diff --git a/public/docs-static/img/manage/team/idp-sync/google-workspace-sync/6Huo7vW.png b/public/docs-static/img/manage/team/idp-sync/google-workspace-sync/6Huo7vW.png deleted file mode 100644 index 521e6292..00000000 Binary files a/public/docs-static/img/manage/team/idp-sync/google-workspace-sync/6Huo7vW.png and /dev/null differ diff --git a/public/docs-static/img/manage/team/idp-sync/google-workspace-sync/9ECRJqC.png b/public/docs-static/img/manage/team/idp-sync/google-workspace-sync/9ECRJqC.png deleted file mode 100644 index 3776f31e..00000000 Binary files a/public/docs-static/img/manage/team/idp-sync/google-workspace-sync/9ECRJqC.png and /dev/null differ diff --git a/public/docs-static/img/manage/team/idp-sync/google-workspace-sync/BPfboem.png b/public/docs-static/img/manage/team/idp-sync/google-workspace-sync/BPfboem.png deleted file mode 100644 index 13805d5a..00000000 Binary files a/public/docs-static/img/manage/team/idp-sync/google-workspace-sync/BPfboem.png and /dev/null differ diff --git a/public/docs-static/img/manage/team/idp-sync/google-workspace-sync/F80lm4H.png b/public/docs-static/img/manage/team/idp-sync/google-workspace-sync/F80lm4H.png deleted file mode 100644 index 4f8e1045..00000000 Binary files a/public/docs-static/img/manage/team/idp-sync/google-workspace-sync/F80lm4H.png and /dev/null differ diff --git a/public/docs-static/img/manage/team/idp-sync/google-workspace-sync/GBbcnt3.png b/public/docs-static/img/manage/team/idp-sync/google-workspace-sync/GBbcnt3.png deleted file mode 100644 index 9c62054a..00000000 Binary files a/public/docs-static/img/manage/team/idp-sync/google-workspace-sync/GBbcnt3.png and /dev/null differ diff --git a/public/docs-static/img/manage/team/idp-sync/google-workspace-sync/HLddKPh.png b/public/docs-static/img/manage/team/idp-sync/google-workspace-sync/HLddKPh.png deleted file mode 100644 index ddb9894d..00000000 Binary files a/public/docs-static/img/manage/team/idp-sync/google-workspace-sync/HLddKPh.png and /dev/null differ diff --git a/public/docs-static/img/manage/team/idp-sync/google-workspace-sync/IBEGQD8.png b/public/docs-static/img/manage/team/idp-sync/google-workspace-sync/IBEGQD8.png deleted file mode 100644 index b7753851..00000000 Binary files a/public/docs-static/img/manage/team/idp-sync/google-workspace-sync/IBEGQD8.png and /dev/null differ diff --git a/public/docs-static/img/manage/team/idp-sync/google-workspace-sync/IZn8XWY.png b/public/docs-static/img/manage/team/idp-sync/google-workspace-sync/IZn8XWY.png deleted file mode 100644 index 0e862417..00000000 Binary files a/public/docs-static/img/manage/team/idp-sync/google-workspace-sync/IZn8XWY.png and /dev/null differ diff --git a/public/docs-static/img/manage/team/idp-sync/google-workspace-sync/JWdAg4R.png b/public/docs-static/img/manage/team/idp-sync/google-workspace-sync/JWdAg4R.png deleted file mode 100644 index a7a1ffcb..00000000 Binary files a/public/docs-static/img/manage/team/idp-sync/google-workspace-sync/JWdAg4R.png and /dev/null differ diff --git a/public/docs-static/img/manage/team/idp-sync/google-workspace-sync/Ky8bguM.png b/public/docs-static/img/manage/team/idp-sync/google-workspace-sync/Ky8bguM.png deleted file mode 100644 index b823c63e..00000000 Binary files a/public/docs-static/img/manage/team/idp-sync/google-workspace-sync/Ky8bguM.png and /dev/null differ diff --git a/public/docs-static/img/manage/team/idp-sync/google-workspace-sync/METhl2T.png b/public/docs-static/img/manage/team/idp-sync/google-workspace-sync/METhl2T.png deleted file mode 100644 index d64a21a8..00000000 Binary files a/public/docs-static/img/manage/team/idp-sync/google-workspace-sync/METhl2T.png and /dev/null differ diff --git a/public/docs-static/img/manage/team/idp-sync/google-workspace-sync/MGgCzky.png b/public/docs-static/img/manage/team/idp-sync/google-workspace-sync/MGgCzky.png deleted file mode 100644 index 60241a68..00000000 Binary files a/public/docs-static/img/manage/team/idp-sync/google-workspace-sync/MGgCzky.png and /dev/null differ diff --git a/public/docs-static/img/manage/team/idp-sync/google-workspace-sync/WZWFp1Z.png b/public/docs-static/img/manage/team/idp-sync/google-workspace-sync/WZWFp1Z.png deleted file mode 100644 index a3595bb6..00000000 Binary files a/public/docs-static/img/manage/team/idp-sync/google-workspace-sync/WZWFp1Z.png and /dev/null differ diff --git a/public/docs-static/img/manage/team/idp-sync/google-workspace-sync/WzqMsmW.png b/public/docs-static/img/manage/team/idp-sync/google-workspace-sync/WzqMsmW.png deleted file mode 100644 index a18b8cba..00000000 Binary files a/public/docs-static/img/manage/team/idp-sync/google-workspace-sync/WzqMsmW.png and /dev/null differ diff --git a/public/docs-static/img/manage/team/idp-sync/google-workspace-sync/X1CYEHq.png