# SailPoint Google Workspace Connector Documentation > Google Workspace Connector Documentation # Documentation # Configuring Additional Google Workspace Settings ## Advanced Settings Provide the settings for your aggregation. After you select **Advanced Settings**, the following page displays. > [!NOTE] > > **Screenshot** > > [![Advanced Settings]()]() 1. (Optional) Enter a **Domain Name** to aggregate from only a single Google Workspace domain in your organization. The connector supports and manages multi-domain environments. If you want to aggregate from all domains, leave this field empty or remove the domain name that was previously entered. 2. (Optional) Select **Delta Aggregation** to toggle enable or disable this feature. If you enable delta aggregation, the aggregation only includes changes since the last aggregation. Refer to [Configuring Delta Aggregation](<#configuring-delta-aggregation>) for more information. 3. (Optional) Use the **Account Filter** field to configure the scope of user records during full and delta account aggregation. This filter is only applicable for user accounts and not for service accounts or domains. For example, to filter out suspended users, enter `isSuspended=false` as an Account Filter entry. For more information about the filter syntax, refer to [Search for users]() in the Google documentation. > **Note** > > The Google documentation is not maintained by SailPoint, and is subject to change without notice. 4. Select **Save**. ### Improving Aggregation Performance You can configure the following optional attributes to improve aggregation performance when using the Google Workspace connector: > [!NOTE] > > Refer to [Best Practices: REST API Authentication]() and [REST API - Update Source (Partial)]() in the SailPoint Developer Community for more information on SailPoint REST APIs. #### Configuring `isSkipAlias` The number of API calls can be reduced during account aggregation by setting the `isSkipAlias` attribute to `true`. By default, this attribute value is `false`, which means one API call per user is required to fetch aliases. This has a greater risk of exhausting the daily limit of API calls and adversely affects account aggregation performance. When `isSkipAlias` is set to `true`, it saves one API call per user, improving account aggregation performance and reducing the number of API calls. Set the attribute value using: - Key - `connector_isSkipAlias` - Value - `true` #### Configuring `skipPreloadingMemberships` You can turn off group membership preloading if the number of group memberships is greater than or equal to the total number of users in your environment. Preloading group memberships means the connector performs account and entitlement aggregation to build a map of group memberships for each account. By default, the value of `skipPreloadingMemberships` is `false`, so the connector preloads group membership. Set the attribute value using: - Key - `connector_skipPreloadingMemberships` - Value - `false` > [!NOTE] > > If set to `true`, the connector skips membership preloading and instead executes many APIs during account aggregation, reducing performance and risking exhaustion of the API call limit. SailPoint recommends only setting this attribute to `true` when the number of groups is greater than or equal to the number of users in your environment. ### Configuring Delta Aggregation > [!IMPORTANT] > > The Google Workspace documentation lists the events that can be configured and fetched during delta aggregation. However, some attributes, such as `isEnrolledIn2Sv`, which corresponds to the event `USER_ENROLLED_IN_TWO_STEP_VERIFICATION`, are not fetched by the Google Workspace API. To define the scope for delta account and group aggregations, refer to [Generating OAuth 2.0 Credentials](). Use [Advanced Settings](<#advanced-settings>) to enable or disable delta aggregation. The Google Workspace connector retrieves accounts based on Activity Events for delta aggregation. By default, the following events are supported for account delta aggregation: `ADD_NICKNAME, CHANGE_USER_RELATION, CHANGE_USER_ORGANIZATION, CHANGE_USER_IM, CHANGE_LAST_NAME, CHANGE_FIRST_NAME, CHANGE_PASSWORD_ON_NEXT_LOGIN, MOVE_USER_TO_ORG_UNIT, REMOVE_NICKNAME, RENAME_USER, SUSPEND_USER, UPDATE_BIRTHDATE, CHANGE_PASSWORD, UNDELETE_USER, UNSUSPEND_USER, CHANGE_USER_CUSTOM_FIELD` Refer to [Admin Audit Activity Events - User Settings]() in the Google Workspace documentation for more information on events. Delta aggregation is supported only for the User account type. The connector performs full aggregation for Service Account and Domain account types. You can override the default account and group activity events using these source attributes: | Delta Aggregation Type | Default Events | Source Attribute | | --- | --- | --- | | Account | `ADD_NICKNAME, CHANGE_USER_RELATION, CHANGE_USER_ORGANIZATION, CHANGE_USER_IM, CHANGE_LAST_NAME, CHANGE_FIRST_NAME, CHANGE_PASSWORD_ON_NEXT_LOGIN, MOVE_USER_TO_ORG_UNIT, REMOVE_NICKNAME, RENAME_USER, SUSPEND_USER, UPDATE_BIRTHDATE, CHANGE_PASSWORD, UNDELETE_USER, UNSUSPEND_USER, CHANGE_USER_CUSTOM_FIELD` | `accountUpdateEvents` | | Group | `CHANGE_GROUP_SETTING, CHANGE_GROUP_DESCRIPTION, CHANGE_GROUP_NAME, DELETE_GROUP, REMOVE_GROUP_MEMBER` | `groupUpdateEvents` | > [!NOTE] > > Refer to [Best Practices: REST API Authentication]() and [REST API - Update Source (Partial)]() in the SailPoint Developer Community for more information on SailPoint REST APIs. ### Configuring Additional REST Parameters > [!NOTE] > > Refer to [Best Practices: REST API Authentication]() and [REST API - Update Source (Partial)]() in the SailPoint Developer Community for more information on SailPoint REST APIs. The connector supports a configurable page size for Group and Role by adding the following entries through the REST API: #### Configuring Aggregation Statistics Logging The connector logs aggregation statistics by default when the log level is set to Debug. To disable aggregation statistics logging, add the following source attribute through the REST API: - Key - `disableStatistics` - Value - `true` #### Configuring Data Transfer Before