Connecting Google Workspace with Miradore

To benefit from using automated workflows, Miradore allows you to integrate with Google Workspace. To connect your Miradore site with your Google Workspace account, you need to create trust between them with OAuth 2.0 or a service account authentication.

1. Navigate to System > Integrations.

   Result: The Integrations page is displayed, where you can get a list of all available applications or filter the list for applications already connected to Miradore.

2. Select Google Workspace.
   The General tab is displayed by default if you have not created the connection.
3. Select Connect.

   Result: The Google Workspace connection page is displayed.

OAuth 2.0

A connection with OAuth 2.0 is formed with an admin user account in Google Workspace. This means that the Miradore site authentication is based on the email of the Google Workspace's admin user.

Note: This connection relies on the account of an individual user. It is recommended to create a company-owned account for this purpose.

1. On the General tab, select OAuth 2.0 from the Authentication type drop-down.
2. Leave the Advanced settings as they are. Certain scopes are added by default.
3. Sign in with the Google Workspace admin account.

Results: The Miradore site is integrated with the admin account.

Service account

This authentication type requires the creation of a service account in the Google Cloud console. Instead of establishing the connection with the individual user's account, the account is created for your Miradore site. This way, multiple users inside the company can manage the connection.

Create and authorize a service account

1. Navigate to console.cloud.google.com/ and make sure you are logged in as a user that has access to the correct organization.
2. Open the Service Accounts page.
   To find the Service Accounts page, you can search for "Service Accounts" on the Google Cloud console.
3. Add a service account for the specific project in the console. Select the correct project from the upper left drop-down menu, or create a new one.
4. Create the service account by selecting + Create service account.
   Follow the instructions from Google if needed. You don't need to give any permissions or access to anything.
5. Select the newly created service account and navigate to the Keys tab.
6. From the Keys tab, select Add key > Create new key, then select a JSON key.
   The file is automatically downloaded after key creation.
7. Check that the Admin SDK API is enabled for the project.
   You can search for "Enabled APIs & services" and select the Admin SDK API to access the needed information.
8. Open admin.google.com/ and sign in with the super admin account to the Google Admin console.
9. In the Google Admin console, search for "API controls" to open the page.
10. Select Manage domain-wide delegation to set the domain-wide delegation for the service account created in Google Cloud.
    Note: For more information about delegating the domain-wide authority, see Google's instructions.
11. Select Add new at the top of the page to add the API client for the created service account.
12. To fill in the needed information for the new API client, open the JSON file that was downloaded when the new key for the service account was created.
13. From the JSON file, copy and paste the value of the client_id parameter to the Client ID field.
14. Copy and paste the following line to the OAuth scopes field:
    https://www.googleapis.com/auth/admin.directory.user,https://www.googleapis.com/auth/admin.directory.orgunit,https://www.googleapis.com/auth/admin.directory.domain,https://www.googleapis.com/auth/admin.directory.group,https://www.googleapis.com/auth/admin.directory.group.member,https://www.googleapis.com/auth/admin.datatransfer,https://www.googleapis.com/auth/admin.directory.device.mobile.action,https://www.googleapis.com/auth/admin.directory.userschema,https://www.googleapis.com/auth/admin.reports.audit.readonly,https://www.googleapis.com/auth/admin.reports.usage.readonly,https://www.googleapis.com/auth/admin.directory.rolemanagement,https://www.googleapis.com/auth/admin.directory.user.security
15. Select Authorize.

Connect Miradore to Google Workspace with the service account

1. Go back to Miradore to create a connection with the created service account.
2. To fill in the needed information for the connection, open the JSON file that was downloaded when the new key for the service account was created.
3. Copy the value of the client_email parameter and paste it into the GCP project service account email field.
4. Copy the value of the private_key parameter and paste it into the Private key field.
5. The User email field must have a real superuser account email matching an existing user in the workspace. The service account will act as this account.
6. Confirm the details by selecting Sign in with Google.

Results: The Miradore site is integrated with the service account.

Note: It can take up to 24 hours until the connection to Google Workspace is established after the configuration.