b/public/docs-static/img/manage/team/idp-sync/google-workspace-sync/X1CYEHq.png deleted file mode 100644 index f4573681..00000000 Binary files a/public/docs-static/img/manage/team/idp-sync/google-workspace-sync/X1CYEHq.png and /dev/null differ diff --git a/public/docs-static/img/manage/team/idp-sync/google-workspace-sync/Z4CQd9O.png b/public/docs-static/img/manage/team/idp-sync/google-workspace-sync/Z4CQd9O.png deleted file mode 100644 index 3ef93e7a..00000000 Binary files a/public/docs-static/img/manage/team/idp-sync/google-workspace-sync/Z4CQd9O.png and /dev/null differ diff --git a/public/docs-static/img/manage/team/idp-sync/google-workspace-sync/ZYSw3KZ.png b/public/docs-static/img/manage/team/idp-sync/google-workspace-sync/ZYSw3KZ.png deleted file mode 100644 index f0e423a5..00000000 Binary files a/public/docs-static/img/manage/team/idp-sync/google-workspace-sync/ZYSw3KZ.png and /dev/null differ diff --git a/public/docs-static/img/manage/team/idp-sync/google-workspace-sync/bSakeRS.png b/public/docs-static/img/manage/team/idp-sync/google-workspace-sync/bSakeRS.png deleted file mode 100644 index be13428e..00000000 Binary files a/public/docs-static/img/manage/team/idp-sync/google-workspace-sync/bSakeRS.png and /dev/null differ diff --git a/public/docs-static/img/manage/team/idp-sync/google-workspace-sync/gUQ4XAd.png b/public/docs-static/img/manage/team/idp-sync/google-workspace-sync/gUQ4XAd.png deleted file mode 100644 index c385ffbf..00000000 Binary files a/public/docs-static/img/manage/team/idp-sync/google-workspace-sync/gUQ4XAd.png and /dev/null differ diff --git a/public/docs-static/img/manage/team/idp-sync/google-workspace-sync/ij3niha.png b/public/docs-static/img/manage/team/idp-sync/google-workspace-sync/ij3niha.png deleted file mode 100644 index ab688634..00000000 Binary files a/public/docs-static/img/manage/team/idp-sync/google-workspace-sync/ij3niha.png and /dev/null differ diff --git a/public/docs-static/img/manage/team/idp-sync/google-workspace-sync/jhgTfsk.png b/public/docs-static/img/manage/team/idp-sync/google-workspace-sync/jhgTfsk.png deleted file mode 100644 index 2428000f..00000000 Binary files a/public/docs-static/img/manage/team/idp-sync/google-workspace-sync/jhgTfsk.png and /dev/null differ diff --git a/public/docs-static/img/manage/team/idp-sync/google-workspace-sync/pmeCOd4.png b/public/docs-static/img/manage/team/idp-sync/google-workspace-sync/pmeCOd4.png deleted file mode 100644 index 49cdfcc0..00000000 Binary files a/public/docs-static/img/manage/team/idp-sync/google-workspace-sync/pmeCOd4.png and /dev/null differ diff --git a/public/docs-static/img/manage/team/idp-sync/google-workspace-sync/q6tuStz.png b/public/docs-static/img/manage/team/idp-sync/google-workspace-sync/q6tuStz.png deleted file mode 100644 index ffa8e137..00000000 Binary files a/public/docs-static/img/manage/team/idp-sync/google-workspace-sync/q6tuStz.png and /dev/null differ diff --git a/public/docs-static/img/manage/team/idp-sync/google-workspace-sync/rDU0Puv.png b/public/docs-static/img/manage/team/idp-sync/google-workspace-sync/rDU0Puv.png deleted file mode 100644 index c88dd495..00000000 Binary files a/public/docs-static/img/manage/team/idp-sync/google-workspace-sync/rDU0Puv.png and /dev/null differ diff --git a/public/docs-static/img/manage/team/idp-sync/google-workspace-sync/rPYNLz1.png b/public/docs-static/img/manage/team/idp-sync/google-workspace-sync/rPYNLz1.png deleted file mode 100644 index f9d713b0..00000000 Binary files a/public/docs-static/img/manage/team/idp-sync/google-workspace-sync/rPYNLz1.png and /dev/null differ diff --git a/public/docs-static/img/manage/team/idp-sync/google-workspace-sync/sGLG0tX.png b/public/docs-static/img/manage/team/idp-sync/google-workspace-sync/sGLG0tX.png deleted file mode 100644 index ab94cdff..00000000 Binary files a/public/docs-static/img/manage/team/idp-sync/google-workspace-sync/sGLG0tX.png and /dev/null differ diff --git a/public/docs-static/img/manage/team/idp-sync/google-workspace-sync/tRbBQsR.png b/public/docs-static/img/manage/team/idp-sync/google-workspace-sync/tRbBQsR.png deleted file mode 100644 index 92ca2945..00000000 Binary files a/public/docs-static/img/manage/team/idp-sync/google-workspace-sync/tRbBQsR.png and /dev/null differ diff --git a/src/pages/manage/team/idp-sync/embedded/google-workspace-sync.mdx b/src/pages/manage/team/idp-sync/embedded/google-workspace-sync.mdx index 866085c4..346e0eda 100644 --- a/src/pages/manage/team/idp-sync/embedded/google-workspace-sync.mdx +++ b/src/pages/manage/team/idp-sync/embedded/google-workspace-sync.mdx @@ -28,12 +28,12 @@ Go to the `Integrations` section in the left menu to access the `Identity Provid Select your **Google Workspace** identity provider connector for this integration and click **Continue** to proceed.

