Skip to content

Google Cloud Integration

Google Identity Platform is used to authorize users based on group membership.

The authorization is done based on the subject in the authorization token.

LAAVAT PKI and Signing Platform uses OAuth2 Implicit grant flow. Client credentials are used first to get an access token, and then user data is fetched using the access token.

Creating cloud project

In the Google Cloud console, create a new project.

Name the new project accordingly.

OAuth configuration

  1. Navigate to APIs & Services > OAuth consent screen in the Google Cloud Console.
  2. Select GO TO NEW EXPERIENCE (If visible).
  3. Select GET STARTED
  4. Fill in the following details:
    • App name: Name the new application accordingly.
    • User support email. This needs to be a internal email address.
    • Click NEXT
  5. For Audience
    • Select Internal (for organizational use only).
    • Click NEXT
  6. For Contact Information
    • Add: support@laavat.io
    • Click NEXT
  7. On Finish
    • Agree with a User Data Policy
    • Click CONTINUE
  8. Click CREATE

Create OAuth Client

  1. Go to APIs & Services > Credentials.
  2. Click Create credentials > OAuth Client ID.
  3. Choose Application type: Web application
  4. Fill in information
  5. Name: Name the new client accordingly.
  6. Authorized redirect URIs:
    • https://app.laavat.io/<CustomerName>/api/v1/auth/callback
    • https://app.laavat.io/<CustomerName>/gui/callbackgui
  7. Click CREATE
  8. Download a client credentials JSON.
    • This JSON is needed on LAAVAT side for onboarding.

Enable Required APIs

  1. Navigate to APIs & Services > Library.
  2. Enable APIs required by LAAVAT PKI and Signing Platform:
    • Admin SDK API.
    • iam service account credentials api.

Set Up a Service Account for group membership checking

Create Service Account

  1. Go to IAM & Admin > Service Accounts.
  2. Click Create Service Account and configure:
    • Service account name: Name the new service account accordingly.
    • Description (optional).
  3. Click CREATE AND CONTINUE
  4. Grant this service account access to project
    • Service Account Token Creator
    • Click CONTINUE
  5. Grant users access to this service account (optional)
    • Not needed for LAAVAT PKI and Signing Platform
  6. Click DONE
  7. Create keys for service account
  8. From actions:
    • click Manage keys
    • Click ADD KEY
    • Create or upload a key. Follow your organization guidelines for key creation.
  9. Download the private key (JSON) and store it securely.
    • This JSON is needed on LAAVAT side for onboarding.
    • Take a note for Service account client ID.

Configure Google workspace

Add application to google workspace

  1. On google workspace admin console
  2. Click Security > Access and data control > API controls
  3. Click MANAGE THIRD-PARTY APP ACCESS
  4. Click Configure new app
    • Type in a Service account Client ID
    • Click Search
  5. Set Scope based on your organization guidelines.
  6. Click continue
  7. Access to Google Data.
  8. Select Specific Google data
  9. Click Update google services or scopes
  10. Click Add more OAuth scopes
  11. Add scopes:
    • https://www.googleapis.com/auth/admin.directory.group.readonly
    • https://www.googleapis.com/auth/admin.directory.group.member.readonly
    • https://www.googleapis.com/auth/admin.directory.user.readonly
  12. Click Add
  13. Click Save
  14. Click Continue
  15. Review application information and click Finish

Domain wide delegation

  1. On google workspace admin console
  2. Click Security > Access and data control > API controls
  3. Click MANAGE DOMAIN WIDE DELEGATION
  4. Click Add new
  5. Type in Client ID
  6. Add OAuth scopes:
    • https://www.googleapis.com/auth/admin.directory.group.readonly
    • https://www.googleapis.com/auth/admin.directory.group.member.readonly
    • https://www.googleapis.com/auth/admin.directory.user.readonly
  7. Click AUTHORIZE

Group check impersonated user

Create a google workspace user with a following role assigned.

  • Groups Reader

Write the user email address to the registration form.

Information needed by LAAVAT

Following JSON required:

  1. OAuth client JSON
  2. Service Account JSON

For credentials transfer follow instructions on the chapter: Secure credentials transfer to LAAVAT.