Google Workspace

Overview

This use case describes how to configure password reset for accounts managed in Google Workspace. It covers self-service password reset scenarios. We also talk about delegated password reset scenarios, where an authorized administrator can reset another user’s password. A typical example is a teacher resetting a forgotten password for a student.

Prerequisites

• Fortified ID Password Reset is installed and configured as a SAML Service Provider (SP) against an SAML Identity Provider (IdP), for example Fortified ID Access.
• Configuration of the SAML IdP is outside the scope of this use case and is therefore not covered.

This use case provides an example configuration for resetting an Google Workspace password after successful user authentication. The pre-configured SAML IdP must support an authentication method that does not rely on an Google Workspace password, such as Swedish BankID, Freja, or username combined with a one-time password (OTP).

Configuration

Caution

Use these examples with synthetic test identities before deploying them. Replace example credentials and certificates with your own protected configuration. Keep TLS certificate validation enabled; install the required CA chain in the relevant truststore rather than enabling ssl_trust_all. Do not add request, session, or state dump valves to a password-reset flow: these objects can contain the new password, assertions, or access tokens. See Password Reset security configuration.

Overview of the steps in this use case

1. Configure your Google Workspace to support Password Reset
2. Configure Fortified ID Password Reset
   1. Configure the Google signing keystore
   2. Configure the HTTP client used by the Google API valves
   3. Update the Password Self Reset pipe
3. Test to reset a Google Workspace test account password

1. Configure your Google Workspace to support Password Reset

Setup the Google Workspace configuration using this guide.
This document describes how to setup the Google Directory User API to allow Fortified ID products to perform CRUD operations. It also describes how to fetch custom attribute for mappings.

2. Configure Fortified ID Password Reset

2.1 Configure the Google signing key and HTTP client

Complete the Google Workspace API setup first. Store your own signing keystore in the protected customer directory and supply the globals.google.serviceaccount and globals.keystore.google values referenced by the pipe below. The ssl_keystore_path, ssl_keystore_password, ssl_key_password, and ssl_key_alias values must identify that keystore and key. Never use an example private key in production.

The HttpPost and HttpPut valves below use an HTTP client destination named default. Configure that client with TLS certificate validation enabled; see the Password Reset external module inventory for its reference. There is no separate Entra ID module in this Google Workspace flow.

2.2 Update the Password Self Reset pipe

1. Login to Management Center for Password Reset

2. Click Configuration tab

3. Expand Password Reset

4. Expand Pipes

5. Click self_reset

6. Click JSON for JSON Edit

7. Copy data below and overwrite all existing data

   {
     "id": "self_reset",
     "display_name": "self_reset",
     "description": "Self Reset",
     "config": {
       "valves": [
   
   
         {
           "name": "CreateJwt",
           "config": {
             "jwt_ttl": 5,
             "jwt_claims": {
               "iss": "${globals.google.serviceaccount}",
               "scope": "https://www.googleapis.com/auth/admin.directory.user",
               "aud": "https://oauth2.googleapis.com/token"
             },
             "keystore": {
               "path": "${globals.keystore.google.ssl_keystore_path}",
               "password": "${globals.keystore.google.ssl_keystore_password}",
               "type": "PKCS12"
             },
             "keystore_password": "${globals.keystore.google.ssl_key_password}",
             "keystore_alias": "${globals.keystore.google.ssl_key_alias}"
           }
         },
         {
           "name": "HttpPost",
           "config": {
             "url": "https://oauth2.googleapis.com/token",
             "destination": "default",
             "parameters": {
               "assertion": "{{{item.jwt}}}",
               "grant_type": "urn:ietf:params:oauth:grant-type:jwt-bearer"
             },
             "content_type": "application/x-www-form-urlencoded"
           }
         },
         {
           "name": "HttpPut",
           "config": {
             "url": "https://admin.googleapis.com/admin/directory/v1/users/{{{request.user_name}}}",
             "destination": "default",
             "headers": {
               "Authorization": "Bearer {{{state.body.access_token}}}"
             },
             "content": {
               "changePasswordAtNextLogin": false,
               "password": "{{{request.new_password}}}"
             },
             "content_type": "application/json"
           }
         }
       ]
     }
   }

8. Click Update and Deploy

3. Test to reset a Google account password

Login to Fortified ID Password Reset

1. Browse to https://pwdreset.example.org/pwdreset/
2. Password Reset will redirect you to your SAML IdP
   1. This use case expect that you have some authentication method that is not using the password you are trying to reset. Configuration of the SAML IdP is not explained here. Use a synthetic test account with the configured authentication method; do not use a static test identity for production password resets.
3. When logged in to Fortified ID Password Reset add a new password and click Reset
4. If the password did not reset
   1. Verify the server.log file. Use the scoped troubleshooting procedure and avoid dumping requests, sessions, or token-bearing state.