- select-identity-provider + The connector picker with the Google Workspace identity provider selected

This will open a pop-up window featuring an intuitive wizard to guide you through the synchronization process between NetBird and Google Workspace. -![NetBird Connect NetBird with Google Workspace](/docs-static/img/manage/team/idp-sync/google-workspace-sync/q1aq98X.png) +![The Google Workspace card on the Identity Provider Sync tab with its Connect button](/docs-static/img/manage/team/idp-sync/google-workspace-sync/q1aq98X.png) ## Prerequisites @@ -57,9 +57,7 @@ To [check your user permissions](https://support.google.com/a/answer/7519580?hl= * Navigate to `Directory` > `Users`. * Select your user account and click on `Admin roles and privileges` to view assigned roles and permissions. -Confirm that you have one of the required roles before proceeding with the integration: - -![Google Workspaces User Permissions](/docs-static/img/manage/team/idp-sync/google-workspace-sync/Ky8bguM.png) +Confirm that you have one of the required roles before proceeding with the integration. If you lack the required permissions, please contact your workspace administrator to request them. @@ -76,20 +74,14 @@ To [check your organization-level permissions](https://cloud.google.com/resource * Look for users with roles like `Organization Administrator`, `Organization Policy Administrator`, or other high-level roles. - Verifying your GCP permissions is mandatory before proceeding with the integration since you might need to disable the `iam.disableServiceAccountKeyCreation` constraint temporarily during the process. +Verifying your GCP permissions is mandatory before proceeding with the integration since you might need to disable the `iam.disableServiceAccountKeyCreation` constraint temporarily during the process. -![Google Workspace IAM & Admin](/docs-static/img/manage/team/idp-sync/google-workspace-sync/9ECRJqC.png) - If you lack the required role, contact your organization's IT department or the person who set up your Google Cloud account. ## Creating the NetBird Project -Once you have the necessary permissions, you can create the NetBird project in GCP. - -![NetBird Create NetBird Project](/docs-static/img/manage/team/idp-sync/google-workspace-sync/GBbcnt3.png) - -Let's go through the required steps: +Once you have the necessary permissions, create the NetBird project in GCP: * Sign in to [Google Console](https://console.cloud.google.com) * Click the project dropdown at the top of the page. @@ -98,97 +90,65 @@ Let's go through the required steps: * Ensure the proper organization is selected in the `Organization` field. * Click `CREATE`. -![Google Workspace New Project](/docs-static/img/manage/team/idp-sync/google-workspace-sync/sGLG0tX.png) - To let `NetBird` authenticate and access Google Workspace, you must enable the `Admin SDK API`. Here's how to do it: * Ensure you're in the correct project. * Navigate to [https://console.cloud.google.com/apis/library/admin.googleapis.com](https://console.cloud.google.com/apis/library/admin.googleapis.com) * Click the `Enable` button. -![Google Workspace Admin SDK API](/docs-static/img/manage/team/idp-sync/google-workspace-sync/ij3niha.png) - ## Creating the NetBird Service Account -Once you create the project, you can set up the `NetBird` service account. On NetBird, click `Continue →`. That will show you a summary of the required steps. - -![NetBird Create Service Account](/docs-static/img/manage/team/idp-sync/google-workspace-sync/tRbBQsR.png) - -Here are the step-by-step instructions: +Once you create the project, you can set up the `NetBird` service account. On NetBird, click `Continue →` to move to the service account step, then follow these instructions: Navigate to [https://console.cloud.google.com/apis/credentials](https://console.cloud.google.com/apis/credentials), click `CREATE CREDENTIALS` at the top menu and select `Service account` from the dropdown list. -![Google Workspace Service Account](/docs-static/img/manage/team/idp-sync/google-workspace-sync/rDU0Puv.png) - Complete the form with the supplied values: * `NetBird` for the service account name * `netbird` for the service account ID Click `DONE` when ready. -![Google Workspace Service Account Details](/docs-static/img/manage/team/idp-sync/google-workspace-sync/WzqMsmW.png) - ## Getting Your Service Account Email -On NetBird, click `Continue →`. You'll need to provide the email of the service account. - -![NetBird Get Service Account Email](/docs-static/img/manage/team/idp-sync/google-workspace-sync/IBEGQD8.png) - -You can copy the email from the `Credentials` page. - -![Google Workspace Service Account Email](/docs-static/img/manage/team/idp-sync/google-workspace-sync/Z4CQd9O.png) +On NetBird, click `Continue →`. You'll need to provide the email of the service account. You can copy it from the `Credentials` page in GCP. ## Creating a New Service Account Key -Back on NetBird, click `Continue →`. You'll see a summary of how to create a service account key. +Back on NetBird, click `Continue →` to move to the service account key step. -![NetBird Create Service Account Key](/docs-static/img/manage/team/idp-sync/google-workspace-sync/MGgCzky.png) - -First, click on the service account email to show its details. - -![Google Workspace Service Account Details](/docs-static/img/manage/team/idp-sync/google-workspace-sync/JWdAg4R.png) - -Next, click the `Keys` tab. Open the `ADD KEY` drop-down menu and select `Create new key` from the list. - -![Google Workspace Create New Key](/docs-static/img/manage/team/idp-sync/google-workspace-sync/gUQ4XAd.png) - -A new pop-up window will open, select `JSON` as indicated below: - -![Google Workspace New Key Format](/docs-static/img/manage/team/idp-sync/google-workspace-sync/WZWFp1Z.png) +In GCP, on the `Credentials` page, click the service account email to open its details. Then click the `Keys` tab, open the `ADD KEY` drop-down menu and select `Create new key`. In the pop-up window, select `JSON` as the key type. The key will automatically download to your local device. The new key will also appear as `active` in the `KEYS` tab. -![Google Workspace Copy New Key](/docs-static/img/manage/team/idp-sync/google-workspace-sync/bSakeRS.png) - During service account key creation, you may encounter the following error: -![Google Workspace Key Creation Error](/docs-static/img/manage/team/idp-sync/google-workspace-sync/mU2qAwe.png) +![The GCP error shown when the organization policy blocks service account key creation](/docs-static/img/manage/team/idp-sync/google-workspace-sync/mU2qAwe.png) -If that's the case, activate Google Cloud Shell on the top menu (shell icon) and enter the following command: +If that's the case, lift the constraint for the NetBird project only. Activate Google Cloud Shell on the top menu (shell icon) and run: ``` -gcloud org-policies delete iam.disableServiceAccountKeyCreation --organization=ORGANIZATION_ID +gcloud resource-manager org-policies disable-enforce iam.disableServiceAccountKeyCreation --project=PROJECT_ID ``` -Remember to replace `ORGANIZATION_ID` with your organization ID. +Replace `PROJECT_ID` with the ID of the project you created for NetBird. The organization-level policy stays in place, so other projects still can't create keys. Then create the key again. Now, you can upload the service account key to NetBird. After a successful upload, you'll see the key listed in the NetBird interface. -![NetBird Paste New Key](/docs-static/img/manage/team/idp-sync/google-workspace-sync/g8omqCt.png) +![The NetBird wizard step for uploading the service account JSON key, with the key listed after upload](/docs-static/img/manage/team/idp-sync/google-workspace-sync/g8omqCt.png) + +If you lifted the constraint, restore it now by removing the project-level override. The key you already created keeps working: + +``` +gcloud resource-manager org-policies delete iam.disableServiceAccountKeyCreation --project=PROJECT_ID +``` + +If your organization needs a lasting exception instead, Google recommends a [tag-based exemption](https://docs.cloud.google.com/iam/docs/keys-create-delete) for the project. ## Creating a New Admin Role in Google Workspace -After creating the service account in GCP and uploading its secret key, return to NetBird and click 'Continue →'. The next steps will guide you through creating a role in Google Workspace for this service account +After creating the service account in GCP and uploading its secret key, return to NetBird and click `Continue →`. The next steps create a role in Google Workspace for this service account. -![NetBird Create Admin Role](/docs-static/img/manage/team/idp-sync/google-workspace-sync/F80lm4H.png) - -Navigate to Google Workspace [Admin Console](https://admin.google.com/ac/home). Select `Account` on the left menu and then click `Admin Roles` - -![Google Workspace Admin Roles](/docs-static/img/manage/team/idp-sync/google-workspace-sync/X1CYEHq.png) - -Click `Create new role` - -![Google Workspace Create New Role](/docs-static/img/manage/team/idp-sync/google-workspace-sync/pmeCOd4.png) +Navigate to the Google Workspace [Admin Console](https://admin.google.com/ac/home). Select `Account` on the left menu, click `Admin Roles`, then click `Create new role`. Fill in the form with the values provided in NetBird: * Name: `User and Group Management ReadOnly` @@ -196,72 +156,54 @@ Fill in the form with the values provided in NetBird: When done, click `CONTINUE` -![Google Workspace Create