To configure a Google Workspace user sync with Kantega SSO Enterprise, you will first have to create a service account, assign the account privileges, then create an impersonation account for the service account and a role for reading users and groups. Follow the steps described below to prepare your Google Workspace for integrating with a Kantega SSO Connector directory. When these steps are finished, you can go to Kantega SSO and paste the values needed.

Start setup in Kantega SSO Enterprise

To add a Workspace Connector/ User Directory in an Atlassian product, navigate to Kantega SSO Enterprise > Cloud user provisioning. Then add a Google Workspace connector.

The below form should appear:

As shown in the screenshot, you will need some items (which we will grab and make notes of during the setup):

required The domain of your Google directory with just the domain name like company.com
optional The Google customer ID (may be left blank)
required A JSON key file created on the service account
required The email address of the impersonation account to be used by the service account for reading the Google APIs

Let’s go to Google to get the setup needed!

Configure Google workspace

EXTERNAL

Set up service account in Google Cloud

The next step is to create an application and credentials in Google Cloud, which will allow you to complete the form and synchronize users and groups.

Go to Google Cloud at https://console.developers.google.com

Navigate to IAM & Admin > Service Accounts

Enter a Service account name, such as "jira-read"

You do not need to grant access to project or users at this time, just click Done

Next, locate the account you just created in the list of service accounts, and click the three dots from the Action column to expand options. Select Manage key:

Then click the ADD KEY select and choose Create new key:

Click Select JSON and click CREATE.

The JSON private key file will be downloaded to your computer and should be uploaded in the form field JSON key file on the top of this Google GSuite Connector wizard page later.

Go back to the service account and scroll to the right. Copy the OAuth2 Client ID and save it for later.

Assign domain-wide delegation to the Service Account

Assigning domain-wide delegation has been moved to Google Workspace. This guide explains how API clients generally work https://developers.google.com/identity/protocols/oauth2/service-account#delegatingauthority.

Log in to your Google Workspace domain on a super administrator account.

From your Google Workspace domain's Admin console, go to Main menu menu > Security > Access and data control > API Controls.

In the Domain wide delegation pane, select Manage Domain Wide Delegation.

Click Add new

In the Client ID field, enter the service account's Client ID which you saved at the previous section (You can find your service account's client ID in the Service accounts page, listed on the service account you just created)

In the OAuth scopes (comma-delimited URls on the format https://www.googleapis.com/auth/admin.directory.user) field, enter the following:

https://www.googleapis.com/auth/admin.directory.group,https://www.googleapis.com/auth/admin.directory.user

Click Authorize.

You will now see the new API client listed after creation.

Your application now has the authority to make API calls as users in your domain (to impersonate users). When you prepare to make authorized API calls, you specify the user to impersonate.

Create a user account for the service account to impersonate

Navigate back to the Directory in the left menu of Google Workspace and click “Add new user”.

Suggested values:

First name: jira
Last name: read
Primary email address: "jira-read@<yourdomain.com>"

You do not need to set a password.

Click ADD NEW USER

Copy the account email address (e.g. jira-read@yourdomain.com) for later use. It will be needed again later in Kantega SSO.

Add and assign a read-only security role

Open the side menu in Google Workspace in admin.google.com as a super admin user.

Navigate to Account > Admin roles and click Create new role.

Name the role as something specific like “read users and groups”,. Click CONTINUE

Now you need to choose the correct READ privileges.

Scroll down to Admin API Privileges and select:

Users > Read and
Groups > Read.

Then click CONTINUE

Review that you have got the correct privileges. Then click CREATE ROLE.

You will now be navigated to the page of the new role you just created. If not you will find it under Roles.

Click Assign users.

Search for the impersonation account you created earlier. We have chosen to call the account in this example jira-dev-read. Click ASSIGN ROLE.

Complete the setup in Kantega SSO Enterprise

Go back to your Atlassian product and to the form you started in the beginning (If you closed that, just start a new one under Kantega SSO Enterprise > Cloud user provisioning, and clicking add provider > Google Workspace).
Paste the values obtained during the setup in Google.:

required The domain of your Google directory with just the domain name like company.com
optional The Google customer ID (this may be left blankt, and is only needed if you have a service account across domains)
required A JSON key file created on the service account
required The email address of the impersonation account to be used by the service account for reading the Google APIs

Add user directory

You can then add the user directory (which will act like a normal Crowd directory) and start the sync. Once the Crowd user directory has been created, you can view users, groups and group memberships retrieved from Google Workspace. Check “Use nested groups” if you use nested groups in Google Workspace.

Google Workspace (API Connector)