Configuring Google Workspace

This section describes the steps to be performed in the Google Workspace administration and developer console to register the Central NAC application and provide access to the Google Workspace instance.

To integrate Google Workspace with the Central NAC application and fetch user’s attributes from Google Workspace, complete the following steps:

1. Get the Customer ID and Domain Information from the Google Admin Console

   To configure Google Workspace in the Central NAC application, get the client and domain information from the Google Admin Console. For instructions, see Getting Information from Google Workspace.

   Note:

   For more information on getting customer ID and domain information from the Google Admin Console, see Find your customer ID. and Access your Google Workspace domain settings.

2. Create a Project in Google Cloud Platform

   Create a new project for Central NAC to authenticate the application with Google Cloud Platform. Enable the Admin SDK API to view and manage the users and groups in the Google Workspace.

   Note:

   To create a new project in Google Cloud Platform, you must have administrator rights.

For instructions, see Create a project and enable the Admin SDK API.

Configuring OAuth Consent Screen

Configure OAuth consent screen to register the application. After you get an authorization from Google, you can access and manage the user data.

For more information, see Configure the OAuth consent screen.

Creating Credentials

The Google Workspace Admin API and Central NAC application integration requires credentials to authenticate the Google Workspace Admin API.

On the Credentials page, you can create the OAuth Client ID and Service Account.

Creating OAuth Client ID

The client ID is used to identify the Central NAC application by Google's OAuth servers.

In the Authorized redirect URIs section, click ADD URI to add OAuth and Reply URLs of the Cloud Guest server. The reply URL must be in the https://<cloud guest server>/oauth/reply format.

For more information about Cloud Guest server URLs, see Cloud Guest Server Domains for Guest Access Service in Opening Firewall Ports for Device Communication.

Creating a Service Account

Create a service account to enable server-to-server, application-level authentication between the Central NAC application and Google Workspace. The service account allows the Central NAC application to make API calls by using the service account's credentials to request user data from Google Workspace.

Providing Access to Google Workspace Instance

Central NAC application requires access to Google Workspace instance (customer instance) to retrieve the user data.

To provide access to Google Workspace, complete the following steps in the Google Admin Console:

1. Open the https://admin.google.com URL to access the Google Admin Console.

2. Log in using Google admin credentials.

   The Google Admin dashboard is displayed.

3. Select Enable Google Workspace domain-wide-delegation for the service account.

4. Enter the following comma separated Oauth scopes:

   • https://www.googleapis.com/auth/admin.directory.user.readonly
   • https://www.googleapis.com/auth/admin.directory.group.readonly

On successful authorization, the Central NAC application is authorized to retrieve the user group membership, and role information from the Google Workspace.

APIs for Google Workspace

The following APIs are used by Central NAC to authorize users in Google Workspace:

• GET https://admin.googleapis.com/admin/directory/v1/users

• GET https://admin.googleapis.com/admin/directory/v1/groups?userKey={userKey}