator Email
• OAuth2.0 Client ID
• Client Secret
• Service Account Crentials File

Getting the Customer ID and Domain Information

1. Login to Google Admin Console and navigate to Account > Account settings. Copy the Customer ID from the Profile section.
   
   

   

   
   
   

2. Navigate to Account > Domains > Manage domains and copy the domain name.
   
   

   

   
   
   

Creating a Project for Central NAC in Google Cloud Console

1. Login to your Google Cloud Console as an administrator and navigate to Project Picker > New Project from the home screen.
   
   

   

   
   
   

2. Provide a suitable Project Name (for example, Central NAC), select the Organization and Parent Resource, and then click Create.
   
   

   

   
   
   

3. Now switch to the project that was created from the Project Picker.
   
   

   

   
   
   

Create OAuth 2.0 Client ID and Client Secret

1. From the hamburger menu in the top-left corner, go to APIs & Services > Credentials.
   
   

   

   
   
   

2. The OAuth consent screen must be configured before you can create an OAuth Client ID and Client Secret. To configure the consent screen, either click Configure consent screen from the banner displayed on the page or navigate to the OAuth consent screen menu, as shown below.
   
   

   

   
   
   

3. Click on Get Started from the Overview Page or follow the onscreen instructions. Enter a suitable App name and a User support email and click Next.
   
   

   

   
   
   

4. Choose Internal as the Audience and click Next.
   
   

   

   
   
   

5.Enter the email addresses that should receive notifications from Google for any changes to your project under Contact Information, Agree to the Google API Services:User Data Policy on the Finish page and then click Create.

6. You can now create the OAuth Client Credentials. Click on Create OAuth client from the Overview page or Navigate back to the hamburger menu in the top-left corner, go to APIs & Services > Credentials > Create Credentials > OAuth client ID.
   
   

   

   
   
   

7. Choose Web application as the Application type, Give a Name to your OAuth 2.0 client and scroll down.
   
   

   

   
   
   

8. Click on Add URI under the Authorized redirect URIs, enter the redirect URI and click Create. You can find the redirect URI from Central NAC by navigating to Central NAC > Configuration > Identity Management > Create Identity Store as shown below.
   
   

   

   
   
   
   
   

   

   
   
   

9. Copy the Client ID and Client Secret displayed after the OAuth client is created. These will be used later while configuring the IdP in Central NAC.
   
   

   

   
   
   

Creating a Service Account

1. From the hamburger menu in the top-left corner, go to IAM & Admin > Service Accounts.
   
   

   

   
   
   

2. Click Create Service Account to start creating a new service account for the project.
   
   

   

   
   
   

3. Give a name to the Service account, The Service account ID should be auto generated. Click Create and continue to advance to the next steps.
   
   

   

   
   
   

4. The Permissions and Principals with access section is optional and can be skipped by clicking on Continue. Click Done to complete the service account creation.
   
   

   

   
   
   

5. Once the account is created, it will be listed on the Service Accounts page. For the service account created for Central NAC, click the Actions menu and select Manage keys.
   
   

   

   
   
   

6. Click on Add Key and select Create new key. Choose Key type as JSON and click on Create. The keys should be downloaded to your computer.
   
   

   

   
   
   
   
   

   

   
   
   

Configuring Google Workspace as IDP in Central NAC

1. Within Central NAC, Navigate to Configuration > Identity Mangement > Manage as shown below.
   
   

   

   
   
   

2. Click on Create Identity Store to create the IDP
   
   

   

   
   
   

3. Provide a Name, select Google Workspace as the identity provider and fill the form using the Customer ID, Domain, Administator Email, Client ID, Client Secret and Credentials file copied from Google Workspace.