Skip to content

Generating OAuth 2.0 Credentials

The following procedures outline how to generate the necessary OAuth 2.0 credentials.

Note

When generating client credentials and service account credentials, use a Google Workspace user who has permission to generate refresh tokens and the required roles or IAM roles to manage Google Workspace and GCP data. Refer to Prerequisites and Required Roles for Google Workspace and GCP Management.

Client Credentials

This section describes the procedures for generating the Client ID, Client Secret, and Refresh Token.

Generating a Client ID and Client Secret

  1. Go to Google Cloud Platform > APIs & Services > Credentials.
  2. From the project dropdown list, select an existing project or create a new one.
  3. On the Credentials page, select Create Credentials > OAuth Client ID.
  4. If prompted with a Consent page, select the application type as Internal, enter the application name, and save it.
  5. Under Application type, select Web application.
  6. Enter an Application Name.

  7. Under Authorized redirect URLs, add the following:

    https://developers.google.com/oauthplayground

  8. Select Create.

    Note the Client ID and Client Secret displayed, as these are required for generating the refresh token.

Generating a Refresh Token

Note

Before proceeding, ensure you have generated the Client ID and Client Secret.

  1. Go to the OAuth2 Playground.

  2. Select the gear icon in the upper right corner and select the Use your own OAuth credentials checkbox (if it is not already selected).

    1. Confirm that OAuth Flow is set to Server-side and Access type is set to Offline. This ensures that you get a refresh token and an access token.
    2. Enter the OAuth2 client ID and OAuth2 client secret you obtained in the previous step.
    3. In Step 1 - Select & authorize APIs, enter the required scopes in the text box at the bottom. Use a comma as a separator to add more than one scope.
    Scope Purpose
    https://www.googleapis.com/auth/admin.directory.user User Provisioning
    https://www.googleapis.com/auth/apps.groups.settings Group Settings API
    https://www.googleapis.com/auth/admin.directory.rolemanagement All role management operations, including creating roles and role assignments
    https://www.googleapis.com/auth/admin.directory.rolemanagement.readonly Getting and listing roles, privileges, and role assignments
    https://www.googleapis.com/auth/cloud-platform
    https://www.googleapis.com/auth/iam    		 Accessing GCP-related data
    https://www.googleapis.com/auth/admin.directory.domain Managing a domain as an account type in GCP
    https://www.googleapis.com/auth/admin.datatransfer Data transfer before account deletion
    https://www.googleapis.com/auth/admin.directory.group Group Provisioning
    https://www.googleapis.com/auth/admin.reports.audit.readonly Account and Group Delta Aggregation

  3. When prompted, sign in to the account that you want to grant access to and select Allow.

    Note

    If a redirect_uri_mismatch error states that your changes might not have propagated, select Back and try selecting Authorize APIs again.

  4. On Step 2 - Exchange authorization code for tokens, verify that the Authorization code is displayed.

  5. Select Exchange authorization code for tokens.

    The Refresh token and Access token fields are displayed.

  6. Copy the Refresh token into the configuration file for the client library with the Client ID and Client Secret.

Service Account

Note

SailPoint's Cloud Infrastructure Entitlement Management (CIEM) only supports Service Account as a grant type.

A Service Account belongs to the application. Create a service account for the project in the API Console, delegate domain-wide access to the service account, and add the required scopes in the admin console against the service account Client ID.

Creating a Service Account and Generating a Private Key

  1. Sign in to the Google Cloud Platform Console using a user who has the permissions required to generate the private key and manage Google Workspace and GCP data.
  2. Go to Service Accounts.
  3. Select an existing project or create a new project.
  4. Select Create service account.
  5. Enter a name and description for the service account. For example, enter Project-Service Account.
  6. Select Done.
  7. Select the email address of the newly created service account.
  8. Go to Keys.
  9. Select Add key > Create new key.
  10. Select JSON.
  11. Select Create. The private key downloads to the computer in JSON format.
  12. Select Close.

