To configure a Google Workspace user sync with Kantega SSO Enterprise, you will first have to create a service account, assign the account privileges, then create an impersonation account for the service account and a role for reading users and groups. Follow the steps described below to prepare your Google Workspace for integrating with a Kantega SSO Connector directory. When these steps are finished, you can go to Kantega SSO and paste the values needed.

Start setup in Kantega SSO Enterprise

To add a Workspace Connector/ User Directory in an Atlassian product, navigate to Kantega SSO Enterprise > Cloud user provisioning. Then add a Google Workspace connector.

...

As shown in the screenshot, you will need for some items (which we will grab and make notes of during the setup):

• Status
  colour Blue title required

  The domain of your Google directory with just the domain name like company.com

• Status
  title optional

  The Google customer ID (may be left blank)

• Status
  colour Blue title required

  A JSON key file created on the service account

• Status
  colour Blue title required

  The email address of the impersonation account to be used by the service account for reading the Google APIs

Let’s go to Google to get the setup needed!

Configure Google workspace

Set up service account in Google Cloud

The next step is to create an application and credentials in Google Cloud, which will allow you to complete the form and synchronize users and groups.

...

Go back to the service account and scroll to the right. Copy the OAuth2 Client ID and save it for later.

...

Assign domain-wide delegation to the Service Account

Assigning domain-wide delegation has been moved to Google Workspace. This guide explains how API clients generally work https://developers.google.com/identity/protocols/oauth2/service-account#delegatingauthority.

...

Your application now has the authority to make API calls as users in your domain (to impersonate users). When you prepare to make authorized API calls, you specify the user to impersonate.

Create a user account for the service account to impersonate

Navigate back to the directory the Directory in the left menu of Google Workspace and click “Add new user”.

...

Suggested values:

• First name: jira

• Last name: read

• Primary email address: "jira-read@<yourdomain.com>"

You do not need to set a password.

Click ADD NEW USER

...

Cut & paste Copy the account username into the "Admin account address" and make a note of it as it email address (e.g. jira-read@yourdomain.com) for later use. It will be needed again later in Kantega SSO.

Add and assign a read-only security role

Open the side menu in Google Workspace in admin.google.com as a super admin user.

...

Now you need to choose the correct READ privileges.

Scroll down to Admin API Privileges and select:

• Users > Read and

• Groups > Read.

Then click CONTINUE

Review that you have got the correct privileges. Then click CREATE ROLE.

...

Search for the impersonation account you created earlier. We have chosen to call the account in this example jira-dev-read. Click ASSIGN ROLE.

...

Complete the setup in Kantega SSO Enterprise

Go back to your Atlassian product and to the form you started in the beginning (If you closed that, just start a new one under Kantega SSO Enterprise > Cloud user provisioning, and clicking add provider > Google Workspace).
Paste the values obtained during the setup in Google. You need:

• Status
  colour Blue title required

  The domain of your Google directory with just the domain name like http:// company.com

• Status
  title optional

  The Google customer ID (this may be left blankt, and is only needed if you have a service account across domains)

• Status
  colour Blue title required

  A JSON key file created on the service account

• Status
  colour Blue title required

  The email address of the impersonation account to be used by the service account for reading the Google APIs

...

Add user directory

You can then add the user directory (which will act like a normal Crowd directory) and start the sync. Once the Crowd user directory has been createscreated, you can view users, groups and group memberships retrieved from Google Workspace.

...

Check “Use nested groups” if you use nested groups in Google Workspace.

...