Account Deletion Configure the following source attributes through the REST API to transfer Google Workspace application data before deleting an account: - `excludeAppsFromTransfer` - List of Google Workspace applications to exclude from data transfer. By default, this list contains `Calendar` and `None`. The list must contain at least one entry (`None`). - `enableDataTransferOnDelete` - Boolean value that indicates whether data transfer is performed after account deletion. - `relationsForDataTransfer` - Ordered list of relationships used to identify the data owner when `newOwner` is not provided in the provisioning form. Example values include `manager`, `assistant`, and `father`. #### `groupPageSize` Number of records per page for Group Aggregation. The default value is the value provided in the **Page Size** field. Refer to [Advanced Settings](<#advanced-settings>) for more information. The maximum value is 200. #### `rolePageSize` Number of records per page for Role Aggregation. The default value is the value provided in the **Page Size** field. Refer to [Advanced Settings](<#advanced-settings>) for more information. The maximum value is 100. The connector supports account type configuration using the `accountTypes` attribute, which creates a list of account types you want to manage. If provided, Account Aggregation aggregates according to the configured list. By default, the connector aggregates all three account types (`users`, `serviceAccount`, and `domain`). - `fetchCustomIamRolesOnly` - Boolean/String. Fetches only custom roles during aggregation when set to `true`. It skips predefined roles. Requires a SailPoint CIEM license. - `aggregateGARolesOnly` - Boolean/String. Fetches generally available roles during aggregation when set to `true`. It skips roles in stages such as alpha and beta. Requires a SailPoint CIEM license. - `iamRoleView` - String. Possible values are `FULL` or `BASIC`. `FULL` is the default, which brings all permissions along with roles. `BASIC` skips the `includedPermission` attribute. Requires a SailPoint CIEM license. - `iamRolePageSize` - Page size for the role API. The default is 300. The maximum is 1,000. Requires a SailPoint CIEM license. - `serviceAccountPageSize` - Page size for the Service Account API. The default is 100. The maximum is 500. - `assetSearchPageSize` - Page size for the Cloud Asset API. The default and maximum are 500. When GCP support is enabled, the connector fetches both searchable resource types, `cloudresourcemanager` and `iam`, by default. To limit the number of entitlements, configure the connector to fetch one or the other by setting `searchableResourceTypes` to `iam` (Service Accounts) or `cloudresourcemanager` (Organization, Folders, and Projects) through the REST API. To fetch `iamResourcePermission` for only the `iam` resource type, which consists of Service Accounts, use the following PATCH body: ```json [ { "op": "add", "path": "/connectorAttributes/searchableResourceTypes", "value": "iam" } ] ``` To fetch `iamResourcePermission` for only the `cloudresourcemanager` resource type, which consists of Organizations, Folders, and Projects, use the following PATCH body: ```json [ { "op": "add", "path": "/connectorAttributes/searchableResourceTypes", "value": "cloudresourcemanager" } ] ``` ## Configuring the Exponential Backoff Retry Mechanism By default, the connector handles the following retryable error messages: - Request rate higher than configured - Quota exceeded - Rate limit exceeded You can configure additional error messages using the following entry key: ```text Error message 1 Error message 2 ``` > [!NOTE] > > Refer to [Best Practices: REST API Authentication]() and [REST API - Update Source (Partial)]() in the SailPoint Developer Community for information on SailPoint REST APIs. Use the REST API to configure the following attributes to set the amount of time the connector should wait before retrying the provisioning operation: - Key - `connector_waitBeforeProvisioningRetry` - Value - Time in seconds, for example `5` Ensure that you perform the following steps before generating a Client ID, Client Secret, Refresh Token for Client Credentials, and Private Key for Service Account: ## Google Cloud Platform (GCP) Setup Before generating OAuth 2.0 credentials for a service account, ensure the following Google Cloud Platform (GCP) configurations are in place: 1. Verify that a GCP Organization is available. 2. Create a project at the Organization level within the Google Cloud Platform Console. This requires a user with Super Admin or Project Creator privileges. 3. In the newly created or existing project, go to [APIs & Services \> Library]() and enable the following APIs: - Admin SDK API - Groups Settings API - Identity and Access Management (IAM) API - Cloud Resource Manager API - Cloud Asset API > **Note** > > For more information on generating the Client Credentials and Service Account, refer to [Generating OAuth 2.0 Credentials](). # Configuring Built-In Role Permissions ## Service Account Scopes and Built-In Roles for an Impersonated User The following table lists the minimum Service Account Scopes and Built-In Roles applied to an Impersonated User for the respective connector operations:
Connector Operation Service Account Scopes Impersonate User
Test Connection https://www.googleapis.com/auth/admin.directory.group
https://www.googleapis.com/auth/admin.directory.user		 No Role
Role related operations(Aggregate Role, Add and Remove Role) https://www.googleapis.com/auth/admin.directory.group
https://www.googleapis.com/auth/admin.directory.user
https://www.googleapis.com/auth/admin.directory.rolemanagement
https://www.googleapis.com/auth/admin.directory.rolemanagement.readonly		 Super Admin
Create Account with Role https://www.googleapis.com/auth/admin.directory.group
https://www.googleapis.com/auth/admin.directory.user
https://www.googleapis.com/auth/admin.directory.rolemanagement
https://www.googleapis.com/auth/admin.directory.rolemanagement.readonly		 Super Admin
Refresh Account G-Suite
https://www.googleapis.com/auth/admin.directory.group
https://www.googleapis.com/auth/admin.directory.user

