> For the complete documentation index, see [llms.txt](https://docs.fortifiedid.se/use-cases/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.fortifiedid.se/use-cases/misc/google/common-configuration-for-google-workspace-directory-api.md).

# Common configuration for Google Workspace - Directory API

This document describes how to setup the Google Directory User API to allow Fortified ID products to perform CRUD operations. It also describes how to fetch custom attribute for mappings.

## Prerequisite

* **Google Workspace administration rights.**

### Update the Google Workspace configuration

#### Setup API for user lookup

* Login to Google Workspace admin console (<https://admin.google.com>) as an administrator for your domain
* Open the API console (<https://console.developers.google.com>)
* Create a new project. Name the project *UserApiLookupsFor\<Customer>*. (Replace \<Customer> with a customer identifier. Can be any string.)\
  Leave the rest with default valiues.
* Open (select) the newly created project
* Select *Enabled APIs & services*
* Click *+ Enable APIS and services*
* Search for *Admin SDK API*
* Select *Admin SDK API*
* Click *Enable*
* Click on *Admin SDK API*

<figure><img src="https://4941856-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fma90VxImBcL0Zervef45%2Fuploads%2FUgU0QLLIJyYgU6cucsfH%2Fgoogle_enabled_apis_and_services.png?alt=media&amp;token=5eea3750-bd5b-43ce-8441-f464b684a41d" alt=""><figcaption></figcaption></figure>

* Click *Credentials*
* Click *Manage Service Accounts*

<figure><img src="https://4941856-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fma90VxImBcL0Zervef45%2Fuploads%2FKXXkieQz0p2KIij8gKC2%2Fgoogle_creds_service_accounts.png?alt=media&amp;token=45765a17-7a9c-4e6e-8d91-c2c460b1bc9d" alt=""><figcaption></figcaption></figure>

* Click *+Create Service Account*
* Enter a name, *userapi. Create*
* Click on the newly created Service Account
* Click *Keys*
* Click *Add key -> Create new key*
* Select *p12 format*
* Copy the private key password
* Rename the downloaded p12 file to google\_jwt\_signer.p12
* Place the p12 file on the Integrity Web / Password reset / Forms server (depending on your use case). Remove the file from your client.
* Copy the service account email adress value (for example *<userapi@userapilookups.iam.gserviceaccount.com>*)
* Open the admin console (<https://admin.google.com>)
* Navigate to *Account->Admin roles*
* Click *Assign Admin* in the row representing the role *User Management Admin*

<figure><img src="https://4941856-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fma90VxImBcL0Zervef45%2Fuploads%2FNfBp0XvTjWQpX5l0wsuj%2Fgoogle_assign_admin.png?alt=media&amp;token=f4fd6aab-6196-48a6-b876-65029e71d308" alt=""><figcaption></figcaption></figure>

* Click *Assign Service account*
* Enter the service account email address
* Click *ADD*

#### Fetch the schema and custom attribute

* From the admin console, navigate to *Directory->Users*
* Select *More options->Manage custom attributes*
* Find the schema and attribute name for the social security number (or add a new custom attribute for that purpose). In the example below, the schema name is *FortifiedID* and the attribute name is *personnummer*.

<figure><img src="https://4941856-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fma90VxImBcL0Zervef45%2Fuploads%2FI5vgaBAOAqUe1NV6hXay%2Fgoogle_custom_attribute.png?alt=media&amp;token=332cf1c6-0852-4a35-8e11-ba5b514a7c68" alt=""><figcaption></figcaption></figure>

* (Store the social security number on the user objects, if it hasn't been provisioned already)

### Update the configuration to map to your environment

#### Integrity Web

(This step is only required if the use case involves Integrity Web. If not, please skip this step).

Place the file google\_jwt\_signer.p12 in the folder customer/config/resources\_internal/certificates/Google/. (Replace if a file already exists)

Open the file customer/config/globals.json. Change according to the instructions below.

1. google

Set the proper values for your environment.

Set *domain* to your Google DNS domain.

Set *serviceaccount* to the value fetched in previous step.

Set *custom\_attribute* to schema.attribute\_name fetched in previous step.

Example:

```json
"google": {
            "domain": "fortifiedid.se",
            "serviceaccount": "userapi@userapilookups.iam.gserviceaccount.com",
            "custom_attribute": "FortifiedID.personnummer"
        },
```

2. keystore->google

Change the passwords (*ssl\_keystore\_password* and *ssl\_key\_password)* to the private key password fetched in previous step.

Example:

```json
"google": {
            "ssl_keystore_path": "${globals.file_path.base_dir}/config/resources_internal/certificates/Google/google_jwt_signer.p12",
            "ssl_keystore_password": "Summer2022rr3",
            "ssl_key_alias": "privatekey",
            "ssl_key_password": "Summer2022rr3"
        }
```

#### Password reset

(This step is only required if the use case involves Password Reset. If not, please skip this step).<br>

Place the file google\_jwt\_signer.p12 in the folder customer/config/resources\_internal/certificates/Google/. (Replace if a file already exists)

Open the file customer/config/globals.json. Change according to the instructions below.

1. google

Set the proper values for your environment.

Set *serviceaccount* to the value fetched in previous step.

Example:

```json
"google": {
            "serviceaccount": "userapi@userapilookups.iam.gserviceaccount.com"
        },
```

2. keystore->google

Change the passwords (*ssl\_keystore\_password* and *ssl\_key\_password)* to the private key password fetched in previous step.

Example:

```json
"google": {
            "ssl_keystore_path": "${globals.file_path.base_dir}/config/resources_internal/certificates/Google/google_jwt_signer.p12",
            "ssl_keystore_password": "Summer2022rr3",
            "ssl_key_alias": "privatekey",
            "ssl_key_password": "Summer2022rr3"
        }
```

#### Forms

(This step is only required if the use case involves Forms. If not, please skip this step).

Place the file google\_jwt\_signer.p12 in the folder customer/config/resources\_internal/certificates/Google/. (Replace if a file already exists)

Open the file customer/config/globals.json. Change according to the instructions below.

1. google

Set the proper values for your environment.

Set *domain* to your Google DNS domain.

Set *serviceaccount* to the value fetched in previous step.

Set *mapping\_attribute* to the google directory api attribute that connects the delegated admin with the users the admin should be able to manage. Please view [this Google documentation](https://developers.google.com/admin-sdk/directory/v1/guides/search-users#fields) for more info about attribute names.

Set *custom\_schema\_name* to schema fetched in previous step.

Set *custom\_update\_structure* to match what should be sent to the Google API. Change the schema name and attribute names to match your environment.

Example:

```json
"google": {
        "domain": "fortifiedid.se",
        "serviceaccount": "userapi@userapilookups.iam.gserviceaccount.com",
        "mapping_attribute": "orgDepartment",
        "custom_schema_name" : "FortifiedID",
        "custom_update_structure": {
            "customSchemas": {
                "FortifiedID": {
                    "mlsman1": "{{{request.malsman1}}}",
                    "mlsman2": "{{{request.malsman2}}}"
                }
            }
        }
    },
```

2. keystore->google

Change the passwords (*ssl\_keystore\_password* and *ssl\_key\_password)* to the private key password fetched in previous step.

Example:

```json
"google": {
            "ssl_keystore_path": "${globals.file_path.base_dir}/config/resources_internal/certificates/Google/google_jwt_signer.p12",
            "ssl_keystore_password": "Summer2022rr3",
            "ssl_key_alias": "privatekey",
            "ssl_key_password": "Summer2022rr3"
        }
```

Save the file.

<br>