why-phy

As I begin my journey into learning more about Cloud RADIUS/Authentication/PKI, I’m finding that configuring the integrations between various cloud services is:

The particular issue I encountered today was adding Google Workspace as an IDP in AGNI so that AGNI can do directory lookups against your users in Google Workspace.

While the AGNI documentation I’ve used has been pretty decent overall, in this instance it was lacking. So I figured I’d make my own documentation (because I will definitely forget the steps!) and share it with the world. Hopefully it saves someone else some time!

Prerequisites

• Google Workspace Admin Access
• AGNI Admin Access
• Google Cloud Access

Google Workspace API

Login to your Google Admin (admin.google.com) with the appropriate credentials

Login to console.cloud.google.com

• Open APIs and Services and select Enabled APIs & Services

• Create a new project

• Give it a name and select the Organization and Location (my lab is all under the same level) – YMMV if you are doing this in a Production Environment

• Enable the Admin SDK API by clicking Enable APIs and services then search for Admin SDK API. Select it and Enable.

Next we are going to create a set of Service Account and Key that will eventually be used to query our Google Workspace Directory

• Click Credentials, Create credentials, and select Service Account

• Add a Service Account name and description (Account ID will auto generate) and then Create and Continue

• Click Continue on the 2nd step (do not assign any roles) and then Done on the last step (do not assign user access)

• With the service account created, we can now add an API key
• To do so, click your newly created Service Account

• Next click Keys, Add Key, and Create New Key

• Select JSON and Click Create

• This will create the JSON file and prompt you to download that file to your computer

Congrats you have completed Part 1!

---

GOOGLE ADMIN CONSOLE CONFIGURATION

Now that we have a service account and a key, we need to allow that account to have the appropriate access to our Google Workspace Directory. For this part you will need to open the JSON file you downloaded and grab the Client ID from the file

• Open the Google Admin console and select Security -> Access and Data Control – > API Controls and then select Manage Domain Wide Delegation

• Click Add New, enter your Client ID (from the JSON file), and copy/paste these lines below (can do all one chunk) into the OAuth Scopes, and click Authorize

This was the part I had to find the hard way – I couldn’t find any documentation from Arista on what permissions I needed. I ended up finding them in Reporting-> Audit and investigation -> OAuth log events. In there it showed my failed access attempts (after doing the AGNI configuration below) and thankfully it listed exactly what resources I was being denied.

Onto Part 3!

---

AGNI IDP CONFIGURATION

Before you begin this part, you will need a piece of information from the Google Admin Console: your Customer ID

• To get the Customer ID – go to Account -> Account Settings -> and note the Customer ID

Next login to AGNI where will configure Google Workspace as an IDP

• Click Identity Provider and then Add in the upper right hand corner

• Fill out the follow fields
  • Name
  • Domain Name – must match your Workspace domain
  • Identity Provider – Google Workspace
• Enable Identity Information Synchronization and fill out the following fields
  • Customer ID (What you grabbed from your Google Admin Console at the beginning of this section)
  • Account Email
    • Note – I’m unsure exactly what email has to be used here. In my lab I just used my normal admin account (same account used to create the API credentials). In a production environment you would likely want to use a service account or generic account email instead of an individual. This account most likely would need admin credentials of some sort. If you figure out an answer – drop me a reply!
  • In the Upload Service Account Credentials – click Update Service Account and add your JSON file that you downloaded back in Part 1
  • Sync Interval (Optional)
    • Set this to whatever you like – default is 24 hours which may or may not be suitable for your environment. You can always manually sync at any time.

THE MOMENT OF TRUTH…

• Click Verify and hopefully you will see something like this

If you get this: congrats you successfully added Google Workspace as an IDP

If you get a failure message – I’d encourage you to first look at the Google Admin Console logs I mentioned above: Reporting-> Audit and investigation -> OAuth log

Hopefully at least one other person finds this helpful and that it saves them the time I lost figuring out a lot of this the hard way!

Cheers!