Prerequisites For Google IdP

Creating a Gateway SAML app on google workspace

To configure a web application for Seqrite ZTNA user portal authentication on Google workspace admin console, follow these steps. This application is used for SAML authentication.

1. Log on to your google workspace admin console and navigate to Apps > Web and mobile apps.

   

2. Click the Add app drop-down menu and select Add custom SAML app.

   

3. Provide your app details such as App name and Description and click Continue.

   

4. Click Download Metadata to download the metadata xml file used to configure IDP while onboarding on the admin console. Click Continue.

   

5. On the Service provider details page, enter the following details.
   • Enter the ACS URL.
   • Enter the entity ID.
   • Select the checkbox for signed response option.
   • Select Email in Name ID format.
   • In Name ID, select Basic Information> Email.

   Note:
   The ACS URL and the Entity ID must contain your company domain on which you want to host the Seqrite ZTNA Gateway.

   • Example ACS URL: https://company.com/api/v1/saml/acs/callback
   • Example entity ID: https://company.com/qh/gw

   

6. In this step, we have to add the mappings.
   • In the basic information drop-down menu, select Primary email.
   • Enter the attribute name.
   • Click Add Mapping. Click Save.

   Note:
   The app attribute name should be in all lowercase alphabets only as used in the example ‘email’. Alphanumeric, special chars and space should not be used.

   

7. After finishing the app creation, navigate to the created app.
   Make sure the user access for this app is turned ON as highlighted in the following image.
   If it is not turned on, click the View details button and select On.

   

The SAML application is now ready to be used for authenticating the google workspace users on the Seqrite ZTNA user portal.

Creating a user sync app on google cloud console

1. Log on to the Google Cloud Platform https://console.cloud.google.com/

   

   In the left pane, navigate to IAM & Services > Create a Project.

   

   Fill all the required information and click Create.

2. In the left pane, navigate to APIs & Services > Dashboard.

   

3. Click ENABLE APIS AND SERVICES.

   

4. In the API Library search box, search Admin SDK and select Admin SDK API.

   

5. Click the Enable button.

   

6. In left pane, navigate to APIs & Services and select Credentials.

   

   Click Configure consent screen.

   

7. In the OAuth consent screen section, fill all the required information and click Save And Continue. (Keep the App Domain and Authorized domains blank).

   

8. In the Scope section, keep everything blank and Click Save And Continue.

   

9. Check summary and navigate to Credentials in left pane. Click Create credentials. Select OAuth client ID.

   

10. Select Web Application in Application Type dropdown. Enter application name and add below URL in Authorized redirect URIs and click Create.

    

    https://cnsdev.qhtpl.com/cns//webcns/idp-management/add-edit-idp
    https://cnsqa.qhtpl.com/cns//webcns/idp-management/add-edit-idp

    Note:
    Replace with your tenant code. You will get tenant code in your admin console URL.

    Refer the following image.

    

11. Copy Client ID and Client Secret. Download JSON to get Project ID.

    

    Use Client ID, Client Secret and Project ID to configure Google Workspace IDP in ZTNA Admin Console.

Reauthorization workflow

Removing existing OAuth client ID from google cloud console

If the OAuth client ID has been authorized and already in use, then an error occurs on the Add IdP page for IdP type Google workspace.
We need to remove this OAuth client ID from google cloud account permissions page (URL).
To remove the existing OAuth client ID from google cloud console permissions page, follow these steps.

1. Navigate to permissions page (https://myaccount.google.com/permissions) on google cloud console.
   

   Note:
   The admin user must be logged in for accessing this page.

   

2. Click the OAuth client ID for which you want to remove the access and click Remove Access.



3. Click OK.
4. Now you can add this OAuth client ID on the Add IdP page.