Role](/docs-static/img/manage/team/idp-sync/google-workspace-sync/HLddKPh.png) - ## Granting Role Privileges Return to NetBird and click `Continue →`. The next screen shows the privileges needed for the Admin API. -![NetBird Add Role Privileges](/docs-static/img/manage/team/idp-sync/google-workspace-sync/IZn8XWY.png) - Back to Google Workspace, enter `admin api` in the search bar and enable the following privileges for the Admin API: * Users: `Read` * Groups: `Read` Then, click `CONTINUE` -![Google Workspace Select Privileges](/docs-static/img/manage/team/idp-sync/google-workspace-sync/nKLJX2H.png) +![The Google Workspace privilege picker with Admin API Users Read and Groups Read checked](/docs-static/img/manage/team/idp-sync/google-workspace-sync/nKLJX2H.png) Review the Admin API privileges to verify they are correct and click `CREATE ROLE` when ready. -![Google Workspace Review Privileges](/docs-static/img/manage/team/idp-sync/google-workspace-sync/METhl2T.png) - ## Assigning Admin API Privileges to Google Cloud Service Account In NetBird, click `Continue →`. For convenience, you can copy the service account Email from this screen and use it to grant it the necessary permissions in Google Workspace. -![NetBird Assign Service Account](/docs-static/img/manage/team/idp-sync/google-workspace-sync/jhgTfsk.png) - Then, in Google Workspace, click on `Assign service accounts` as shown below: -![Google Workspace Assign Service Account](/docs-static/img/manage/team/idp-sync/google-workspace-sync/HHzmRAL.png) +![The Assign service accounts link on the new role's page in Google Workspace](/docs-static/img/manage/team/idp-sync/google-workspace-sync/HHzmRAL.png) Paste the service account Email address and click the `ADD` button. -![Google Workspace Add Service Account](/docs-static/img/manage/team/idp-sync/google-workspace-sync/ZYSw3KZ.png) - Verify the Email and click `ASSIGN ROLE` to grant the role `User and Group Management ReadOnly` to the `NetBird` service account. -![Google Workspace Assign Role](/docs-static/img/manage/team/idp-sync/google-workspace-sync/rPYNLz1.png) - ## Entering Customer ID Go back to NetBird and click `Continue →`. The next screen will prompt you to enter your Google Workspace Customer ID. -![NetBird Enter Customer ID](/docs-static/img/manage/team/idp-sync/google-workspace-sync/q6tuStz.png) - To get your customer ID, navigate to [Account Settings](https://admin.google.com/ac/accountsettings/profile?hl=en_US) and copy the corresponding ID. -![Google Workspace Customer ID](/docs-static/img/manage/team/idp-sync/google-workspace-sync/443kaDt.png) +![The Customer ID field on the Google Workspace Account settings profile page](/docs-static/img/manage/team/idp-sync/google-workspace-sync/443kaDt.png) ## Synchronizing Google Workspace Groups and Users Return to NetBird. The next two screens allow you to select which Google Workspace groups and users you want to synchronize. By default, NetBird synchronizes all groups and users. If you're okay with syncing everything, click `Continue` on both screens. -![NetBird Groups Sync](/docs-static/img/manage/team/idp-sync/google-workspace-sync/gAgKeL0.png) +![The NetBird wizard step for choosing which Google Workspace groups to sync](/docs-static/img/manage/team/idp-sync/google-workspace-sync/gAgKeL0.png) You can also click on `+ Add group (or user group) filter` to change this settings as you see fit. To finish the integration process, click the `Connect` button. -![NetBird Users Sync](/docs-static/img/manage/team/idp-sync/google-workspace-sync/6Huo7vW.png) +The next screen confirms that the integration was successful: -The next screen, should be similar the following one, verifying that the integration was successful: - -![NetBird Google Workspace Enabled](/docs-static/img/manage/team/idp-sync/google-workspace-sync/EkPJqpJ.png) +![The Google Workspace card showing the integration as enabled](/docs-static/img/manage/team/idp-sync/google-workspace-sync/EkPJqpJ.png) To verify the integration is working correctly, you can also navigate to `Team` > `Users`. Here, you should see your synchronized Google Workspace users listed. -![NetBird Users](/docs-static/img/manage/team/idp-sync/google-workspace-sync/5AcaIqW.png) +![The NetBird Users table listing users synced from Google Workspace](/docs-static/img/manage/team/idp-sync/google-workspace-sync/5AcaIqW.png) -The users should be the same listed in Google Workspace Admin console: - -![Google Workspace Users](/docs-static/img/manage/team/idp-sync/google-workspace-sync/BPfboem.png) +The list should match the users in your Google Workspace Admin console. diff --git a/src/pages/manage/team/idp-sync/google-workspace-sync.mdx b/src/pages/manage/team/idp-sync/google-workspace-sync.mdx index d315b1eb..b1b6fb98 100644 --- a/src/pages/manage/team/idp-sync/google-workspace-sync.mdx +++ b/src/pages/manage/team/idp-sync/google-workspace-sync.mdx @@ -24,7 +24,7 @@ import {Note} from "@/components/mdx"; Go to the `Integrations` section in the left menu to access the `Identity Provider integration`. Click the `Google Workspace` button. This will open a pop-up window featuring an intuitive wizard to guide you through the synchronization process between NetBird and Google Workspace. -![NetBird Connect NetBird with Google Workspace](/docs-static/img/manage/team/idp-sync/google-workspace-sync/q1aq98X.png) +![The Google Workspace card on the Identity Provider Sync tab with its Connect button](/docs-static/img/manage/team/idp-sync/google-workspace-sync/q1aq98X.png) ## Prerequisites @@ -48,9 +48,7 @@ To [check your user permissions](https://support.google.com/a/answer/7519580?hl= * Navigate to `Directory` > `Users`. * Select your user account and click on `Admin roles and privileges` to view assigned roles and permissions. -Confirm that you have one of the required roles before proceeding with the integration: - -![Google Workspaces User Permissions](/docs-static/img/manage/team/idp-sync/google-workspace-sync/Ky8bguM.png) +Confirm that you have one of the required roles before proceeding with the integration. If you lack the required permissions, please contact your workspace administrator to request them. @@ -67,20 +65,14 @@ To [check your organization-level permissions](https://cloud.google.com/resource * Look for users with roles like `Organization Administrator`, `Organization Policy Administrator`, or other high-level roles. - Verifying your GCP permissions is mandatory before proceeding with the integration since you might need to disable the `iam.disableServiceAccountKeyCreation` constraint temporarily during the process. +Verifying your GCP permissions is mandatory before proceeding with the integration since you might need to disable the `iam.disableServiceAccountKeyCreation` constraint temporarily during the process. -![Google Workspace IAM & Admin](/docs-static/img/manage/team/idp-sync/google-workspace-sync/9ECRJqC.png) - If you lack the required role, contact your organization's IT department or the person who set up your Google Cloud account. ## Creating the NetBird Project -Once you have the necessary permissions, you can create the NetBird project in GCP. - -![NetBird Create NetBird Project](/docs-static/img/manage/team/idp-sync/google-workspace-sync/GBbcnt3.png) - -Let's go through the required steps: +Once you have the necessary permissions, create the NetBird project in GCP: * Sign in to [Google Console](https://console.cloud.google.com) * Click the project dropdown at the top of the page. @@ -89,97 +81,65 @@ Let's go through the required steps: * Ensure the proper organization is selected in the `Organization` field. * Click `CREATE`. -![Google Workspace New Project](/docs-static/img/manage/team/idp-sync/google-workspace-sync/sGLG0tX.png) - To let `NetBird` authenticate and access Google Workspace, you must enable the `Admin SDK API`. Here’s how to do it: * Ensure you're in the correct project. * Navigate to [https://console.cloud.google.com/apis/library/admin.googleapis.com](https://console.cloud.google.com/apis/library/admin.googleapis.com) * Click the `Enable` button. -![Google Workspace Admin SDK API](/docs-static/img/manage/team/idp-sync/google-workspace-sync/ij3niha.png) - ## Creating the NetBird Service Account -Once you create the project, you can set up the `NetBird` service account. On NetBird, click `Continue →`. That will show you a summary of the required steps. - -![NetBird Create Service Account](/docs-static/img/manage/team/idp-sync/google-workspace-sync/tRbBQsR.png) - -Here are the step-by-step instructions: +Once you create the project, you can set up the `NetBird` service account. On NetBird, click `Continue →` to move to the service account step, then follow these instructions: Navigate to [https://console.cloud.google.com/apis/credentials](https://console.cloud.google.com/apis/credentials), click `CREATE CREDENTIALS` at the top menu and select `Service account` from the dropdown list. -![Google Workspace Service Account](/docs-static/img/manage/team/idp-sync/google-workspace-sync/rDU0Puv.png) - Complete the form with the supplied values: -* `NerBird` for the service account name +* `NetBird` for the service account name * `netbird` for the service account ID Click `DONE` when ready. -![Google Workspace Service Account Details](/docs-static/img/manage/team/idp-sync/google-workspace-sync/WzqMsmW.png) - ## Getting Your Service Account Email -On NetBird, click `Continue →`. You’ll need to provide the email of the service account. - -![NetBird Get Service Account Email](/docs-static/img/manage/team/idp-sync/google-workspace-sync/IBEGQD8.png) - -You