> Markdown version of https://docs.laavat.io/getting-started/onboarding/google/ from the LAAVAT PKI and Signing Platform documentation. All pages: https://docs.laavat.io/llms.txt

# Google Cloud Integration

Google Identity Platform is used to authorize users based on group membership.

The authorization is done based on the subject in the authorization token.

LAAVAT PKI and Signing Platform uses OAuth2 Implicit grant flow. Client credentials are used first to get an access token, and then user data is fetched using the access token.

---

## Creating cloud project

In the Google Cloud console, create a new project.

Name the new project accordingly.

### OAuth configuration

#### Set Up OAuth Consent Screen  

1. Navigate to **APIs & Services > OAuth consent screen** in the Google Cloud Console.
2. Select **GO TO NEW EXPERIENCE** (If visible).
3. Select **GET STARTED** 
4. Fill in the following details:  
    - App name: Name the new application accordingly.
    - User support email. This needs to be a internal email address.
    - Click **NEXT**
5. For Audience
    - Select **Internal** (for organizational use only).
    - Click **NEXT**
6. For Contact Information
    - Add: support@laavat.io
    - Click **NEXT**
7. On Finish
    - Agree with a User Data Policy
    - Click **CONTINUE**
8. Click **CREATE**  

#### Create OAuth Client

1. Go to **APIs & Services > Credentials**.  
2. Click **Create credentials** > **OAuth Client ID**.  
3. Choose **Application type**: Web application
4. Fill in information
   - Name: Name the new client accordingly.
   - Authorized redirect URIs:
      - `https://app.laavat.io/<CustomerName>/api/v1/auth/callback`
      - `https://app.laavat.io/<CustomerName>/gui/callbackgui`
5. Click **CREATE**
6. Download a client credentials JSON.
     - This JSON is needed on LAAVAT side for onboarding.

---

### Enable Required APIs  

1. Navigate to **APIs & Services > Library**.  
2. Enable APIs required by LAAVAT PKI and Signing Platform:  
    - Admin SDK API.
    - iam service account credentials api.  

---

### Set Up a Service Account for group membership checking

#### Create Service Account

1. Go to **IAM & Admin > Service Accounts**.  
2. Click **Create Service Account** and configure:  
    - Service account name: Name the new service account accordingly.  
    - Description (optional).
3. Click **CREATE AND CONTINUE**
4. Grant this service account access to project
    - Service Account Token Creator
    - Click **CONTINUE**
5. Grant users access to this service account (optional)
    - Not needed for LAAVAT PKI and Signing Platform
6. Click **DONE**
7. Create keys for service account
8. From actions:
    - click **Manage keys**
    - Click **ADD KEY**
    - Create or upload a key. Follow your organization guidelines for key creation.
9. Download the private key (JSON) and store it securely.
    - This JSON is needed on LAAVAT side for onboarding.
    - Take a note for Service account client ID.

---

### Configure Google workspace 

#### Add application to google workspace

1. On google workspace admin console
2. Click **Security > Access and data control > API controls**  
3. Click **MANAGE THIRD-PARTY APP ACCESS**
4. Click **Configure new app**
    - Type in a Service account Client ID
    - Click Search
5. Set Scope based on your organization guidelines.
   - Click continue
6. Access to Google Data. 
   - Select **Specific Google data**
   - Click **Update google services or scopes**
   - Click **Add more OAuth scopes**
   - Add scopes:
      - `https://www.googleapis.com/auth/admin.directory.group.readonly`
      - `https://www.googleapis.com/auth/admin.directory.group.member.readonly`
      - `https://www.googleapis.com/auth/admin.directory.user.readonly`
   - Click **Add**
   - Click **Save**
   - Click **Continue**
7. Review application information and click **Finish**

#### Domain wide delegation

1. On google workspace admin console
2. Click **Security > Access and data control > API controls**
3. Click **MANAGE DOMAIN WIDE DELEGATION**
4. Click **Add new**
   - Type in Client ID
   - Add OAuth scopes:
      - `https://www.googleapis.com/auth/admin.directory.group.readonly`
      - `https://www.googleapis.com/auth/admin.directory.group.member.readonly`
      - `https://www.googleapis.com/auth/admin.directory.user.readonly`
   - Click **AUTHORIZE**

#### Group check impersonated user

Create a google workspace user with a following role assigned.

- Groups Reader

Note the user email address — you will enter it in the [setup wizard](https://docs.laavat.io/getting-started/onboarding/identity-provider-setup/).

### Required credentials for Identity Provider Setup

The following credentials are needed when completing the [Identity Provider Setup](https://docs.laavat.io/getting-started/onboarding/identity-provider-setup/):

1. OAuth client JSON
2. Service Account JSON

Once credentials and [initial groups](https://docs.laavat.io/getting-started/onboarding/initialgroups/) are created, follow instructions on the chapter: [Identity Provider Setup](https://docs.laavat.io/getting-started/onboarding/identity-provider-setup/) to complete the onboarding.