GCP
https://www.googleapis.com/auth/iam
https://www.googleapis.com/auth/cloud-platform		 G-Suite
User Management Admin, Groups Admin, and Super Admin (only required if Role entitlements are managed)

GCP
Cloud Asset Viewer, Service account user, Project IAM Admin, Folder IAM Admin, Organization Administrator (only required if organization level access managed), Service Account Admin, User Management, and Group Admin
Account Aggregation
Create Account with Entitlement(s)
Update Account attribute(s) (For accounts with entitlement)
Add and Remove Entitlement(s)
Partitioning Aggregation
Group Aggregation G-Suite
https://www.googleapis.com/auth/admin.directory.group
https://www.googleapis.com/auth/apps.groups.settings

GCP
https://www.googleapis.com/auth/iam
https://www.googleapis.com/auth/cloud-platform		 G-Suite
Group Admin

GCP
Cloud Asset Viewer, Organization Administrator (only required if organization level access is managed), Service Account Admin, Folder IAM Admin, and Project IAM Admin
Create and Update Group G-Suite
https://www.googleapis.com/auth/admin.directory.group
https://www.googleapis.com/auth/apps.groups.settings

GCP
https://www.googleapis.com/auth/cloud-platform
https://www.googleapis.com/auth/iam
Create Account without Entitlement(s) G-Suite
https://www.googleapis.com/auth/admin.directory.user

GCP
https://www.googleapis.com/auth/iam
https://www.googleapis.com/auth/cloud-platform		 G-Suite
User Management Admin, Super Admin (only required if managing domain as a user)

GCP
Service Account Admin
Enable, Disable, and Delete Account
Update Account attribute(s) (For accounts without entitlement)
Change Password
Delta Aggregation for Account G-Suite
https://www.googleapis.com/auth/admin.directory.group
https://www.googleapis.com/auth/admin.directory.user
https://www.googleapis.com/auth/admin.reports.audit.readonly

GCP
https://www.googleapis.com/auth/iam
https://www.googleapis.com/auth/cloud-platform		 G-Suite
User Management Admin, Groups Admin, Custom Role (Reports), Super Admin (only required if managing domain as a user)

GCP
Cloud Asset Viewer
Delta Aggregation for Group G-Suite
https://www.googleapis.com/auth/admin.directory.group
https://www.googleapis.com/auth/admin.reports.audit.readonly

GCP
https://www.googleapis.com/auth/iam
https://www.googleapis.com/auth/cloud-platform		 G-Suite
Groups Admin and Custom Role (Reports)

