# Generating OAuth 2.0 Credentials The following procedures outline how to generate the necessary OAuth 2.0 credentials. > [!NOTE] > > When generating client credentials and service account credentials, use a Google Workspace user who has permission to generate refresh tokens and the required roles or IAM roles to manage Google Workspace and GCP data. Refer to [Prerequisites]() and [Required Roles for Google Workspace and GCP Management](). ## Client Credentials This section describes the procedures for generating the Client ID, Client Secret, and Refresh Token. ### Generating a Client ID and Client Secret 1. Go to **Google Cloud Platform \> APIs & Services \> Credentials**. 2. From the project dropdown list, select an existing project or create a new one. 3. On the **Credentials** page, select **Create Credentials \> OAuth Client ID**. 4. If prompted with a Consent page, select the application type as **Internal**, enter the application name, and save it. 5. Under **Application type**, select **Web application**. 6. Enter an **Application Name**. 7. Under **Authorized redirect URLs**, add the following: ```text https://developers.google.com/oauthplayground ``` 8. Select **Create**. Note the Client ID and Client Secret displayed, as these are required for generating the refresh token. ### Generating a Refresh Token > [!NOTE] > > Before proceeding, ensure you have generated the Client ID and Client Secret. 1. Go to the [OAuth2 Playground](). 2. Select the gear icon in the upper right corner and select the **Use your own OAuth credentials** checkbox (if it is not already selected). 1. Confirm that OAuth Flow is set to Server-side and Access type is set to **Offline**. This ensures that you get a refresh token and an access token. 2. Enter the **OAuth2 client ID** and **OAuth2 client secret** you obtained in the previous step. 3. In **Step 1 - Select & authorize APIs**, enter the required scopes in the text box at the bottom. Use a comma as a separator to add more than one scope. | Scope | Purpose | | --- | --- | | `https://www.googleapis.com/auth/admin.directory.user` | User Provisioning | | `https://www.googleapis.com/auth/apps.groups.settings` | Group Settings API | | `https://www.googleapis.com/auth/admin.directory.rolemanagement` | All role management operations, including creating roles and role assignments | | `https://www.googleapis.com/auth/admin.directory.rolemanagement.readonly` | Getting and listing roles, privileges, and role assignments | | `https://www.googleapis.com/auth/cloud-platform`
`https://www.googleapis.com/auth/iam` | Accessing GCP-related data | | `https://www.googleapis.com/auth/admin.directory.domain` | Managing a domain as an account type in GCP | 3. When prompted, sign in to the account that you want to grant access to and select **Allow**. > **Note** > > If a `redirect_uri_mismatch` error states that your changes might not have propagated, select **Back** and try selecting **Authorize APIs** again. 4. On **Step 2 - Exchange authorization code for tokens**, verify that the **Authorization code** is displayed. 5. Select **Exchange authorization code for tokens**. The **Refresh token** and **Access token** fields are displayed. 6. Copy the **Refresh token** into the configuration file for the client library with the Client ID and Client Secret. ## Service Account > [!NOTE] > > SailPoint's Cloud Infrastructure Entitlement Management (CIEM) only supports Service Account as a grant type. A Service Account belongs to the application. Create a service account for the project in the API Console, delegate domain-wide access to the service account, and add the required scopes in the admin console against the service account Client ID. ### Creating a Service Account and Generating a Private Key 1. Sign in to the Google Cloud Platform Console using a user who has the permissions required to generate the private key and manage Google Workspace and GCP data. 2. Go to [Service Accounts](). 