Google Services

Before opting for Google Services instead of the Google SAML application to log in with your Google Workspace account, evaluate the potential cost implications for using Google Services.

Prerequisites

  • Administrator access to the Harmony SASE Administrator Portal.

  • Administrator account with the Identity Provider Management Portal.

High-Level Procedure

Step 1 - Generate the Google Client ID and Client Secret

  1. Log in to the Google Admin Console.

  2. Open the console left side menu and select APIs & services, and then select Credentials.

  3. Select a project.

  4. If you do not have a project defined on Google Cloud Platform:

    1. Click Create.

      The New Project pop-up appears.

    2. Enter these details:

      • Project Name

      • Project ID

      • Organization - The organization to which the project should attach to.

      • Location - Parent organization or folder where the project should be saved.

    3. Click Create.

  5. Go to OAuth consent screen, select User Type as External and then click Create.

    The Edit app registration page appears. The information entered here will be used by the users to know who you are and contact you.

  6. In the OAuth consent screen section, enter these values:

    1. Select the Application Type as Public.

    2. In the Application Name field, enter a name for the application.

    3. In the User support email field, enter an email address. The users use this email address to contact for questions about the consent.

    4. (Optional) To add a logo, in the Add logo field, click Browse and select the logo.

    5. In the Application Homepage link field, enter your Harmony SASE workspace URL.

    6. In the Authorized domains section, enter your domain name and click Add Domain.

    7. In the Developer contact information field, enter your support email address.

    8. Click Save and Continue.

  7. In the Scopes section, select these options:

    1. Click Add or Remove Scopes.

    2. Select these scopes:

      1. userinfo.email

      2. userinfo.profile

      3. openid

    3. Click Update and then click Save and Continue.

  8. (Optional) To test the users if they are able to access the application:

    1. Click Add Users.

    2. Enter the user email addresses.

  9. To skip testing the users and continue, click Save and Continue.

    Google creates your project and when the process completes, it prompts you to create credentials.

  10. Click Create credentials and then select OAuth client ID.

    Google shows a To create an OAuth client ID, you must first set a product name on the consent screen warning.

  11. Click Configure consent and enter a product name to appear for the users when they log in through Google.

  12. Google prompts you to provide additional information about the newly-created app. Enter these details:

    • In the Application type, select Web application.

    • In the Name field, enter a name for the application.

    • In the Restrictions section, enter these details:

      • Authorized JavaScript origins: https://auth.perimeter81.com

      • Authorized redirect URI: https://auth.perimeter81.com/login/callback

    • Click Create.

  13. If Google shows "unverified app" screen before showing the consent for your app, complete the OAuth Developer Verification.

  14. Copy the Client ID and Client Secret.

Step 2 - Enable the Admin SDK Service

To connect to Google Suite enterprise domains, you need to enable the Admin SDK service. To do that:

  1. Log in to the Google Admin Console with a administrator account.

  2. From the console left side menu, select APIs & services, and then select Library.

  3. Select Admin SDK.

  4. On the Admin SDK page, select Enable.

Step 3 - Configure the Harmony SASE Administrator Portal

  1. Log in to the Harmony SASE Administrator Portal with a administrator account.

  2. Go to Settings > Identity Providers.

  3. Click Add Provider.

    The Add identity provider pop-up appears.

  4. Select Google Workspace and click Continue.

  5. In the Google Apps Domain field, enter your corporate domain name.

  6. In the Domain Aliases field, enter the business domain names separated by commas or space.

  7. In the Client ID field, enter the client ID.

  8. In the Client Secret field, enter the client secret.

  9. Click Done.

    The Edit Google Apps connection pop-up appears.

    You must configure the application to use Google's Admin APIs. To do that, you must authenticate the application.

  10. If you are an administrator in Google Workspace or you have the credentials of such a user, click Continue and authenticate the application.

    Best Practice - To authenticate, use a service user account with the sufficient permissions. If you authenticate with an administrator account and if that administrator leaves the organization, you must create a new Client ID and Client Secret and then re-authenticate with the new user.

Note - After the first successful authentication of a member with SAML, Harmony SASE does this:

  • Associates the member with the appropriate role.

  • Adds the member to the groups related to Identity Provider.

  • Applies the relevant configuration profiles to the member.