GCP
Cloud Asset Viewer
Delete Data Transfer https://www.googleapis.com/auth/admin.directory.group
https://www.googleapis.com/auth/admin.directory.user		 User Management, Group Admin, and Data Transfer
DelegatedAdmins https://www.googleapis.com/auth/admin.directory.group
https://www.googleapis.com/auth/admin.directory.user
https://www.googleapis.com/auth/gmail.settings.sharing
https://www.googleapis.com/auth/gmail.settings.basic
https://mail.google.com/
https://www.googleapis.com/auth/gmail.modify
https://www.googleapis.com/auth/gmail.readonly		 User Management, Group Admin, and Gmail (Settings)
Aggregation for Folder and Project GCP
https://www.googleapis.com/auth/iam
https://www.googleapis.com/auth/cloud-platform		 GCP
Cloud Asset Viewer
Aggregation for IAM Role GCP
https://www.googleapis.com/auth/iam
https://www.googleapis.com/auth/cloud-platform		 GCP
Cloud Asset Viewer and Organization Role Viewer
Create, Update, and Delete IAM Roles GCP
https://www.googleapis.com/auth/iam
https://www.googleapis.com/auth/cloud-platform		 GCP
Organization Role Administrator
IAM Resource Permission GCP
https://www.googleapis.com/auth/iam
https://www.googleapis.com/auth/cloud-platform		 GCP
Cloud Asset Viewer, Organization Role Viewer, Organization Administrator (only required if managing Organization level access), Service Account Admin, Folder IAM Admin, and Project IAM Admin
To manage all operations on domain as Account type in GCP https://www.googleapis.com/auth/admin.directory.domain Super Admin
# Connecting SailPoint and Google Workspace To connect SailPoint with Google Workspace, perform the following tasks: ## Adding the Source in SailPoint To connect to SailPoint, perform the following steps. Once the connection is made, you can configure it to meet your company's needs. > [!IMPORTANT] > > By default, the provisioning feature is **disabled**, and the connector only supports read-only operations. To support provisioning operations, you must manually enable the feature in the source configuration. **To configure a new source:** 1. Sign in to SailPoint. 2. Go to **Admin \> Connections \> Sources**. 3. Select **Create New**. 4. Search for the connector by entering the name in the search box, and then select **Actions**. 5. In the **Actions** dropdown list, select the setup method: - [**Express Setup**](<#configuring-a-source-using-express-setup>) - Quickly create a read-only connection to your target system by providing minimal configurations and authentication. On completion, aggregation is automatically started. > **Note** > > Express Setup supports Credential Providers. For information on supported credential providers and configuration, refer to [Credential Providers](). For more information, contact your SailPoint Customer Service Manager. - [**Standard Setup**](<#configuring-a-source-using-standard-setup>) - Provide detailed basic configuration to create the source. Once the source is created, continue with source setup. ### Configuring a Source Using Express Setup Express Setup minimizes the initial configuration process so you can quickly connect the application and immediately begin aggregating user account and entitlement data. 1. Review the directions and select **Start Express Setup**. 2. Review the pre-populated **Source Name**, **Source Owner**, and **Description**. To update, select **Edit**. > **Note** > > The source name must be unique. You can change these settings later in the source configuration. 3. Select **Virtual Appliance**. A virtual appliance is a Linux-based virtual machine that connects to your sources and apps using SailPoint APIs, connectors, and integrations. For more information about configuring and deploying virtual appliances, refer to [SailPoint Virtual Appliances](). 4. (Optional) If enabled for your organization, select the **Use a Credential Provider** checkbox to manage the source's authentication using a credential provider. > **Note** > > To add a Credential Provider in SailPoint, go to **Admin \> Connections \> Credential Providers**. For more information about credential providers, refer to [Credential Providers](). 5. Configure the authentication to allow SailPoint to connect to the source. For more information, refer to the **Connection Settings** section. 6. Select **Finish**. After a successful test connection, the system creates your source and prompts you to run an aggregation. - If you want to aggregate now, select **Aggregate**. - To see the latest account aggregation history, go to **Account Management \> Account Aggregation**. - To see the list of aggregated source accounts, go to **Account Management \> Accounts**. - If you want to aggregate later, select **Exit**. This returns you to the **Sources** page. Your new source is listed, but contains no accounts or aggregation history yet. ### Configuring a Source Using Standard Setup Use Standard Setup to configure the connector for full feature support. 1. In the **Source Name** field, enter a unique and descriptive name for your source. Source names cannot exceed 128 characters. 2. In the **Description** field, provide additional details about the source to help distinguish it from similar sources. This field allows a maximum of 2,000 characters. 3. In the **Source Owner** field, begin typing the name of an owner. Matches appear after you type two or more letters. For more information, refer to [Assigning a Source Owner](). 4. Under **Connection Type**, select **Direct Connection** or **Flat File**. - **Direct Connection** - A direct connection fetches data from the **Virtual Appliance Cluster** you choose as the application connector for the source. A direct connection configuration allows for real-time updates. For more information about configuring and deploying virtual appliances, refer to the [Virtual Appliance Reference Guide](). - **Flat File** - Select the flat file if no connector is available, or if another system restricts the connection. This option allows only reading and aggregating data as a generic/delimited application. Provisioning activity is unsupported, and additional configuration pages like connection settings and aggregation settings are unavailable. 5. If you selected **Direct Connection**, in **Virtual Appliance Cluster**, select the virtual appliance cluster that will be used as the application connector for the source. 6. (Optional) Select a governance group to grant its members [source]() or [role]() sub-admin level oversight of the source and its access. For more information, refer to [Creating and Managing Governance Groups](). 