This document describes how to setup the Google Directory User API to allow Fortified ID products to perform CRUD operations. It also describes how to fetch custom attribute for mappings.
Last updated
Google Workspace administration rights.
Login to Google Workspace admin console () as an administrator for your domain
Open the API console ()
Create a new project. Name the project UserApiLookupsFor<Customer>. (Replace <Customer> with a customer identifier. Can be any string.) Leave the rest with default valiues.
Open (select) the newly created project
Select Enabled APIs & services
Click + Enable APIS and services
Search for Admin SDK API
Select Admin SDK API
Click Enable
Click on Admin SDK API
Click Credentials
Click Manage Service Accounts
Click +Create Service Account
Enter a name, userapi. Create
Click on the newly created Service Account
Click Keys
Click Add key -> Create new key
Select p12 format
Copy the private key password
Rename the downloaded p12 file to google_jwt_signer.p12
Place the p12 file on the Integrity Web / Password reset / Forms server (depending on your use case). Remove the file from your client.
Copy the service account email adress value (for example userapi@userapilookups.iam.gserviceaccount.com)
Navigate to Account->Admin roles
Click Assign Admin in the row representing the role User Management Admin
Click Assign Service account
Enter the service account email address
Click ADD
From the admin console, navigate to Directory->Users
Select More options->Manage custom attributes
Find the schema and attribute name for the social security number (or add a new custom attribute for that purpose). In the example below, the schema name is FortifiedID and the attribute name is personnummer.
(Store the social security number on the user objects, if it hasn't been provisioned already)
(This step is only required if the use case involves Integrity Web. If not, please skip this step).
Place the file google_jwt_signer.p12 in the folder customer/config/resources_internal/certificates/Google/. (Replace if a file already exists)
Open the file customer/config/globals.json. Change according to the instructions below.
Set the proper values for your environment.
Set domain to your Google DNS domain.
Set serviceaccount to the value fetched in previous step.
Set custom_attribute to schema.attribute_name fetched in previous step.
Example:
keystore->google
Change the passwords (ssl_keystore_password and ssl_key_password) to the private key password fetched in previous step.
Example:
(This step is only required if the use case involves Password Reset. If not, please skip this step).
Place the file google_jwt_signer.p12 in the folder customer/config/resources_internal/certificates/Google/. (Replace if a file already exists)
Open the file customer/config/globals.json. Change according to the instructions below.
Set the proper values for your environment.
Set serviceaccount to the value fetched in previous step.
Example:
keystore->google
Change the passwords (ssl_keystore_password and ssl_key_password) to the private key password fetched in previous step.
Example:
(This step is only required if the use case involves Forms. If not, please skip this step).
Place the file google_jwt_signer.p12 in the folder customer/config/resources_internal/certificates/Google/. (Replace if a file already exists)
Open the file customer/config/globals.json. Change according to the instructions below.
Set the proper values for your environment.
Set domain to your Google DNS domain.
Set serviceaccount to the value fetched in previous step.
Set custom_schema_name to schema fetched in previous step.
Set custom_update_structure to match what should be sent to the Google API. Change the schema name and attribute names to match your environment.
Example:
keystore->google
Change the passwords (ssl_keystore_password and ssl_key_password) to the private key password fetched in previous step.
Example:
Save the file.
Open the admin console ()
Set mapping_attribute to the google directory api attribute that connects the delegated admin with the users the admin should be able to manage. Please view for more info about attribute names.
