Introduction
This article shows you how to connect Google Workspace to the Astrato enterprise authentication function.
Helpful Links
Setup Information
The setup process has several stages, so we've listed them here. The instructions for each stage include a Checklist listing any information you need to enter and any information you'll need to collect to complete the setup.
Google Workspace—The setup begins in the Google Cloud Console, where you'll need to create or open a Project, add a Google OAuth consent screen for authorization, create authorization Credentials, and enable the APIs you need to use.
Astrato—The integration setup with Astrato is managed in the Google Workspace Setup page, which is located in the Enterprise Authentication section of the Administration pages. You'll need to enter a Connection Name, Workspace Name, Client ID,and Client Secret.
Google Workspace
Checklist
Access to the Google Cloud Console for your organization.
Your organization name and location.
App links - home page, domain, privacy policy, terms of service, authorization provider.
The Sign out redirect URI and Scopes are listed on the Setup page for Google Workspace in Astrato. You'll also need the browser request authentication URL.
Project
In the console's top bar, click Select a Project to open the project screen
If you're working from an existing project, select it and click Open.
If you need to work from a new project, click New Project, then enter a project name, and select your organization and location, then click Create.
Important: The project name and organization cannot be changed.
You'll be taken to the project Dashboard when the project opens or is created. Click "Go to project settings" to proceed to the next stage.
Google OAuth Consent Screen
Note: You must create a separate consent screen for each project. The Learn panel on the right provides more information about the consent screen.
In the project settings, open the navigation menu (the top left button on the screen).
Click on APIs and Services
Select OAuth Consent Screen from the dropdown.
Project configuration
* This step is done once for the whole project when the first Auth client is defined.
App Information-
fill in the needed information and click next.
Audience
Set the Audiecen to Internal and click next.
Contact Information
Fill in the contact information and click next.
Finish
Agree to the usage term, click continue, and then create.
Define A Client Application
In the new side menu, click on clients and create client.
Select Web application as the application type.
Fill in the Additional Information:
Name- give the application a name
Authorized redirect URIs- paste the URL you gathered in the checklist step.
Click Create.
Add Scopes
Navigate to the Data Access tab in the left menu bar.
Click on Add or Remove Scopes
Select the openid, email, and profile scopes, then click update.
Enable API
In this step, we'll enable the APIs needed for the integration
In the dashboard, select APIs & Services and choose Library from the dropdown.
When the library screen opens, search for Google Drive.
Click Enable to register the API. When the process completes you'll see a confirmation screen.
Repeat steps 3 and 4 for the Google Sheets API.
Client Secret and ID
The last step is to obtain the Client Secret and Client ID for setting up the integration in Astrato
In the left menu bar, select the Clients option and click on the client created in a previous step.
Obtain the Client Secret and Client ID from the next screen.
Astrato
Checklist
Your Google Workspace domain name.
The Client ID and Client Secret created in the Google Cloud Console
Setup Page
Login to the Astrato site.
Navigate to the Google Workspace integration page using
Administration > Enterprise Authentication > Google Workspace (Figure 7).
Figure 7: Google Workspace
Open the Setup page (Figure 8), and enter the configuration information:
Connection name - this should be unique.
Google Workspace domain - this should match the domain you entered in the project settings.
Client ID - enter the value generated in Google cloud.
Client secret - enter the value generated in Google cloud.
Click Create to save the setup details. You should receive a confirmation that the connection has been enabled.
Figure 8: Astrato Set Up
One More Step Required
The "One more step required" button appears at the top of the configuration screen (Figure 9). When the account screen opens, click to select the account you want to use. If the authorization is successful, you'll be taken to the confirmation screen. Close the window to return to the workspace.
Figure 9: One More Step Required
Delete
If you need to delete the connection, go to the bottom of the page, click Delete, and confirm the deletion when the pop-up opens (Figure 10). Once the connection has been deleted, the Connect option will appear again.
Figure 10: Delete Connection
SSO Login
Once the connection setup is complete, your users will have to login to Astrato using the SSO Screen. Any logins from other locations (e.g. LinkedIn) will return an error.
Enterprise Authentication Articles
The Administration articles collection includes articles on enterprise authentication, including an Introduction and setup articles for other integrations.