7. If this source represents a primary system containing your organization's personnel records, select the **Authoritative Source** checkbox. For more information, refer to [Creating Identity Profiles](). 8. Select **Continue**. The source is created, and you are navigated to the **Source Setup \> Base Configuration** page. Continue to configure your connected source there. ## Base Configuration Provide the base configuration parameters. Information you entered in the Create New Source dialog is automatically entered into the fields in the Base Configuration page. You can edit this information if necessary. 1. Enter a unique name and description for the source. 2. In the **Source Owner** dropdown list, select the identity that owns this source. - To find a source owner, begin entering their name. 3. In the **Virtual Appliance Cluster** dropdown list, select the virtual appliance to use when communicating with your organization's systems. For more information, refer to [SailPoint Virtual Appliances](). 4. (Optional) If enabled for your organization, select the **Use a Credential Provider** checkbox to manage the source's authentication using a credential provider. > **Note** > > To add a credential provider, go to **Admin \> Connections \> Credential Providers**. For more information about credential providers, refer to [Credential Providers](). 5. Configure the authentication to allow SailPoint to connect to the source. Refer to [Connection Settings](<#connection-settings>) for more information. 6. (Optional) In the **Governance Group for Source Management** dropdown list, select a governance group to associate with this source. For more information about governance groups, refer to [Associating Governance Groups with a Source](). 7. (Optional) Choose whether to enable or disable provisioning for the source. Provisioning is disabled by default. - **Enable Provisioning** - Set the toggle to **Enabled** to allow the source to create, update, and deactivate accounts in the connected source system. - **Disable Provisioning** - Set the toggle to **Disabled** to disable provisioning for the source. Disabling provisioning will prevent the creation, updating, or deactivating of accounts on this source. 8. Select **Save**. ## Connection Settings Choose the appropriate authentication type and provide the information required to connect and interact with the source. ### Service Account Authentication Settings > [!NOTE] > > **Screenshot** > > [![Service Account Authentication Settings]()]() 1. Go to **Connection Settings**. 2. In the **Grant Type** menu, select **Service Account**. 3. In the **Email Address of Service Account** field, enter the email address of the service account user. 4. In the **Email Address of User to Impersonate** field, enter the email address of the Impersonate User. This is the user in Google Workspace who has the required access via roles to perform the operations. 5. In the **Scopes** field, enter the scopes to access the Google API. To add more than one scope, use a comma (,) as a separator. For more information on the available scopes, refer to [Generating OAuth 2.0 Credentials](). 6. In the **Private Key** field, enter the encrypted private key generated in [Generating OAuth 2.0 Credentials](). 7. In the **Private Key Password** field, enter the private key password generated in [Generating OAuth 2.0 Credentials](). 8. Select **Save**. ### Client Credentials Authentication Settings > [!NOTE] > > **Screenshot** > > [![Client Credentials Authentication Settings]()]() For information on generating the client ID, client secret, and refresh token, refer to [Generating OAuth 2.0 Credentials](). 1. In the **Grant Type** menu, select **Client Credentials**. 2. Enter the **Client ID** and **Client Secret** of the user application for OAuth 2.0 authentication. 3. In the **Refresh Token** field, enter the value of the refresh token to obtain a new access token. 4. Select **Save**. ## Cloud Resource Management Settings Select **Manage Cloud Resources** to enter the Organization ID. Adding this ID enables you to govern your cloud environments using the Google Workspace connector. > [!NOTE] > > **Screenshot** > > [![Cloud Resource Management Settings]()]() 1. In the **Organization ID** field, enter the 10-digit Organization ID. You can find the Organization ID in Google's Business Profile Manager. Refer to [View organization ID and other details]() in the Google documentation. 2. Select **Save**. ## Configuring Additional Settings After establishing the connection, configure optional aggregation, governance, and machine identity settings. Refer to [Configuring Additional Google Workspace Settings](). ## Review and Test Perform a test to confirm the connection to SailPoint. 1. Go to **Review and Test**. 2. Confirm that the entries in each field are correct. If you note any mistakes, return to the section and make corrections. 3. Select **Test Connection**. ## SailPoint Application Onboarding SailPoint application onboarding enables you to easily onboard new applications and create sources following the successful onboarding of a discovery source. To use this feature, continue to **Discovered Applications** in the SailPoint user interface. For more information, refer to [Application Onboarding]() in the SailPoint SaaS documentation. # Configuring Custom Role Permissions ## Service Account Scopes and Custom Roles for an Impersonated User Refer to [Creating Custom Roles](<#creating-custom-roles>) for more information. ### Creating Custom Roles To create a custom role in Google Workspace: 1. In the Google Workspace configuration interface, go to **Admin Console \> Menu \> Account \> Admin roles**. 2. Select **Create new role**. 3. Enter the **Name** and **Description** for the role and select **Continue**. To create a custom role in Google Cloud Platform (GCP): 1. Go to **GCP Console \> Roles**. 2. Select **Create Role**. 3. Enter the **Title** and **Description** for the role and select **Continue**. The following table lists the minimum requirements of Service Account Scopes and Custom Roles applied to an Impersonated User for the respective connector operations.
Connector Operation Service Account Scopes Impersonate User
Test Connection G-Suite
https://www.googleapis.com/auth/admin.directory.group
https://www.googleapis.com/auth/admin.directory.user