Adding Scopes to the Service Account

  1. Sign in to the Google Admin Console as a Super Admin user.
  2. Go to Menu > Security > Access and data control > API controls.
  3. Select Manage Domain Wide Delegation.
  4. Select Add new.
  5. Enter the service account client ID. The client ID, also called the Unique ID, is the client_id in the downloaded JSON file, for example, "client_id":"102996919678308170059". You can also find it under IAM & Admin > Service accounts > [your service account].

  6. In OAuth scopes, enter the required scopes. Use a comma as a separator to add more than one scope.

    Scope Purpose
    https://www.googleapis.com/auth/admin.directory.group Group Provisioning
    https://www.googleapis.com/auth/admin.directory.user User Provisioning
    https://www.googleapis.com/auth/apps.groups.settings Group Settings API
    https://www.googleapis.com/auth/admin.directory.rolemanagement All role management operations, including creating roles and role assignments
    https://www.googleapis.com/auth/admin.directory.rolemanagement.readonly Getting and listing roles, privileges, and role assignments
    https://www.googleapis.com/auth/gmail.settings.sharing Gmail API provisioning
    https://www.googleapis.com/auth/cloud-platform
    https://www.googleapis.com/auth/iam    		 Accessing GCP-related data
    https://www.googleapis.com/auth/gmail.settings.basic
    https://mail.google.com/
    https://www.googleapis.com/auth/gmail.modify
    https://www.googleapis.com/auth/gmail.readonly    		 Gmail API aggregation
    https://www.googleapis.com/auth/admin.directory.domain Managing a domain as an account type in GCP
    https://www.googleapis.com/auth/admin.datatransfer Data transfer before account deletion
    https://www.googleapis.com/auth/admin.reports.audit.readonly Account and Group Delta Aggregation

  7. Select Authorize.

    Note

    If an error displays, the client ID might not be registered with Google or the scopes might contain duplicates or unsupported values.

  8. Select the new Client ID.

  9. Select View details and verify that each scope is listed.
  10. If a scope is missing, select Edit, enter the missing scope, and select Authorize. You can't edit the client ID.

The application should be available within minutes, but availability can take up to 24 hours.

Assigning Scopes to the Service Account

Service Account Scopes

  1. Go to Google Admin.
  2. Go to Security > Access and Data Control > API controls.
  3. Select Manage Domain Wide Delegation.
  4. Select the service account and assign the applicable scopes documented in this guide.

Converting a Service Account Private Key to RSA Format

  1. Open the downloaded JSON file.

  2. Copy the private key value into a new file.

    For example:

