Providing Access to Google Workspace Instance

Cloud Authentication and Policy application requires access to Google Workspace instance (customer instance) to retrieve the user data.

To provide access to Google Workspace, complete the following steps in the Google Admin Console:

Open the https://admin.google.com URL Uniform Resource Locator. URL is a global address used for locating web resources on the Internet. to access the Google Admin Console.
Log in using Google admin credentials.
The Google Admin dashboard is displayed.
Select Enable Google Workspace domain-wide-delegation for the service account.
Enter the following comma separated Oauth scopes:
- https://www.googleapis.com/auth/admin.directory.user.readonly
- https://www.googleapis.com/auth/admin.directory.group.readonly

For more information on enabling Google Workspace domain-wide-delegation and add Oauth scopes, see Control API access with domain-wide delegation.

On successful authorization, the Cloud Authentication and Policy application is authorized to retrieve the user group membership, and role information from the Google Workspace.

APIs for Google Workspace

The following APIs Application Programming Interface. Refers to a set of functions, procedures, protocols, and tools that enable users to build application software. are used by Cloud Authentication and Policy to authorize users in Google Workspace:

GET https://admin.googleapis.com/admin/directory/v1/users
GET https://admin.googleapis.com/admin/directory/v1/groups?userKey={userKey}