3. Select an existing project or create a new project. 4. Select **Create service account**. 5. Enter a name and description for the service account. For example, enter `Project-Service Account`. 6. Select **Done**. 7. Select the email address of the newly created service account. 8. Go to **Keys**. 9. Select **Add key \> Create new key**. 10. Select **JSON**. 11. Select **Create**. The private key downloads to the computer in JSON format. 12. Select **Close**. ### Adding Scopes to the Service Account 1. Sign in to the [Google Admin Console]() as a Super Admin user. 2. Go to **Menu \> Security \> Access and data control \> API controls**. 3. Select **Manage Domain Wide Delegation**. 4. Select **Add new**. 5. Enter the service account client ID. The client ID, also called the Unique ID, is the `client_id` in the downloaded JSON file, for example, `"client_id":"102996919678308170059"`. You can also find it under **IAM & Admin \> Service accounts \> \[your service account\]**. 6. In **OAuth scopes**, enter the required scopes. Use a comma as a separator to add more than one scope. | Scope | Purpose | | --- | --- | | `https://www.googleapis.com/auth/admin.directory.group` | Group Provisioning | | `https://www.googleapis.com/auth/admin.directory.user` | User Provisioning | | `https://www.googleapis.com/auth/apps.groups.settings` | Group Settings API | | `https://www.googleapis.com/auth/admin.directory.rolemanagement` | All role management operations, including creating roles and role assignments | | `https://www.googleapis.com/auth/admin.directory.rolemanagement.readonly` | Getting and listing roles, privileges, and role assignments | | `https://www.googleapis.com/auth/gmail.settings.sharing` | Gmail API provisioning | | `https://www.googleapis.com/auth/cloud-platform`
`https://www.googleapis.com/auth/iam` | Accessing GCP-related data | | `https://www.googleapis.com/auth/gmail.settings.basic`
`https://mail.google.com/`
`https://www.googleapis.com/auth/gmail.modify`
`https://www.googleapis.com/auth/gmail.readonly` | Gmail API aggregation | | `https://www.googleapis.com/auth/admin.directory.domain` | Managing a domain as an account type in GCP | 7. Select **Authorize**. > **Note** > > If an error displays, the client ID might not be registered with Google or the scopes might contain duplicates or unsupported values. 8. Select the new **Client ID**. 9. Select **View details** and verify that each scope is listed. 10. If a scope is missing, select **Edit**, enter the missing scope, and select **Authorize**. You can't edit the client ID. The application should be available within minutes, but availability can take up to 24 hours. ### Assigning Scopes to the Service Account [![Service Account Scopes]()]() 1. Go to [Google Admin](). 2. Go to **Security \> Access and Data Control \> API controls**. 3. Select **Manage Domain Wide Delegation**. 4. Select the service account and assign the applicable scopes documented in this guide. ### Converting a Service Account Private Key to RSA Format 1. Open the downloaded JSON file. 2. Copy the private key value into a new file. For example: ```text -----BEGIN PRIVATE