Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Update G Suite docs to add clarification #4394

Merged
merged 6 commits into from
Sep 30, 2020
Merged

Update G Suite docs to add clarification #4394

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
70e4126
Update ssh-gsuite.md
webvictim Sep 29, 2020
41bd5ca
Update ssh-gsuite.md
webvictim Sep 29, 2020
e767b12
Update ssh-gsuite.md
webvictim Sep 29, 2020
63b1150
Update ssh-gsuite.md
webvictim Sep 29, 2020
e4a34b7
Removing trailing whitespace from 4.2 guide
webvictim Sep 29, 2020
8533f63
Fix whitespace
webvictim Sep 30, 2020
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 8 additions & 2 deletions docs/4.2/enterprise/sso/ssh-gsuite.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -69,12 +69,18 @@ the OIDC Connector, under `google_service_account_uri`.
Teleport requires the service account JSON to be uploaded to all Teleport authentication servers when setting
up in a HA config.

!!! Warning

Do not use the email of the service account. The configuration display will look the same but the service account will not have the domain-wide delegation required. The `client_id` field must be the unique ID number captured from the admin UI. An indicator that this is misconfigured is if you see "Client is unauthorized to retrieve access tokens using this method, or client not authorized for any of the scopes requested." in your log.

!!! Note

The email that you set for `google_admin_email` **must** be the email address of a user that has permission to list all groups, users, and group membership in your G Suite account. This user will generally need super admin privileges.

## API Scopes:
Before setting the Manage API client access capture the client ID of the service account.
Within GSuite to access the Manage API client access go to Security -> Settings. Navigate to Advanced Settings and open Manage API client access. Put the client ID in the Client Name field and the below permissions in the API scopes as a single comma separated line. Press Authorize.

!!! note: Do not use the email of the service account. The configuration display will look the same but the service account will not have the domain-wide delegation required. A indicator of that is if you see `Client is unauthorized to retrieve access tokens using this method, or client not authorized for any of the scopes requested.` in your log.

`https://www.googleapis.com/auth/admin.directory.group.member.readonly, https://www.googleapis.com/auth/admin.directory.group.readonly, https://www.googleapis.com/auth/admin.directory.user.readonly`

![Manage API Client Access](../../img/gsuite/gsuite-6-manage-api-access.png)
Expand Down
5 changes: 4 additions & 1 deletion docs/4.3/enterprise/sso/ssh-gsuite.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -83,8 +83,11 @@ Within GSuite to access the Manage API client access go to Security -> Settings.

!!! Warning

Do not use the email of the service account. The configuration display will look the same but the service account will not have the domain-wide delegation required. A indicator of that is if you see `Client is unauthorized to retrieve access tokens using this method, or client not authorized for any of the scopes requested.` in your log.
Do not use the email of the service account. The configuration display will look the same but the service account will not have the domain-wide delegation required. The `client_id` field must be the unique ID number captured from the admin UI. An indicator that this is misconfigured is if you see "Client is unauthorized to retrieve access tokens using this method, or client not authorized for any of the scopes requested." in your log.

!!! Note

The email that you set for `google_admin_email` **must** be the email address of a user that has permission to list all groups, users, and group membership in your G Suite account. This user will generally need super admin privileges.

**Client Name:** For Client Name: Use the Unique ID for the service account. [See Video for instructions](https://youtu.be/DG97l8WJ6oU?t=281).

Expand Down