Google Workspace

1. Select Enable Administrators to log in to the portal using this IdP.

2. Select one of these options:

   • Login based on domain verification - Infinity Portal Administrators can log in to this Infinity Portal account with SSO from the Identity Provider. Administrators log in through the Infinity Portal login page.

   • Login with a unique URL - Infinity Portal Administrators can log in to multiple Infinity Portal accounts with SSO from the Identity Provider. Administrators log in using the URL that appears at the bottom of the Login with a unique URL section. Copy this URL and keep it in a safe place.

1. In the Service(s) Integration section, select one of these options:

   • No Services - End users of Infinity Portal services cannot authenticate with SSO from the Identity Provider. This is the default configuration.

   • All Services - End users can log in with SSO from the Identity Provider to all Check Point services that support SSO.

   • Specific Service(s) - From the list of services, select service(s) to allow end users to log into with SSO from the Identity Provider. Available services:

     • Harmony Connect

     • Quantum Gateways

2. Click Next (or, if you are editing a configuration, Apply) to complete the Integration Type configuration.

IdP Initiated lets you connect directly to the Infinity Portal from your Google Workspace Admin Console. To do this, you must create an Infinity Portal app card in your Google Workspace Admin Console. See the Google Workspace documentation for Add-ons.

Step 1: In Infinity Portal, enable IdP Initiated flow:

In the Infinity Portal > IdP Integration Allow Connectivity step, select the checkbox Enable IDP initiated flow.

The Start URL field appears.

Step 2: In your Google Workspace account, configure the IdP Settings:

1. Navigate to your Google Workspace Admin Console.

2. From the left toolbar click Apps > Web and mobile Apps.

   The Web and mobile apps menu opens.

3. From the Web and mobile apps menu, open the application object for the SAML connection to Infinity Portal.

4. Expand the Service provider details menu.

5. In the Start URL field, enter the Start URL from Infinity Portal.

6. Click Save.

In this step, you configure the attribute mapping and group membership in Google Workspace.

1. Go to Google Workspace > Attribute mapping > Attributes.

   

2. Below Google directory attributes, click Add Mapping to add an attribute field.

3. Enter these corresponding attributes from the Infinity Portal IdP Integration page.

   Google Directory attributes	App attributes
   Primary email	email
   First name	firstName
   Last name	lastName

4. In Group membership, enter these details:

   

   Google Groups	App attribute
   Enter the group(s) name	groups

5. Click Finish.

6. On the Infinity Portal IdP Integration page, click Next.

1. If you did not already download the metadata file, then go to your Google Workspace account, go to Apps > Web and mobile apps, and open the applicable application.

2. In the application page that opens, click Download Metadata.

   

3. In the Download metadata window, click Download Metadata.

4. To exit the window, click Close.

5. On the Infinity Portal IdP Integration page, click Select File and upload the Google Workspace metadata file.

   

6. Optional: Run test - This test makes sure the SAML connection between the Infinity Portal and Google Workspace is configured correctly.

7. Click Next.

You can select to continue and configure Set Directory Integration (see Set Directory Integration). Or to finish select the checkbox I want to skip this step and use this IdP for SSO authentication only and then click Next.

1. From the menu, select IAM and admin > Service Accounts > and select Create Service Account.

   1. In the Service account details, enter a service account name (such as dss-sync) and then click Create and Continue.

   2. Below Grant this service account access to project, for Quick access select Basic, and for Roles select Owner.

      

   3. Below Grant users access to this service account, click Done.

2. On the Service accounts page that opens, click the dss-sync project.

   

3. On the Service details page, click Advanced settings.

   1. Save the Client ID. Go to Advanced settings > Domain wide delegation.

      

   2. From the menu, click Keys > Add Key > Create a new key.

      

   3. For the Key type, select JSON.

      

   4. Click Create. This downloads a JSON credential file. Save the file.

   5. Close the window.

1. Sign in to the Google Admin console with a super admin account.

2. Go to Security > Access and data control > API controls.

3. Below Domain wide delegation, click Manage Domain Wide Delegation.

4. Click Add new.

   1. Enter the Service Account In Microsoft® Active Directory, a user account created explicitly to provide a security context for services running on Microsoft® Windows® Server.'s Client ID from "Create Service Account", step 3.

   2. Enter these scopes:

      Copy

      https://www.googleapis.com/auth/admin.directory.user.readonly,
      https://www.googleapis.com/auth/admin.directory.group.readonly,
      https://www.googleapis.com/auth/admin.directory.device.chromeos.readonly,
      https://www.googleapis.com/auth/admin.directory.device.mobile.readonly,
      https://www.googleapis.com/auth/admin.directory.device.chromebrowsers.readonly,
      https://www.googleapis.com/auth/cloud-identity.devices.readonly

   3. Click Authorize.

1. Below Admin Email, enter your Google Super Admin email.

2. For Credentials, upload the service account credentials from "Create Service Account", step 3.

3. Click Test Connectivity.

   Note - Allow about five minutes for Google to authorize the Domain Wide Delegation (a maximum of twenty-four hours).