Google Gsuite Oauth SSO Integration

Note: GSuite users are strongly advised to use SAML authentication instead of OAuth wherever possible.  SAML configurations are faster, simpler, more powerful and less brittle.

Step 1 Enable API access

1. Login to your G Suite admin console at https://admin.google.com as an administrator
2. Familiarize yourself with granting OAuth access to your G Suite implementation. You may find this Google documentation useful: 
   https://support.google.com/a/answer/7281227
3. Ensure that Swank will have read access to the Admin SDK, Directory API, Users endpoint.

Step 2 Create a new role

1. Go to the admin roles: Click on the main menu (image below) > Account> Admin roles
   1. 
2. Click CREATE A NEW ROLE
   1. 
3. Name the new role S3APIand click Continue
   1. 

4. You will see a screen where you can assign privileges. Assign the following privileges by checking the appropriate boxes:
   1. Admin Console Privileges > Organizational Units > Read
   2. Admin Console Privileges > Users > Read
   3. Admin API Privileges > Organizational Units > Read
   4. Admin API Privileges > Users > Read
   5. Admin API Privileges > Groups > Read
   6. Admin API Privileges > Schema Management > Schema Read
   7. Click Continue
   8. Click Create Role
   9. 

Step 3 Create user for G Suite admin account

1. Go to the user list: Click on the main menu (image below) > Directory> Users
   1. 
2. Add a new user named gsuite s3api
   1. Click Add new user
   2. First name: gsuite
   3. Last name: s3api
   4. Primary email: gsuites3api
   5. Click Manage user’s password, organizational unit, and profile photo
   6. 
   7. Click Create password
   8. Create a password of your choice. We will not need this password, only the user's email.
   9. Be sure to deselect Ask for a password change at the next sign-in
   10. Click ADD NEW USER
   11. 

Step 4 Assign the S3API role to the new user

1. Go to the user list: Click on the main menu (image below) > Directory > Users
   1. 
2. Locate user gsuite s3api and click on that username. You will see user information, security, groups, admin roles and privileges, etc. for this user.
3. Locate the Admin roles and privileges section and click ASSIGN ROLES
   1. 
4. Assign the S3API role and click SAVE
   1. 

Step 5 Create a project for Streaming Server integration into Google G Suite

1. Go to https://console.cloud.google.com/cloud-resource-manager
2. Click CREATE PROJECT
   1. 
3. Enter the project name Swank Streaming Server and select your location / organization.
   1. 

Step 6 Enable Admin SDK

1. Go to API Library https://console.cloud.google.com/apis/library
2. Search for Admin SDK
   1. Admin SDK API allows administrators of enterprise domains to view and manage resources like user, groups etc. It also provides audit and usage reports of domain.
   2. 
3. Select Admin SDK API
4. Click Enable
   1. 

Step 7 Create a service account

1. Go to the API & Services Dashboard at https://console.cloud.google.com/apis/
2. Make sure that the Swank Streaming Server project is selected
   1. 
3. Click Credentials on the left navigation menu
   1. 
4. Click Create credentials and select Service account key
   1. 
5. Enter OAuthForStreamingServeras the service account name and click Create and Continue
   1. 
6. Click Select a role > Service Accounts >Service Account User
   1. Note: This step is not optional and is required for our streaming server.
   2. 
7. Click Continue
8. Click Done

Step 8 Update the service account

1. Make sure you are still on https://console.cloud.google.com
2. Click on the Main Navigation Menu > APIs & Services > OAuth consent screen
   1. 
3. For Application name enter Swank Streaming Server
4. User support email should be your local support group
5. Developer contact information should also be your local support group
   1. 
6. Click Save and Continue
7. No changes under Scopes, click Save and Continue
8. No changes under Optional info, click Save and Continue
9. Click Back to Dashboard under Summary
10. Click Credentials on the left navigation menu
11. You will see a screen with sections API Keys, OAuth 2.0 Client IDs and Service Accounts
12. In the Service Accounts section, click on the pencil icon to edit the newly created service account OAuthForStreamingServer
    1. 
13. Under the Keys section click Add Key > Create new key
    1. 
14. Key type should be JSON
15. Click Create and save that "JSON" file. You will need this to import into the Swank admin portal.
    1. This will create a file that you will need later to configure the Streaming Server. Save this file and reserve this for Step 10
16. Under the Details tab select Show Advanced Settings.
17. Click Create Google Workspace Marketplace-Compatible OAuth Client
    1. 
18. Click Credentials on the left navigation menu
19. Under the OAuth 2.0 Client IDs, click the copy icon under the Client ID column. You will need it in the next steps.
    1. 

Step 9 Manage API client access

1. Go to https://admin.google.com/ac/owl/domainwidedelegation
2. Click the "Add new" button that appears at the top of the page
   1. 
3. Enter the Client/Unique ID number that was copied in step 8.17
4. For the OAuth scopes field enter the following URL string exactly - https://www.googleapis.com/auth/admin.directory.user.readonly
5. Click Authorize
   1. 

Step 10 Configure your Digital Campus portal

1. Navigate to your Digital Campus portal administrative page
2. Select the "Google OAuth" area in the left-hand panel
3. Upload Service Account Credentials (JSON file saved in previous step)
   1. From step 8.10.1.
4. Enter the name of your G Suite admin account (including the domain) in the "G Suite Admin Account" field.
   1. This is the name of the account as created in step 3.2.4
   2. Example: [e-mail]
5. Enter a list of any Organizational Units that will require elevated privileges to your portal in the "Manage Authorization Roles" area.
   1. NOTE: You will want to enter the immediate parent OU of the users who will need elevated privileges.
   2. For example, if a teacher resides in an OU hierarchy such as:

      •                        - School Name
                                  - Staff
                                     -Teacher

        You would need to enter the "Teacher" OU, not "Staff" or "School Name."

   3. Each OU that requires elevated privileges will need to be mapped to a role.
   4. Teachers and faculty should be mapped to the Instructor role.
   5. Administrators can optionally be mapped to the Admin role.
   6. K-12 students will be automatically given the Basic role and do not need to be mapped to a role.
   7. College or university students will be automatically given the User role and do not need to be mapped to a role.
   8. For each organizational unit that contains users who need elevated privileges to the Streaming Server:
      1. Enter the name of that organizational unit in the Manage Authorization Roles area on your streaming portal.
         1. 
         2. 

1. 1. To review your current Organizational Unit hierarchy go to: https://admin.google.com 
   2. Click on the left navigation menu > Directory > Organizational Units
   3. 
   4. You will see a hierarchical list of your organizational units.
      1.