# Google Workspace Configuration

{% hint style="info" %}
Auto provisioning integrate with Google workspace documentation

The google workspace account must be the role and permission:

* Permission `resourcemanager.projects.create`
* Role `roles/resourcemanager.organizationAdmin`
  {% endhint %}

**STEP 1: Create a Google Cloud Project**

Login to [Google Cloud](https://console.cloud.google.com/) and create a project or chose an existing project. The project name can be "IdP Auto Provisioning" or whatever you prefer.

*Create new project*

<figure><img src="/files/hzfqGvKUJEFVereKlPgI" alt=""><figcaption></figcaption></figure>

*Or Choose a current project*

<figure><img src="/files/P9svShgOGT7I0Nu2Dsgg" alt=""><figcaption></figcaption></figure>

#### STEP 2: Enable the Admin SDK API <a href="#step-2-enable-the-admin-sdk-api" id="step-2-enable-the-admin-sdk-api"></a>

* In the `APIs & Services` click `+ENABLE APIS AND SERVICES`

<figure><img src="/files/4dtf8fB8jrZXRUzAZvvW" alt=""><figcaption></figcaption></figure>

* In the `Search for APIs & Services` enter `Admin SDK API`

<figure><img src="/files/tRCW8eyeohQddJBXU6n2" alt=""><figcaption></figcaption></figure>

* Click `ENABLE`

<figure><img src="/files/1tqgy4MblXHyrEeMBwe5" alt=""><figcaption></figcaption></figure>

#### STEP 3: Create a Service Account <a href="#step-3-create-a-service-account" id="step-3-create-a-service-account"></a>

The service account created here will be used to access the Google Workspace user and group information.

* In the `IAM and Admin` menu select `Service accounts`

<figure><img src="/files/GN1rWrbsnJLMvg34FIvS" alt=""><figcaption></figcaption></figure>

* Click `+CREATE SERVICE ACCOUNT` with suggested service account name: `auto-provisioning`

<figure><img src="/files/sYtT5ws6WfBDtJrw1RR3" alt=""><figcaption></figcaption></figure>

* For newly created service account click `Actions`/dots and select `Manage Keys`

<figure><img src="/files/xHCzYgENJCOGiqNMuQ7D" alt=""><figcaption></figcaption></figure>

* Click `ADD KEYS` -> `Create New Key.` Choose JSON key type then `CREATE`

<figure><img src="/files/oEUs4gER0odsQjITEXHc" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/T89qlB0rDHqUdwRgxYaN" alt=""><figcaption></figcaption></figure>

* A JSON file with service account credentials will be downloaded to your computer

<figure><img src="/files/ubTY0UdItDWNHNY8ZhXu" alt=""><figcaption></figcaption></figure>

#### STEP 4: Copy the Client ID <a href="#step-4-copy-the-client-id" id="step-4-copy-the-client-id"></a>

Navigate to your Service Account and select `DETAILS` tab > `Advanced Settings`

In the `Domain-wide delegation` section copy the `Client ID`. You will need to grant this Client ID access to the Google Workspace Directory in the next step.

<figure><img src="/files/9r4RDf8nzv3KZ52ltAaF" alt=""><figcaption></figcaption></figure>

#### STEP 5: Authorize Service Account on Google Workspace <a href="#step-5-authorize-service-account-on-google-workspace" id="step-5-authorize-service-account-on-google-workspace"></a>

In the Google Workspace Panel ([https://admin.google.com](https://admin.google.com/)):

* Navigate to `Security` → `Access and data control` -> `API controls`

<figure><img src="/files/JVENgVmWnBdr6d9GeJQN" alt=""><figcaption></figcaption></figure>

* Under the `Domain wide delegation` click `MANAGE DOMAIN WIDE DELEGATION`
* Click `Add new` in `API Clients`
* Paste the `Client ID` (copied from previous step)

Paste the following text into `OAuth scopes (comma-delimited)`

`https://www.googleapis.com/auth/admin.directory.user,https://www.googleapis.com/auth/admin.directory.user.alias,https://www.googleapis.com/auth/admin.directory.group,https://www.googleapis.com/auth/admin.directory.group.member`&#x20;

<figure><img src="/files/rMd64hIY2DGyOPkq96GX" alt=""><figcaption></figcaption></figure>

* Click `AUTHORIZE` - These scopes grant Service Account read-only access to Google Workspace Directory Users, Groups and Membership.

#### STEP 6: Retrieve the Primary Email <a href="#step-6-retrieve-the-primary-email" id="step-6-retrieve-the-primary-email"></a>

* In Google Workspace ([https://admin.google.com](https://admin.google.com/)), navigate to `Account` -> `Account settings`
* Copy the `Primary admin` email into the clipboard (upper right area) for use in the next step.

<figure><img src="/files/u45zE9XOiWZmAEVZu4Mm" alt=""><figcaption></figcaption></figure>

### Add credential (account service key) and primary admin to Oten Admin <a href="#add-credential-account-service-key-and-primary-admin-to-oten-admin" id="add-credential-account-service-key-and-primary-admin-to-oten-admin"></a>

* Go to `https://admin.oten.com` → Settings → **Auto provisioning** → click **Add provider**

<figure><img src="/files/oxtIA382gCqal0KqhCAo" alt=""><figcaption></figcaption></figure>

* In **Add provider** → select **Google Workspace**, input **primary admin email** and upload **service account keys** (JSON file) → click **Add provider**

<figure><img src="/files/COJgsOj7CUnh6mXJ1wDf" alt=""><figcaption></figcaption></figure>

* After add **Google Workspace provider** success → Click Enable **Google Workspace**

<figure><img src="/files/IGEoKbddGNTm9vmA91LX" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/SDC6mb3OopNHsZnj6yBE" alt=""><figcaption></figcaption></figure>

{% hint style="info" %}
**Reference:**

Google Workspace API documentation

* [Develop on Google Workspace  |  Google for Developers](https://developers.google.com/workspace/guides/get-started)
  {% endhint %}


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://oten.gitbook.io/identity-support/integration/provisioning-connector/google-workspace-configuration.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.