GCP
https://www.googleapis.com/auth/iam
https://www.googleapis.com/auth/cloud-platform		 G-Suite
Admin Console Privileges - Organizational Units (Read), Users (Read)
Admin API Privileges - Organizational Units (Read), Users (Read), Group (Read), Domain Management (only required if managing domain as a user)

GCP
(User-defined Custom Role) - cloudasset.assets.searchAllResources, cloudasset.assets.searchAllIamPolicies, iam.serviceAccounts.list
Refresh Account
Account Aggregation
Partitioning Aggregation
Role related operations (Aggregate Role, Create Account/Enable/Disable/Change Password/Add and Remove) with Role https://www.googleapis.com/auth/admin.directory.group
https://www.googleapis.com/auth/admin.directory.user
https://www.googleapis.com/auth/admin.directory.rolemanagement
https://www.googleapis.com/auth/admin.directory.rolemanagement.readonly		 Super Admin
Group Aggregation G-Suite
https://www.googleapis.com/auth/admin.directory.group
https://www.googleapis.com/auth/apps.groups.settings
https://www.googleapis.com/auth/admin.directory.rolemanagement
https://www.googleapis.com/auth/admin.directory.rolemanagement.readonly

GCP
https://www.googleapis.com/auth/iam
https://www.googleapis.com/auth/cloud-platform		 G-Suite
Admin API Privileges - Group (Read)

GCP
(User-defined Custom Role) - cloudasset.assets.searchAllResources, cloudasset.assets.searchAllIamPolicies
Delete group https://www.googleapis.com/auth/admin.directory.group Admin Console Privileges - Groups
Admin API Privileges - Group (Delete)
Create and Update Group G-Suite
https://www.googleapis.com/auth/admin.directory.group
https://www.googleapis.com/auth/apps.groups.settings

GCP
https://www.googleapis.com/auth/iam
https://www.googleapis.com/auth/cloud-platform		 G-Suite
Admin Console Privileges - Groups
Admin API Privileges - Group (Create and Read)

GCP
(User-defined Custom Role) - cloudasset.assets.searchAllResources, cloudasset.assets.searchAllIamPolicies, resourcemanager.projects.getIamPolicy, resourcemanager.projects.setIamPolicy, resourcemanager.folders.getIamPolicy, resourcemanager.folders.setIamPolicy, resourcemanager.organizations.getIamPolicy, resourcemanager.organizations.setIamPolicy, iam.serviceAccounts.getIamPolicy, iam.serviceAccounts.setIamPolicy
Create Account without Entitlement(s) G-Suite
https://www.googleapis.com/auth/admin.directory.user

GCP
https://www.googleapis.com/auth/iam
https://www.googleapis.com/auth/cloud-platform		 G-Suite
Admin Console Privileges - Organizational Unit (Read), Users (Create and Read), Update (Rename Users, Move Users, Reset Password, Force Password Change, Add/Remove Aliases, Suspend Users)
Admin API Privileges - Users (Create and Read), Update (Rename Users, Move Users, Reset Password, Force Password Change, Add/Remove Aliases, Suspend Users), Domain Management (only required if managing domain as a user)

GCP
(User-defined Custom Role) - iam.serviceAccounts.create, iam.serviceAccounts.get
Enable, Disable and Delete Account
Update Account attribute(s) (For accounts without entitlement)
Change Password
Create Account with Entitlement(s) G-Suite
https://www.googleapis.com/auth/admin.directory.group
https://www.googleapis.com/auth/apps.groups.settings
https://www.googleapis.com/auth/admin.directory.user
https://www.googleapis.com/auth/admin.directory.rolemanagement

GCP
https://www.googleapis.com/auth/iam
https://www.googleapis.com/auth/cloud-platform		 G-Suite
Admin Console Privileges - Organizational Unit (Read), Users (Create and Read), Update (Rename Users, Move Users, Reset Password, Force Password Change, Add/Remove Aliases, Suspend Users), Group
Admin API Privileges - Groups (Create and Read), Delete, Users (Create and Read), Update (Rename Users, Move Users, Reset Password, Force Password Change, Add/Remove Aliases, Suspend Users Groups) Cloud Asset Viewer, Project IAM Admin, Folder IAM Admin, Organization Administrator, Service Account Admin

GCP
(User-defined Custom Role) - cloudasset.assets.searchAllResources, cloudasset.assets.searchAllIamPolicies, iam.serviceAccounts.create, iam.serviceAccounts.get, resourcemanager.projects.getIamPolicy, resourcemanager.projects.setIamPolicy, resourcemanager.folders.getIamPolicy, resourcemanager.folders.setIamPolicy, resourcemanager.organizations.get, resourcemanager.organizations.getIamPolicy, resourcemanager.organizations.setIamPolicy, iam.serviceAccounts.getIamPolicy, iam.serviceAccounts.setIamPolicy
Add/Remove Entitlements
Update Account attribute(s) (For accounts with entitlement)
Delta Aggregation for Account G-Suite
https://www.googleapis.com/auth/admin.directory.group
https://www.googleapis.com/auth/apps.groups.settings
https://www.googleapis.com/auth/admin.directory.user
https://www.googleapis.com/auth/admin.reports.audit.readonly