    -----BEGIN PRIVATE KEY-----\nMIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQDVAm/9T1/yBO2Z\nCCUn9xJbaoFloMUQcQyc7Xd2snXeKSWXGNMmHFPOMTXT4KNCMsxfGPXeHixYcgpu\nPGok/bqJjY9rWncYh8/UUy3gox4fr+J21rj4qCZ5gvOItF7oVKfjk/E4SQrSRvAp\nAc08W3u8vjNAmFoTBeUyEoKuHqCp48N5Gg3pM6htLXMrf2+q+wcv8IwtWAhopoG3\n8XpjAh4+/bff/gkfFoDdIFYwo3IJ5qlU9xawmbZzy3R+8eZTM2WFAkG75lWfX7id\nj87J32EiSe9etCyER9EtaKbxIKC/bww/JKcz3nIWweyXOAX4/tMDs8ThcsztBTa/\npseo4PI1AgMBAAECggEAEsdo+55OkV3lW4c4DV6vH9+TIlRK41DwIXqe/Fgt44Th\no0FFRjgbnFNC0Vfd1MV5No4TCP7EfpSpPkA1xGaZFizkfrymQMOiay/dHM+MpZMC\nRmNWQdfDMpW8pinurxFdjsb5bnKkEVc/L4JQ53gSP9jN2G1GDaTIqMIwgqzBEdER\nHpgrRv1l+MUrJRpyMyh5ZYApihEmFX4XDR2IYa3ZSMkBT4L6MdIcPURBrvVYdV+I\nXGvGWDhPvz/KcjfY7JD8JqVLqSIwgU851gewJJXKpekUS47aYo9Re91+0DB91ZnU\nWhmDmgorVCz90PM7WpKcW/0XkI45yPLWP3elBwsFKQKBgQD7XqKKGf0PChMNlWYV\n1SKEwiFzLipAHzEOJvhXD6v6vskbwqr/xS5j5SvWqpydow9pd2ExCcxmNtlwmpPX\nDXyRu8dmnaXUYCeYBFWheQ+NzlKd2N6wqE5aXrHdwW9xZRcHbyY+dKOv+gFAOQX+\nkakI4bvOcOernhnI6Fnhd94mCQKBgQDY7ukU6/6bVEahhdssakT+trcMOdhiHiPe\nGHaKYy1r3FpmdPmMLeJlECAOFfWqAB0DUiR9hGPXBSB2oIIICCQraQSFV1lu2R+k\nCaV7rFUrvx1b1yeOQDv34/MR6NdjbsjfhPmxSahWaBsvAyx88GRhh0ULgzesEqqk\nZ19PMV/VzQKBgQDrjkU2sR/pRgGQyx28+9u7GMiLzQkeyZwIrRAvVapN8Rc4gnYH\n9NmCFzG7mmnldvZsWMilUY9PgbrFwLUl46eGUbeMO9M4b1rrI7Sy+mVO97eH38Df\nPvkdyntXWXt7gcXQ26G1CUyTDe66JjWt1wXWIuMBk+AlfKShFsuTc+ajMQKBgFNB\nXbLp3409it3ywWsKXfBjr1zB1onRh3J1cQkrhwMeTpOD0UI7WefviF3fj6ju4jOk\nEt0ZMjgTf6IHd+AdP8RpSZLjMy+XpM0P5rLQMN/ZOStGJ6gwftNkaKU293Lx0aX3\nIt0np7OBwO0KCsjoeZ30jEse0P75KwRtp+Z8zIsBAoGAN47TexfJtaEK+ZQBoIn0\nh0mqV1si1QkPfMHSDvriKQ5d5tG8kF0vPVKAQV5kgytBeI+3bEO1iZC8i2FJzL7x\neN8ifRCcNXDRXjRdR0oPVIHImQ0XXwTB6JQmzVIFLWgxddDhZKpCQlA8GSRsbqEe\njtbTjDN0f5sX9llpKxd9xXw=\n-----END PRIVATE KEY-----\n

  3. Replace each literal \n with a line break. In private key syntax, \n denotes a new line. You can make this change in most text editors.

    For example, in Notepad++, replace each \\n with \n.

    The following is an example of the converted key:

