Google Workspace Directory

This article will help you get started using Directory Connector to sync users and groups from your Google Workspace (formerly "G Suite") Directory to your Bitwarden organization.

To setup directory sync with Google Workspace (formerly "G Suite"), you will need access to the Google Workspace Admin Console and Google Cloud Platform Console. Directory Connector will require information obtained from these processes to function properly.

Complete the following steps to create a Google Cloud project to use to connect Directory Connector to your directory. If you already have a Google Cloud project available, skip to Enable Admin SDK:

1. In the GCP Console, use the left-hand navigation to select IAM & Admin → Manage Resources.

2. Select the Create Project button.

3. On the New Project screen:

   • Enter a Bitwarden-specific name for the project (for example, bitwarden-dc-project).

   • Choose an organization to attach it to the project.

   • Choose the parent organization or folder.

   • Select Create.

Complete the following steps to enable the Admin SDK API, to which Directory Connector will make requests:

1. In the GCP Console, open the created or pre-existing project.

2. From the left-hand navigation, select APIs & Services → Library.

3. In the search box, enter Admin SDK and open the Admin SDK API service.

4. Select the Enable button.

Complete the following steps to create a service account to use when making API calls:

1. In the GCP Console, select the created or pre-existing project.

2. From the left-hand navigation, select APIs & Services → Credentials.

3. Select the Create Credentials button, and select Service account from the dropdown.

4. Fill in the Service account details section, and select the Create and continue button.

5. In the Grant this service account access to project section, select Project → Owner from the Role dropdown and select the Continue button.

6. Select the Done button.

Complete the following steps to obtain the appropriate permissions for the created service account:

1. In the GCP Console, open the created or pre-existing project.

2. From the left-hand navigation, select IAM & Admin → Service Accounts.

3. Select the created or pre-existing service account.

4. From the Keys tab, select the Add Key button and select Create new key from the dropdown.

5. Select the Key type JSON and select the Create button to download a JSON-formatted key to your local machine.

6. Back on the Details tab of the service account, select the Advanced settings drop-down.

7. Scroll to the Google Workspace Marketplace OAuth Client section and select Create Google Workspace Marketplace-Compatible OAuth Client, or, if you see box that reads "An OAuth consent screen must be configured in order to create an OAuth client.", select Configure.

8. Select Get Started and in the project configuration:

   • Enter the name of the app asking for consent (e.g. Bitwarden Directory Connector).

   • Choose a user support email.

   • In the Audience section, choose Internal.

   • Continue through the wizard to create the consent screen.

9. Once created, open the Data Access tab and select Add or remove scopes.

10. In the Manually add scopes section, paste the following:

    Plain TextCopia
    https://www.googleapis.com/auth/admin.directory.user.readonly,https://www.googleapis.com/auth/admin.directory.group.readonly,https://www.googleapis.com/auth/admin.directory.group.member.readonly

    Select Add to table and then Update.

11. Click Save.

Using service account credentials with the CLI

If you're going to use the Directory Connector CLI, the JSON-formatted key you've downloaded will be used for the command bwdc config gsuite.key, however intermediary steps are required to allow the CLI to use the private key found in the key file:

• On Linux, run the command bwdc config gsuite.key "\n$(cat projectid-key.json | jq -r '.private_key')", being sure to replace projectid-key.json with the name of your .json file, which is typically a combination of the Project ID and Key.

• On other OSs:

  1. Copy the value of private_key into a separate .crt file, for example named google-bwdc-key.crt.

  2. Run the command bwdc config gsuite.key "\n$(cat google-bwdc-key.crt)\n", being sure to replace the .crt file name with the one you've created.

Complete the following steps to authorize the client to read your directory:

1. Open the Google Admin Console.

2. From the left-hand navigation, select Security → Access and data control → API controls.

3. Select the Manage Domain Wide Delegation button.

4. Select the Add new button.

5. In the Client ID field, paste the created Unique ID you can find by opening the GCP Console, navigating to API & Services → Credentials, opening your service account and looking for the Unique ID.

6. In the OAuth scopes field, paste the following value to grant only read-access:

   BashCopia
   https://www.googleapis.com/auth/admin.directory.user.readonly,https://www.googleapis.com/auth/admin.directory.group.readonly,https://www.googleapis.com/auth/admin.directory.group.member.readonly

7. Select the Authorize button.

Complete the following steps to configure Directory Connector to use your Google directory:

1. Open the Directory Connector desktop app.

2. Navigate to the Settings tab.

3. From the Type dropdown, select G Suite (Google).

   The available fields in this section will change according to your selected type.

4. Enter the Domain of your Google account.

5. Enter the email address of an Admin User with full access to your Google directory.

6. If you have one, enter the Customer ID of your directory. Many users will not have or be required to enter a Customer ID.