GCP
https://www.googleapis.com/auth/iam
https://www.googleapis.com/auth/cloud-platform		 G-Suite
Admin Console Privileges - Organizational Unit (Read), Users (Create and Read), Update (Rename Users, Move Users, Reset Password, Force Password Change, Add/Remove Aliases, Suspend Users), Security (Reports), Groups
Admin API Privileges - Groups (Create and Read), Update, Delete (Rename Users, Move Users, Reset Password, Force Password Change, Add/Remove Aliases, Suspend Users), Groups, Domain Management (only required if managing domain as a user)

GCP
(User-defined Custom Role) - cloudasset.assets.searchAllResources, cloudasset.assets.searchAllIamPolicies, iam.serviceAccounts.list
Delta Aggregation for Group G-Suite
https://www.googleapis.com/auth/admin.directory.group
https://www.googleapis.com/auth/apps.groups.settings
https://www.googleapis.com/auth/admin.reports.audit.readonly

GCP
https://www.googleapis.com/auth/iam
https://www.googleapis.com/auth/cloud-platform		 G-Suite
Admin Console Privileges - Organizational Unit (Read), Users (Create and Read), Update (Rename Users, Move Users, Reset Password, Force Password Change, Add/Remove Aliases, Suspend Users), Security (Reports), Groups
Admin API Privileges - Groups (Create and Read), Update, Delete, Users (Create and Read), Update (Rename Users, Move Users, Reset Password, Force Password Change, Add/Remove Aliases, Suspend Users), Groups

