> For the complete documentation index, see [llms.txt](https://oten.gitbook.io/identity-support/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://oten.gitbook.io/identity-support/integration/provisioning-connector/google-workspace-configuration.md). # Google Workspace Configuration {% hint style="info" %} Auto provisioning integrate with Google workspace documentation The google workspace account must be the role and permission: * Permission `resourcemanager.projects.create` * Role `roles/resourcemanager.organizationAdmin` {% endhint %} ### **1 - Auto provisioning from Oten to Google Workspace** **STEP 1: Create a Google Cloud Project** Login to [Google Cloud](https://console.cloud.google.com/) and create a project or chose an existing project. The project name can be "IdP Auto Provisioning" or whatever you prefer. *Create new project*
*Or Choose a current project*
#### STEP 2: Enable the Admin SDK API * In the `APIs & Services` click `+ENABLE APIS AND SERVICES`
* In the `Search for APIs & Services` enter `Admin SDK API`
* Click `ENABLE`
#### STEP 3: Create a Service Account The service account created here will be used to access the Google Workspace user and group information. * In the `IAM and Admin` menu select `Service accounts`
* Click `+CREATE SERVICE ACCOUNT` with suggested service account name: `auto-provisioning`
* For newly created service account click `Actions`/dots and select `Manage Keys`
* Click `ADD KEYS` -> `Create New Key.` Choose JSON key type then `CREATE`
* A JSON file with service account credentials will be downloaded to your computer
#### STEP 4: Copy the Client ID Navigate to your Service Account and select `DETAILS` tab > `Advanced Settings` In the `Domain-wide delegation` section copy the `Client ID`. You will need to grant this Client ID access to the Google Workspace Directory in the next step.
#### STEP 5: Authorize Service Account on Google Workspace In the Google Workspace Panel ([https://admin.google.com](https://admin.google.com/)): * Navigate to `Security` → `Access and data control` -> `API controls`
* Under the `Domain wide delegation` click `MANAGE DOMAIN WIDE DELEGATION` * Click `Add new` in `API Clients` * Paste the `Client ID` (copied from previous step) Paste the following text into `OAuth scopes (comma-delimited)` `https://www.googleapis.com/auth/admin.directory.user,https://www.googleapis.com/auth/admin.directory.user.alias,https://www.googleapis.com/auth/admin.directory.group,https://www.googleapis.com/auth/admin.directory.group.member`
* Click `AUTHORIZE` - These scopes grant Service Account read-only access to Google Workspace Directory Users, Groups and Membership. #### STEP 6: Retrieve the Primary Email * In Google Workspace ([https://admin.google.com](https://admin.google.com/)), navigate to `Account` -> `Account settings` * Copy the `Primary admin` email into the clipboard (upper right area) for use in the next step.
#### How to set up in IDP * Go to `https://admin.oten.com` → Settings → **Auto provisioning** → click **Add provider**
* In **Add provider** → select **Google Workspace**, input **primary admin email** and upload **service account keys** (JSON file) → click **Add provider**
* After add **Google Workspace provider** success → Click Enable **Google Workspace**
### **2 - Auto provisioning from Google Workspace to Oten** **Add credential (account service key) and primary admin to Oten Admin** * Go to [https://admin.oten.com](https://admin.oten.com/) → Settings → **Auto provisioning** → click **Add provider**
* In **Add provider** → select **Google Workspace**, input **primary admin email**, choose **direction** and upload **service account keys** (JSON file) → click **Add provider**
* After add **Google Workspace provider** success → Click Enable **Google Workspace**
#### Google Workspace - the provisioning configuration During synchronization, the value from the trusted source will overwrite the counterpart in the event of a conflict.
**Mapping user Google workspace with Oten** | **Google user** | **Oten account** | **Description** | | | | | | | ----------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------ | ----- | ---------------------------------------------------- | ------ | ---------------- | |

id

(string)

| `account.external_id` | Unique identity of Google | | | | | | |

primaryEmail

(string)

|

| | | | | | | |

isAdmin

(boolean)

| `user_org_role.role_id` | | | | | | | |

archived

(boolean)

| `account.status` |

Google archived = true →

Oten Soft Deleted

| | | | | | |

suspended

(boolean)

| `account.status` |

Google archived = true →

Oten Deleted

| | | | | | |

suspensionReason

(string)

| | Output only. Has the reason a user account is suspended either by the administrator or by Google at the time of suspension. The property is returned only if the `suspended` property is `true`. | | | | | | |

gender

(string)

| `user_profile.gender` |

The user profile gender

Google male | female | other | unknow

Oten male | female | other

| |

phones\[].primary

(boolean)

| | If `true`, this is the user's primary phone number. A user may only have one primary phone number. | | | | | | |

phones\[].value

(string)

| `user_profile.phone_number` | A human-readable phone number. It may be in any telephone number format. | | | | | | |

name.displayName

(string)

| `user_profile.display_name` | The user's display name. Limit: 256 characters. | | | | | | | `name.givenName` (string) | `user_profile.first_name` | The user's first name. Required when creating a user account. | | | | | | |

name.familyName

(string)

| `user_profile.last_name` | The user's last name. Required when creating a user account. | | | | | | |

thumbnailPhotoEtag

(string)

| `user_profile.picture_url` | The user's photo (avatar). | | | | | | With **account status** will be mapping to matrix after
{% hint style="info" %} **Reference:** Google Workspace API documentation * [Develop on Google Workspace | Google for Developers](https://developers.google.com/workspace/guides/get-started) {% endhint %}