KEY-----\nMIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQDVAm/9T1/yBO2Z\nCCUn9xJbaoFloMUQcQyc7Xd2snXeKSWXGNMmHFPOMTXT4KNCMsxfGPXeHixYcgpu\nPGok/bqJjY9rWncYh8/UUy3gox4fr+J21rj4qCZ5gvOItF7oVKfjk/E4SQrSRvAp\nAc08W3u8vjNAmFoTBeUyEoKuHqCp48N5Gg3pM6htLXMrf2+q+wcv8IwtWAhopoG3\n8XpjAh4+/bff/gkfFoDdIFYwo3IJ5qlU9xawmbZzy3R+8eZTM2WFAkG75lWfX7id\nj87J32EiSe9etCyER9EtaKbxIKC/bww/JKcz3nIWweyXOAX4/tMDs8ThcsztBTa/\npseo4PI1AgMBAAECggEAEsdo+55OkV3lW4c4DV6vH9+TIlRK41DwIXqe/Fgt44Th\no0FFRjgbnFNC0Vfd1MV5No4TCP7EfpSpPkA1xGaZFizkfrymQMOiay/dHM+MpZMC\nRmNWQdfDMpW8pinurxFdjsb5bnKkEVc/L4JQ53gSP9jN2G1GDaTIqMIwgqzBEdER\nHpgrRv1l+MUrJRpyMyh5ZYApihEmFX4XDR2IYa3ZSMkBT4L6MdIcPURBrvVYdV+I\nXGvGWDhPvz/KcjfY7JD8JqVLqSIwgU851gewJJXKpekUS47aYo9Re91+0DB91ZnU\nWhmDmgorVCz90PM7WpKcW/0XkI45yPLWP3elBwsFKQKBgQD7XqKKGf0PChMNlWYV\n1SKEwiFzLipAHzEOJvhXD6v6vskbwqr/xS5j5SvWqpydow9pd2ExCcxmNtlwmpPX\nDXyRu8dmnaXUYCeYBFWheQ+NzlKd2N6wqE5aXrHdwW9xZRcHbyY+dKOv+gFAOQX+\nkakI4bvOcOernhnI6Fnhd94mCQKBgQDY7ukU6/6bVEahhdssakT+trcMOdhiHiPe\nGHaKYy1r3FpmdPmMLeJlECAOFfWqAB0DUiR9hGPXBSB2oIIICCQraQSFV1lu2R+k\nCaV7rFUrvx1b1yeOQDv34/MR6NdjbsjfhPmxSahWaBsvAyx88GRhh0ULgzesEqqk\nZ19PMV/VzQKBgQDrjkU2sR/pRgGQyx28+9u7GMiLzQkeyZwIrRAvVapN8Rc4gnYH\n9NmCFzG7mmnldvZsWMilUY9PgbrFwLUl46eGUbeMO9M4b1rrI7Sy+mVO97eH38Df\nPvkdyntXWXt7gcXQ26G1CUyTDe66JjWt1wXWIuMBk+AlfKShFsuTc+ajMQKBgFNB\nXbLp3409it3ywWsKXfBjr1zB1onRh3J1cQkrhwMeTpOD0UI7WefviF3fj6ju4jOk\nEt0ZMjgTf6IHd+AdP8RpSZLjMy+XpM0P5rLQMN/ZOStGJ6gwftNkaKU293Lx0aX3\nIt0np7OBwO0KCsjoeZ30jEse0P75KwRtp+Z8zIsBAoGAN47TexfJtaEK+ZQBoIn0\nh0mqV1si1QkPfMHSDvriKQ5d5tG8kF0vPVKAQV5kgytBeI+3bEO1iZC8i2FJzL7x\neN8ifRCcNXDRXjRdR0oPVIHImQ0XXwTB6JQmzVIFLWgxddDhZKpCQlA8GSRsbqEe\njtbTjDN0f5sX9llpKxd9xXw=\n-----END PRIVATE KEY-----\n ``` 3. Replace each literal `\n` with a line break. In private key syntax, `\n` denotes a new line. You can make this change in most text editors. For example, in Notepad++, replace each `\\n` with `\n`. The following is an example of the converted key: ```text -----BEGIN PRIVATE KEY----- MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQDVAm/9T1/yBO2ZCCUn9xJbaoFloMUQcQyc7Xd2snXeKSWXGNMmHFPOMTXT4KNCMsxfGPXeHixYcgpuPGok/bqJjY9rWncYh8/UUy3gox4fr+J21rj4qCZ5gvOItF7oVKfjk/E4SQrSRvApAc08W3u8vjNAmFoTBeUyEoKuHqCp48N5Gg3pM6htLXMrf2+q+wcv8IwtWAhopoG38XpjAh4+/bff/gkfFoDdIFYwo3IJ5qlU9xawmbZzy3R+8eZTM2WFAkG75lWfX7idj87J32EiSe9etCyER9EtaKbxIKC/bww/JKcz3nIWweyXOAX4/tMDs8ThcsztBTa/pseo4PI1AgMBAAECggEAEsdo+55OkV3lW4c4DV6vH9+TIlRK41DwIXqe/Fgt44Tho0FFRjgbnFNC0Vfd1MV5No4TCP7EfpSpPkA1xGaZFizkfrymQMOiay/dHM+MpZMCRmNWQdfDMpW8pinurxFdjsb5bnKkEVc/L4JQ53gSP9jN2G1GDaTIqMIwgqzBEdERHpgrRv1l+MUrJRpyMyh5ZYApihEmFX4XDR2IYa3ZSMkBT4L6MdIcPURBrvVYdV+IXGvGWDhPvz/KcjfY7JD8JqVLqSIwgU851gewJJXKpekUS47aYo9Re91+0DB91ZnUWhmDmgorVCz90PM7WpKcW/0XkI45yPLWP3elBwsFKQKBgQD7XqKKGf0PChMNlWYV1SKEwiFzLipAHzEOJvhXD6v6vskbwqr/xS5j5SvWqpydow9pd2ExCcxmNtlwmpPXDXyRu8dmnaXUYCeYBFWheQ+NzlKd2N6wqE5aXrHdwW9xZRcHbyY+dKOv+gFAOQX+kakI4bvOcOernhnI6Fnhd94mCQKBgQDY7ukU6/6bVEahhdssakT+trcMOdhiHiPeGHaKYy1r3FpmdPmMLeJlECAOFfWqAB0DUiR9hGPXBSB2oIIICCQraQSFV1lu2R+kCaV7rFUrvx1b1yeOQDv34/MR6NdjbsjfhPmxSahWaBsvAyx88GRhh0ULgzesEqqkZ19PMV/VzQKBgQDrjkU2sR/pRgGQyx28+9u7GMiLzQkeyZwIrRAvVapN8Rc4gnYH9NmCFzG7mmnldvZsWMilUY9PgbrFwLUl46eGUbeMO9M4b1rrI7Sy+mVO97eH38DfPvkdyntXWXt7gcXQ26G1CUyTDe66JjWt1wXWIuMBk+AlfKShFsuTc+ajMQKBgFNB XbLp3409it3ywWsKXfBjr1zB1onRh3J1cQkrhwMeTpOD0UI7WefviF3fj6ju4jOkEt0ZMjgTf6IHd+AdP8RpSZLjMy+XpM0P5rLQMN/ZOStGJ6gwftNkaKU293Lx0aX3It0np7OBwO0KCsjoeZ30jEse0P75KwRtp+Z8zIsBAoGAN47TexfJtaEK+ZQBoIn0h0mqV1si1QkPfMHSDvriKQ5d5tG8kF0vPVKAQV5kgytBeI+3bEO1iZC8i2FJzL7xeN8ifRCcNXDRXjRdR0oPVIHImQ0XXwTB6JQmzVIFLWgxddDhZKpCQlA8GSRsbqEejtbTjDN0f5sX9llpKxd9xXw= -----END PRIVATE KEY----- ``` 4. Save the converted private key in a new file. 5. Download and extract the latest version of OpenSSL. 6. From the OpenSSL `bin` folder, run one of the following commands: ```text openssl rsa -aes-256-cbc -in "" -out "" -traditional ``` For example: ```text $ openssl rsa -aes-256-cbc -in ConvertedGSuitePK.txt -out rsa.pem -traditional ``` Or: ```text openssl rsa -aes-128-cbc -in "" -out "" -traditional ``` For example: ```text $ openssl rsa -aes-128-cbc -in ConvertedGSuitePK.txt -out rsa.pem -traditional ``` 7. Enter the PEM passphrase. 8. Confirm the passphrase. > [!NOTE] > > Use the generated RSA-format private key and the passphrase as the private key and private key password in the connector configuration.