BlogOpen a Ticket

Google SSO Integration

Suggest Edits

In order to provide seamless and secure access to Kondukto, an option for sign-in using Google Single Sign-On (SSO) has been implemented. This functionality allows users to gain access to our platform utilizing their existing Google credentials, eliminating the need to remember another username and password. This guide is specifically designed to elucidate the procedure of utilizing Google SSO to log in to our platform. All the required steps and guidelines are meticulously detailed to aid you in this process.

The configuration consists of 6 steps:

  1. Creating a Google Cloud Project
  2. Enabling the Admin SDK
  3. Configuring OAuth
  4. Creating a Service Account
  5. Setting Permissions.
  6. Kondukto Integration

1. Creating a project on Google Cloud

  1. Sign in to Google Cloud Console.

  2. Click on the Project Selector button in the top left corner.

  3. On the page that opens up, click on the New Project button.

  4. Enter a name in the Project name field.

  5. Select a valid organization in the Organization field or accept the default
    value.

  6. Click on the Create button.

2. Enabling the Admin SDK

  1. In the left menu, click on APIs & Services ➡️ Library.

  2. On the Library page, type Admin SDK in the search box to find the Admin SDK API and press Enter↵.

  1. Click on Admin SDK API and activate it by clicking the Enable button on the page that appears.
  2. The enabling process may take a few minutes.

3. Configuring the OAuth.

  1. In the left menu, click on APIs & Services ➡️ OAuth consent screen.

  2. Select the Internal.

  3. Click the Create button.

  1. In the Application name field, enter a name that will be displayed to users.
  2. Fill User support email and Developer contact information fields.
  3. Click the Save And Continue button.
  4. Proceed without selecting anything in the Scope section.
  5. Settings determine the design of the pairing screen during the Google connection.
  1. In the left menu, click on APIs & Services ➡️ Credentials.
  2. On the Credentials page, click on the Create credentials button and select OAuth client ID.

  1. In the Application type dialog box, select Web application.

  2. In the Application name field, enter a name that will be displayed to users.

  3. In the Authorized redirect URIs field, enter the URIs to which the user will be redirected after granting or denying consent. Necessary UI can be achieved by adding "~/login/googlesso" to the end of your kondukto host.

  4. In the Authorized JavaScript origins field, enter the origins of your application.

  5. Click the Create button.

  6. Download Json File.

3. Creating a Service Account

  1. In the left menu, click on IAM & Admin ➡️ Service Accounts.

  2. On the Service Accounts page, click on the Create Service Account button.

  3. In the Service account name field, enter a name for the service account.

  4. The Service account ID will be automatically generated.

  5. Optionally, you can enter a description for the service account in the Service account description field.

  6. Click the Continue button.

  7. Click the Create button.

5. Setting Permissions

  1. In the left menu, click on APIs & Services ➡️ Credentials.

  2. Click on the name of your service account.

  3. Click Keys tab.

  4. Click on the Add Key button and select JSON.

  5. Download and save the generated JSON file.

  6. Go to Google Workspace Admin console.

  7. In the Google Workspace admin console, click on Security ➡️ API Controls.

  8. In the Domain wide delegation section, click on the Manage Domain Wide Delegation button.

  9. Click on the Add new button and enter the following information:

    1. "Client ID": Enter the "client_id" value from the JSON file.
    2. "One or More API Scopes": Enter the following scopes:
      1. https://www.googleapis.com/auth/admin.directory.group.readonly
      2. https://www.googleapis.com/auth/admin.directory.user.readonly
      3. Click the "Authorize" button.

  1. After these operations, we will have two Json files. The required fields for OAuth configuration are: client_id, client_secret.
  2. The required fields for Service user configuration are: private_key_id, private_key, client_id.

6. Kondukto Integration

  1. In the left menu, click on APIs & Services ➡️ Credentials.
  2. Under the OAuth 2.0 Client IDs tab, enter the Web Application created for Kondukto.
  3. Client ID and Client Secret can be obtained from this page.
  4. Private Key ID and Private Key variables can be obtained from the Json file created and downloaded in Step 5. The e-mail data can be obtained from the client_email variable in this file.
  5. Enter the administrator's e-mail address in the Impersonate User Email variable.
  6. Create 5 groups for Kondukto by going to Users & Teams from the left menu in Google Workspace.
  7. These groups can be as follows for best practices.
    • KonduktoAdmin
    • KonduktoManager
    • KonduktoTeamLead
    • KonduktoDeveloper
    • KonduktoPentester
  8. Enter the created group names in the Integration section in Kondukto.

Updated 6 months ago