Configuring Google Workspace in Cloud Authentication

This section describes the steps to be performed in the Google Workspace administration and developer console to register the Cloud Authentication and Policy application and provide access to the Google Workspace instance.

To integrate Google Workspace with the Cloud Authentication and Policy application and fetch user’s attributes from Google Workspace, complete the following steps:

1. Get the Customer ID and Domain Information

To configure Google Workspace in the Cloud Authentication and Policy application, get the customer ID and domain information from the Google Admin Console. For instructions, see Get Customer ID and Domain Information.

2. Create a Project in Google Cloud Platform

Create a new project for Cloud Authentication and Policy to authenticate the application with Google Cloud Platform. Enable the Admin SDK API Application Programming Interface. Refers to a set of functions, procedures, protocols, and tools that enable users to build application software. to view and manage users and groups in Google Workspace.

For instructions, see Create a project and enable the API.

Configuring OAuth Consent Screen

Configure OAuth Open Standard for Authorization. OAuth is a token-based authorization standard that allows websites or third-party applications to access user information, without exposing the user credentials. consent screen to register the application. After you get an authorization from Google, you can access and manage the user data.

For more information, see Configure the OAuth consent screen.

Creating Credentials

The Google Workspace Admin API and Cloud Authentication and Policy application integration requires credentials to authenticate the Google Workspace Admin API.

On the Credentials page, you can create the OAuth Client ID and Service Account.

Creating OAuth Client ID

The client ID is used to identify the Cloud Authentication and Policy application by Google's OAuth servers.

In the Authorized redirect URIs Uniform Resource Identifier. URI identifies the name and the location of a resource in a uniform format. section, click ADD URI to add OAuth and Reply URLs Uniform Resource Locator. URL is a global address used for locating web resources on the Internet. of the Cloud Guest server. The reply URL must be in the https://<cloud guest server>/oauth/reply format.

For more information about Cloud Guest server URLs, see Cloud Guest Server Domains for Guest Access Service in Opening Firewall Ports for Device Communication.

Creating a Service Account

Create a service account to enable server-to-server, application-level authentication between the Cloud Authentication and Policy application and Google Workspace. The service account allows the Cloud Authentication and Policy application to make API calls by using the service account's credentials to request user data from Google Workspace.

Providing Access to Google Workspace Instance

Cloud Authentication and Policy application requires access to Google Workspace instance (customer instance) to retrieve the user data.

To provide access to Google Workspace, complete the following steps in the Google Admin Console:

1. Open the https://admin.google.com URL to access the Google Admin Console.
2. Log in using Google admin credentials.

   The Google Admin dashboard is displayed.

3. Select Enable Google Workspace domain-wide-delegation for the service account.
4. Enter the following comma separated Oauth scopes:
   • https://www.googleapis.com/auth/admin.directory.user.readonly
   • https://www.googleapis.com/auth/admin.directory.group.readonly

On successful authorization, the Cloud Authentication and Policy application is authorized to retrieve the user group membership, and role information from the Google Workspace.

APIs for Google Workspace

The following APIs are used by Cloud Authentication and Policy to authorize users in Google Workspace:

• GET https://admin.googleapis.com/admin/directory/v1/users

• GET https://admin.googleapis.com/admin/directory/v1/groups?userKey={userKey}