Seqrite XDR

Google Workspace AD Connector

Print Friendly, PDF & Email

Here’s a more polished and professional version of your document:

Google Workspace AD Connector Setup Guide

1. Create a New Project in Google Cloud Console

  1. Navigate to the Manage Resources page in the Google Cloud Console.
  2. Click Create Project.

  3. In the New Project window:

    • Enter a Project Name (must be 4–30 characters and can include letters, numbers, single quotes, hyphens, spaces, or exclamation points).

    • Specify the Parent Organization or Folder Resource in the Organization and Location field.

      • If you do not have an organization, you can select No organization to create the project at the top level of its own hierarchy.
  4. Click Create to finalize the project creation.

2. Add Credentials to the Project

  1. In the Google Cloud Console, select the project you just created.
  2. Go to APIs & Services > Credentials.
  3. Click + Create Credentials and choose OAuth Client ID.
  4. For Application Type, select Desktop App.
  5. Under Authorized Redirect URIs, add:
    https://developers.google.com/oauthplayground
  6. Click Create.
  7. Copy the Client ID and Client Secret. These will be used later in the integration configuration.

  8. Enable the Gmail API:

    • Go to the API Library.
    • Search for and select Gmail API, then click Enable.

3. Generate an OAuth Code

  1. Open OAuth 2.0 Playground.
  2. Click the gear icon (⚙) in the top right corner and enable Use your own OAuth credentials.

  3. Set the following:

    • OAuth flow: Server-side
    • Access type: Offline (to obtain both refresh and access tokens)
  4. Enter your OAuth2 Client ID and Client Secret.

  5. In Step 1 – Select & authorize APIs:

    • Choose Google Ads API and select the following scope:
      https://www.googleapis.com/auth/adwords
    • Click Authorize APIs and log in with the desired account.
  6. Click Accept when prompted for access permissions.
  7. In Step 2 – Exchange authorization code for tokens, click the button to exchange.
  8. Copy the Refresh Token, Client ID, and Client Secret for use in connector configuration.

4. Create a Service Account

  1. In the Cloud Console, search for Service Accounts, then click Create Service Account.

  2. Provide a Service Account Name and click Create and Continue.

  3. Keep default settings and click Done.

  4. To create a private key:

    • Open the Service Account page.
    • Click the Actions button (⋮) next to your service account.
    • Select Manage Keys > Add Key > Create New Key.
    • Choose P12 format and click Create.
    • Save the downloaded .p12 key file and note the password (usually notasecret unless otherwise set). This will not be displayed again.

  5. Back on the Service Accounts page:

    • Note the Service Account Email and OAuth2 Client ID for use in the connector configuration.

5. Enable Required APIs

  1. In the Cloud Console, search for APIs & Services, then click Enable APIs and Services.

  2. Enable the following APIs:

    • Gmail API
    • Admin SDK API

6. Enable Domain-Wide Delegation

  1. Log in to the Google Admin Console.
  2. Navigate to:
    Security > Access and Data Control > API Controls
  3. Click Manage Domain-Wide Delegation.
  4. Click Add New.

  5. In the form:

    • Paste the OAuth 2.0 Client ID from your service account.

    • Add the following scopes:

      https://www.googleapis.com/auth/admin.reports.audit.readonly, 
https://www.googleapis.com/auth/admin.reports.usage.readonly
  6. Click Authorize to enable domain-wide delegation.

7. Install OpenSSL and Extract the Private Key

  1. Follow instructions to install OpenSSL with Cygwin on Windows.

  2. Open Cygwin Terminal and confirm installation by running:

    openssl version
  3. Copy the downloaded .p12 file to:
    C:\cygwin64\home\<your_user_directory>

  4. Run the following command to extract the private key:

    openssl pkcs12 -info -in  -nodes -nocerts
  5. Enter the .p12 file password when prompted.
  6. Copy the content between -----BEGIN PRIVATE KEY----- and -----END PRIVATE KEY----- (excluding those lines).
    Save it for the connector configuration as the Private Key.

8. Configure the Google Workspace Connector

  1. In your connector platform, go to Ingestion.
  2. Select Google Workspace Message Downloader Connector and click Configure.

  3. Enter the following values:

    • OAuth Code (Refresh Token)
    • Client ID
    • Client Secret
    • Client Email ID
    • Service Account Email ID
    • Private Key
    • Private Key ID
  4. Click Validate and Save to complete the configuration.
Was this page helpful?
Yes No