|
|
Steps to enable API access in Google Apps
Before you can configure Google Apps with ADSelfService Plus for Password Synchronization, you have to enable Domain Admin API access in Google Apps.
Go to Google Admin console
Logon using your Google Apps Administrator account
Create a new project named ADSelfService Plus
In the left pane, click the Library link. Under the G suite APIs, locate Admin SDK and turn it on.
In the left pane, click the Credentials link
In the right hand side, click the Create Credentials button and select Service Account Key.
Click the drop-box under Service account and select New service account.
Enter a name for the service account and provide the role of Project owner for the service account.
Select the Key type as P12 and click Create. You will now receive a P12 file. Save this file to your computer and click Close.
Click on the Manage service accounts link.
Click on the options against the service account that you created and select Edit.
Mark the checkbox against Enable G Suite Domain-wide Delegation, enter a name in the Product name for the consent screen text box and click Save.
Click on the View Client ID link under the options column and copy the value against the client ID field.
The service account email is the one that is mentioned in the Service account field.
Grant domain-wide authority to this Service Account, using the steps mentioned below.
Delegate domain-wide authority to your service account
The service account that you created needs to be granted access to the Google Apps domain's user data that you want to access. The following tasks have to be performed by an administrator of the Google Apps domain.
Go to your Google Apps domain's Admin console.
Select Security from the list of controls.
Select Advanced settings from the list of options.
Select Manage API client access in the Authentication section.
In the Client name field enter the service account's Client ID that you have copied earlier..
In the One or More API Scopes field, enter the list of scopes that your application should be granted access to. For example, if you need domain-wide access to Users, Groups, and Organizational Units, enter:
https://www.googleapis.com/auth/admin.directory.user,
https://www.googleapis.com/auth/admin.directory.group,
https://www.googleapis.com/auth/admin.directory.orgunit
Click the Authorize button.
Your service account now has domain-wide access to the Google Admin SDK Directory API for all the users of your domain.
Steps to configure Google Apps with ADSelfService Plus
Log in to ADSelfService Plus with administrator credentials.
Go to Configuration --> Self-Service --> Password Synchronizer
Click Google Apps link. In the Google Apps configuration page that opens up, select Password Synchronizer as the Module from the drop-down list.
Enter the domain name (e.g.: adselfserviceplus.com) of your Google Apps domain.
Enter the User Name (e.g.: demo@adselfserviceplus.com) of Google Apps admin account.
Enter the Service Account Email (e.g.: 428499212222-9csoom2llko9292ro21rhm411214lkrh@developer.gserviceaccount.com) which was created in the previous step, from Google Apps.
Select the relevant P12 Key File of Google Apps admin account.
Enter a brief description of the configuration.
Select the Self-Service Policies by clicking the plus icon. Password Synchronization will be possible for only those users who fall under the selected self-service policies.
Click Save.
|
|