can copy the email from the `Credentials` page. - -![Google Workspace Service Account Email](/docs-static/img/manage/team/idp-sync/google-workspace-sync/Z4CQd9O.png) +On NetBird, click `Continue →`. You'll need to provide the email of the service account. You can copy it from the `Credentials` page in GCP. ## Creating a New Service Account Key -Back on NetBird, click `Continue →`. You’ll see a summary of how to create a service account key. +Back on NetBird, click `Continue →` to move to the service account key step. -![NetBird Create Service Account Key](/docs-static/img/manage/team/idp-sync/google-workspace-sync/MGgCzky.png) - -First, click on the service account email to show its details. - -![Google Workspace Service Account Details](/docs-static/img/manage/team/idp-sync/google-workspace-sync/JWdAg4R.png) - -Next, click the `Keys` tab. Open the `ADD KEY` drop-down menu and select `Create new key` from the list. - -![Google Workspace Create New Key](/docs-static/img/manage/team/idp-sync/google-workspace-sync/gUQ4XAd.png) - -A new pop-up window will open, select `JSON` as indicated below: - -![Google Workspace New Key Format](/docs-static/img/manage/team/idp-sync/google-workspace-sync/WZWFp1Z.png) +In GCP, on the `Credentials` page, click the service account email to open its details. Then click the `Keys` tab, open the `ADD KEY` drop-down menu and select `Create new key`. In the pop-up window, select `JSON` as the key type. The key will automatically download to your local device. The new key will also appear as `active` in the `KEYS` tab. -![Google Workspace Copy New Key](/docs-static/img/manage/team/idp-sync/google-workspace-sync/bSakeRS.png) - During service account key creation, you may encounter the following error: -![Google Workspace Key Creation Error](/docs-static/img/manage/team/idp-sync/google-workspace-sync/mU2qAwe.png) +![The GCP error shown when the organization policy blocks service account key creation](/docs-static/img/manage/team/idp-sync/google-workspace-sync/mU2qAwe.png) -If that’s the case, activate Google Cloud Shell on the top menu (shell icon) and enter the following command: +If that's the case, lift the constraint for the NetBird project only. Activate Google Cloud Shell on the top menu (shell icon) and run: ``` -gcloud org-policies delete iam.disableServiceAccountKeyCreation --organization=ORGANIZATION_ID +gcloud resource-manager org-policies disable-enforce iam.disableServiceAccountKeyCreation --project=PROJECT_ID ``` -Remember to replace `ORGANIZATION_ID` with your organization ID. +Replace `PROJECT_ID` with the ID of the project you created for NetBird. The organization-level policy stays in place, so other projects still can't create keys. Then create the key again. Now, you can upload the service account key to NetBird. After a successful upload, you'll see the key listed in the NetBird interface. -![NetBird Paste New Key](/docs-static/img/manage/team/idp-sync/google-workspace-sync/g8omqCt.png) +![The NetBird wizard step for uploading the service account JSON key, with the key listed after upload](/docs-static/img/manage/team/idp-sync/google-workspace-sync/g8omqCt.png) + +If you lifted the constraint, restore it now by removing the project-level override. The key you already created keeps working: + +``` +gcloud resource-manager org-policies delete iam.disableServiceAccountKeyCreation --project=PROJECT_ID +``` + +If your organization needs a lasting exception instead, Google recommends a [tag-based exemption](https://docs.cloud.google.com/iam/docs/keys-create-delete) for the project. ## Creating a New Admin Role in Google Workspace -After creating the service account in GCP and uploading its secret key, return to NetBird and click 'Continue →'. The next steps will guide you through creating a role in Google Workspace for this service account +After creating the service account in GCP and uploading its secret key, return to NetBird and click `Continue →`. The next steps create a role in Google Workspace for this service account. -![NetBird Create Admin Role](/docs-static/img/manage/team/idp-sync/google-workspace-sync/F80lm4H.png) - -Navigate to Google Workspace [Admin Console](https://admin.google.com/ac/home). Select `Account` on the left menu and then click `Admin Roles` - -![Google Workspace Admin Roles](/docs-static/img/manage/team/idp-sync/google-workspace-sync/X1CYEHq.png) - -Click `Create new role` - -![Google Workspace Create New Role](/docs-static/img/manage/team/idp-sync/google-workspace-sync/pmeCOd4.png) +Navigate to the Google Workspace [Admin Console](https://admin.google.com/ac/home). Select `Account` on the left menu, click `Admin Roles`, then click `Create new role`. Fill in the form with the values provided in NetBird: * Name: `User