    -----BEGIN PRIVATE KEY-----
MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQDVAm/9T1/yBO2ZCCUn9xJbaoFloMUQcQyc7Xd2snXeKSWXGNMmHFPOMTXT4KNCMsxfGPXeHixYcgpuPGok/bqJjY9rWncYh8/UUy3gox4fr+J21rj4qCZ5gvOItF7oVKfjk/E4SQrSRvApAc08W3u8vjNAmFoTBeUyEoKuHqCp48N5Gg3pM6htLXMrf2+q+wcv8IwtWAhopoG38XpjAh4+/bff/gkfFoDdIFYwo3IJ5qlU9xawmbZzy3R+8eZTM2WFAkG75lWfX7idj87J32EiSe9etCyER9EtaKbxIKC/bww/JKcz3nIWweyXOAX4/tMDs8ThcsztBTa/pseo4PI1AgMBAAECggEAEsdo+55OkV3lW4c4DV6vH9+TIlRK41DwIXqe/Fgt44Tho0FFRjgbnFNC0Vfd1MV5No4TCP7EfpSpPkA1xGaZFizkfrymQMOiay/dHM+MpZMCRmNWQdfDMpW8pinurxFdjsb5bnKkEVc/L4JQ53gSP9jN2G1GDaTIqMIwgqzBEdERHpgrRv1l+MUrJRpyMyh5ZYApihEmFX4XDR2IYa3ZSMkBT4L6MdIcPURBrvVYdV+IXGvGWDhPvz/KcjfY7JD8JqVLqSIwgU851gewJJXKpekUS47aYo9Re91+0DB91ZnUWhmDmgorVCz90PM7WpKcW/0XkI45yPLWP3elBwsFKQKBgQD7XqKKGf0PChMNlWYV1SKEwiFzLipAHzEOJvhXD6v6vskbwqr/xS5j5SvWqpydow9pd2ExCcxmNtlwmpPXDXyRu8dmnaXUYCeYBFWheQ+NzlKd2N6wqE5aXrHdwW9xZRcHbyY+dKOv+gFAOQX+kakI4bvOcOernhnI6Fnhd94mCQKBgQDY7ukU6/6bVEahhdssakT+trcMOdhiHiPeGHaKYy1r3FpmdPmMLeJlECAOFfWqAB0DUiR9hGPXBSB2oIIICCQraQSFV1lu2R+kCaV7rFUrvx1b1yeOQDv34/MR6NdjbsjfhPmxSahWaBsvAyx88GRhh0ULgzesEqqkZ19PMV/VzQKBgQDrjkU2sR/pRgGQyx28+9u7GMiLzQkeyZwIrRAvVapN8Rc4gnYH9NmCFzG7mmnldvZsWMilUY9PgbrFwLUl46eGUbeMO9M4b1rrI7Sy+mVO97eH38DfPvkdyntXWXt7gcXQ26G1CUyTDe66JjWt1wXWIuMBk+AlfKShFsuTc+ajMQKBgFNB

XbLp3409it3ywWsKXfBjr1zB1onRh3J1cQkrhwMeTpOD0UI7WefviF3fj6ju4jOkEt0ZMjgTf6IHd+AdP8RpSZLjMy+XpM0P5rLQMN/ZOStGJ6gwftNkaKU293Lx0aX3It0np7OBwO0KCsjoeZ30jEse0P75KwRtp+Z8zIsBAoGAN47TexfJtaEK+ZQBoIn0h0mqV1si1QkPfMHSDvriKQ5d5tG8kF0vPVKAQV5kgytBeI+3bEO1iZC8i2FJzL7xeN8ifRCcNXDRXjRdR0oPVIHImQ0XXwTB6JQmzVIFLWgxddDhZKpCQlA8GSRsbqEejtbTjDN0f5sX9llpKxd9xXw=

-----END PRIVATE KEY-----

  4. Save the converted private key in a new file.

  5. Download and extract the latest version of OpenSSL.

  6. From the OpenSSL bin folder, run one of the following commands:

    openssl rsa -aes-256-cbc -in "<converted-private-key-file>" -out "<output-file>" -traditional

    For example:

    $ openssl rsa -aes-256-cbc -in ConvertedGSuitePK.txt -out rsa.pem -traditional

    Or:

    openssl rsa -aes-128-cbc -in "<converted-private-key-file>" -out "<output-file>" -traditional

    For example:

    $ openssl rsa -aes-128-cbc -in ConvertedGSuitePK.txt -out rsa.pem -traditional

  7. Enter the PEM passphrase.

  8. Confirm the passphrase.

Note

Use the generated RSA-format private key and the passphrase as the private key and private key password in the connector configuration.

Documentation Feedback

Feedback is provided as an informational resource only and does not form part of SailPoint’s official product documentation. SailPoint does not warrant or make any guarantees about the feedback (including without limitation as to its accuracy, relevance, or reliability). All feedback is subject to the terms set forth at https://developer.sailpoint.com/discuss/tos.