and Group Management ReadOnly` @@ -187,72 +147,54 @@ Fill in the form with the values provided in NetBird: When done, click `CONTINUE` -![Google Workspace Create Role](/docs-static/img/manage/team/idp-sync/google-workspace-sync/HLddKPh.png) - ## Granting Role Privileges Return to NetBird and click `Continue →`. The next screen shows the privileges needed for the Admin API. -![NetBird Add Role Privileges](/docs-static/img/manage/team/idp-sync/google-workspace-sync/IZn8XWY.png) - Back to Google Workspace, enter `admin api` in the search bar and enable the following privileges for the Admin API: * Users: `Read` * Groups: `Read` Then, click `CONTINUE` -![Google Workspace Select Privileges](/docs-static/img/manage/team/idp-sync/google-workspace-sync/nKLJX2H.png) +![The Google Workspace privilege picker with Admin API Users Read and Groups Read checked](/docs-static/img/manage/team/idp-sync/google-workspace-sync/nKLJX2H.png) Review the Admin API privileges to verify they are correct and click `CREATE ROLE` when ready. -![Google Workspace Review Privileges](/docs-static/img/manage/team/idp-sync/google-workspace-sync/METhl2T.png) - ## Assigning Admin API Privileges to Google Cloud Service Account In NetBird, click `Continue →`. For convenience, you can copy the service account Email from this screen and use it to grant it the necessary permissions in Google Workspace. -![NetBird Assign Service Account](/docs-static/img/manage/team/idp-sync/google-workspace-sync/jhgTfsk.png) - Then, in Google Workspace, click on `Assign service accounts` as shown below: -![Google Workspace Assign Service Account](/docs-static/img/manage/team/idp-sync/google-workspace-sync/HHzmRAL.png) +![The Assign service accounts link on the new role's page in Google Workspace](/docs-static/img/manage/team/idp-sync/google-workspace-sync/HHzmRAL.png) Paste the service account Email address and click the `ADD` button. -![Google Workspace Add Service Account](/docs-static/img/manage/team/idp-sync/google-workspace-sync/ZYSw3KZ.png) - Verify the Email and click `ASSIGN ROLE` to grant the role `User and Group Management ReadOnly` to the `NetBird` service account. -![Google Workspace Assign Role](/docs-static/img/manage/team/idp-sync/google-workspace-sync/rPYNLz1.png) - ## Entering Customer ID Go back to NetBird and click `Continue →`. The next screen will prompt you to enter your Google Workspace Customer ID. -![NetBird Enter Customer ID](/docs-static/img/manage/team/idp-sync/google-workspace-sync/q6tuStz.png) - To get your customer ID, navigate to [Account Settings](https://admin.google.com/ac/accountsettings/profile?hl=en_US) and copy the corresponding ID. -![Google Workspace Customer ID](/docs-static/img/manage/team/idp-sync/google-workspace-sync/443kaDt.png) +![The Customer ID field on the Google Workspace Account settings profile page](/docs-static/img/manage/team/idp-sync/google-workspace-sync/443kaDt.png) ## Synchronizing Google Workspace Groups and Users Return to NetBird. The next two screens allow you to select which Google Workspace groups and users you want to synchronize. By default, NetBird synchronizes all groups and users. If you're okay with syncing everything, click `Continue` on both screens. -![NetBird Groups Sync](/docs-static/img/manage/team/idp-sync/google-workspace-sync/gAgKeL0.png) +![The NetBird wizard step for choosing which Google Workspace groups to sync](/docs-static/img/manage/team/idp-sync/google-workspace-sync/gAgKeL0.png) You can also click on `+ Add group (or user group) filter` to change this settings as you see fit. To finish the integration process, click the `Connect` button. -![NetBird Users Sync](/docs-static/img/manage/team/idp-sync/google-workspace-sync/6Huo7vW.png) +The next screen confirms that the integration was successful: -The next screen, should be similar the following one, verifying that the integration was successful: - -![NetBird Google Workspace Enabled](/docs-static/img/manage/team/idp-sync/google-workspace-sync/EkPJqpJ.png) +![The Google Workspace card showing the integration as enabled](/docs-static/img/manage/team/idp-sync/google-workspace-sync/EkPJqpJ.png) To verify the integration is working correctly, you can also navigate to `Team` > `Users`. Here, you should see your synchronized Google Workspace users listed. -![NetBird Users](/docs-static/img/manage/team/idp-sync/google-workspace-sync/5AcaIqW.png) +![The NetBird Users table listing users synced from Google Workspace](/docs-static/img/manage/team/idp-sync/google-workspace-sync/5AcaIqW.png) -The users should be the same listed in Google Workspace Admin console: - -![Google Workspace Users](/docs-static/img/manage/team/idp-sync/google-workspace-sync/BPfboem.png) +The list should match the users in your Google Workspace Admin console.