GCP
(User-defined Custom Role) - cloudasset.assets.searchAllResources, cloudasset.assets.searchAllIamPolicies
Delete Data Transfer https://www.googleapis.com/auth/admin.directory.group
https://www.googleapis.com/auth/admin.directory.user		 Admin Console Privileges - Organizational Unit (Read), Users (Create and Read), Update (Rename Users, Move Users, Reset Password, Force Password Change, Add/Remove Aliases, Suspend Users), Delete
Admin API Privileges - Groups (Create and Read), Update, Delete, Users (Create and Read), Update (Rename Users, Move Users, Reset Password, Force Password Change, Add/Remove Aliases, Suspend Users), Delete Data Transfer
Delegated Admins https://www.googleapis.com/auth/admin.directory.group
https://www.googleapis.com/auth/admin.directory.user
https://www.googleapis.com/auth/gmail.settings.sharing
https://www.googleapis.com/auth/gmail.settings.basic
https://mail.google.com/
https://www.googleapis.com/auth/gmail.modify
https://www.googleapis.com/auth/gmail.readonly		 Admin Console Privileges - Organizational Unit (Read), Users (Create and Read), Update (Rename Users, Move Users, Reset Password, Force Password Change, Add/Remove Aliases, Suspend Users), Gmail (Settings), Groups
Admin API Privileges - Groups (Create and Read), Update, Update (Rename Users, Move Users, Reset Password, Force Password Change, Add/Remove Aliases, Suspend Users), User Management, Group Admin, Gmail (Settings)
Aggregation for Folder and Project GCP
https://www.googleapis.com/auth/iam
https://www.googleapis.com/auth/cloud-platform		 GCP
(User-defined Custom Role) - cloudasset.assets.searchAllResources and cloudasset.assets.searchAllIamPolicies
Aggregation for IAM Role GCP
https://www.googleapis.com/auth/iam
https://www.googleapis.com/auth/cloud-platform		 GCP
(User-defined Custom Role) - cloudasset.assets.searchAllResources, cloudasset.assets.searchAllIamPolicies, iam.roles.list, resourcemanager.projects.list
Create/Update/Delete IAM Roles GCP
https://www.googleapis.com/auth/iam
https://www.googleapis.com/auth/cloud-platform		 GCP
(User-defined Custom Role) - iam.roles.create, iam.roles.update, iam.roles.delete, iam.roles.get, iam.roles.list
Aggregation for IAM Resource Permission GCP
https://www.googleapis.com/auth/iam
https://www.googleapis.com/auth/cloud-platform		 GCP
(User-defined Custom Role) - cloudasset.assets.searchAllResources, iam.roles.list, resourcemanager.projects.list, resourcemanager.organizations.getIamPolicy, iam.serviceAccounts.getIamPolicy, resourcemanager.folders.getIamPolicy, resourcemanager.projects.getIamPolicy
To manage all operations on domain as Account type in GCP G-Suite
https://www.googleapis.com/auth/admin.directory.domain		 G-Suite
Admin API Privileges - Domain Management
# Generating OAuth 2.0 Credentials The following procedures outline how to generate the necessary OAuth 2.0 credentials. > [!NOTE] > > When generating client credentials and service account credentials, use a Google Workspace user who has permission to generate refresh tokens and the required roles or IAM roles to manage Google Workspace and GCP data. Refer to [Prerequisites]() and [Required Roles for Google Workspace and GCP Management](). ## Client Credentials This section describes the procedures for generating the Client ID, Client Secret, and Refresh Token. ### Generating a Client ID and Client Secret 1. Go to **Google Cloud Platform \> APIs & Services \> Credentials**. 2. From the project dropdown list, select an existing project or create a new one. 3. On the **Credentials** page, select **Create Credentials \> OAuth Client ID**. 4. If prompted with a Consent page, select the application type as **Internal**, enter the application name, and save it. 5. Under **Application type**, select **Web application**. 6. Enter an **Application Name**. 7. Under **Authorized redirect URLs**, add the following: ```text https://developers.google.com/oauthplayground ``` 8. Select **Create**. Note the Client ID and Client Secret displayed, as these are required for generating the refresh token. ### Generating a Refresh Token > [!NOTE] > > Before proceeding, ensure you have generated the Client ID and Client Secret. 1. Go to the [OAuth2 Playground](). 2. Select the gear icon in the upper right corner and select the **Use your own OAuth credentials** checkbox (if it is not already selected). 1. Confirm that OAuth Flow is set to Server-side and Access type is set to **Offline**. This ensures that you get a refresh token and an access token. 2. Enter the **OAuth2 client ID** and **OAuth2 client secret** you obtained in the previous step. 3. In **Step 1 - Select & authorize APIs**, enter the required scopes in the text box at the bottom. Use a comma as a separator to add more than one scope. | Scope | Purpose | | --- | --- | | `https://www.googleapis.com/auth/admin.directory.user` | User Provisioning | | `https://www.googleapis.com/auth/apps.groups.settings` | Group Settings API | | `https://www.googleapis.com/auth/admin.directory.rolemanagement` | All role management operations, including creating roles and role assignments | | `https://www.googleapis.com/auth/admin.directory.rolemanagement.readonly` | Getting and listing roles, privileges, and role assignments | | `https://www.googleapis.com/auth/cloud-platform`
`https://www.googleapis.com/auth/iam` | Accessing GCP-related data | | `https://www.googleapis.com/auth/admin.directory.domain` | Managing a domain as an account type in GCP | | `https://www.googleapis.com/auth/admin.datatransfer` | Data transfer before account deletion | | `https://www.googleapis.com/auth/admin.directory.group` | Group Provisioning | | `https://www.googleapis.com/auth/admin.reports.audit.readonly` | Account and Group Delta Aggregation | 3. When prompted, sign in to the account that you want to grant access to and select **Allow**. > **Note** > > If a `redirect_uri_mismatch` error states that your changes might not have propagated, select **Back** and try selecting **Authorize APIs** again. 4. On **Step 2 - Exchange authorization code for tokens**, verify that the **Authorization code** is displayed. 5. Select **Exchange authorization code for tokens**. The **Refresh token** and **Access token** fields are displayed. 6. Copy the **Refresh token** into the configuration file for the client library with the Client ID and Client Secret. ## Service Account > [!NOTE] > > SailPoint's Cloud Infrastructure Entitlement Management (CIEM) only supports Service Account as a grant type. A Service Account belongs to the application. Create a service account for the project in the API Console, delegate domain-wide access to the service account, and add the required scopes in the admin console against the service account Client ID. ### Creating a Service Account and Generating a Private Key 1. Sign in to the Google Cloud Platform Console using a user who has the permissions required to generate the private key and manage Google Workspace and GCP data. 2. Go to [Service Accounts](). 3. Select an existing project or create a new project. 4. Select **Create service account**. 5. Enter a name and description for the service account. For example, enter `Project-Service Account`. 6. Select **Done**. 7. Select the email address of the newly created service account. 8. Go to **Keys**. 9. Select **Add key \> Create new key**. 10. Select **JSON**. 11. Select **Create**. The private key downloads to the computer in JSON format. 12. Select **Close**. ### Adding Scopes to the Service Account 1. Sign in to the [Google Admin Console]() as a Super Admin user. 2. Go to **Menu \> Security \> Access and data control \> API controls**. 3. Select **Manage Domain Wide Delegation**. 4. Select **Add new**. 5. Enter the service account client ID. The client ID, also called the Unique ID, is the `client_id` in the downloaded JSON file, for example, `"client_id":"102996919678308170059"`. You can also find it under **IAM & Admin \> Service accounts \> \[your service account\]**. 6. In **OAuth scopes**, enter the required scopes. Use a comma as a separator to add more than one scope. | Scope | Purpose | | --- | --- | | `https://www.googleapis.com/auth/admin.directory.group` | Group Provisioning | | `https://www.googleapis.com/auth/admin.directory.user` | User Provisioning | | `https://www.googleapis.com/auth/apps.groups.settings` | Group Settings API | | `https://www.googleapis.com/auth/admin.directory.rolemanagement` | All role management operations, including creating roles and role assignments | | `https://www.googleapis.com/auth/admin.directory.rolemanagement.readonly` | Getting and listing roles, privileges, and role assignments | | `https://www.googleapis.com/auth/gmail.settings.sharing` | Gmail API provisioning | | `https://www.googleapis.com/auth/cloud-platform`
`https://www.googleapis.com/auth/iam` | Accessing GCP-related data | | `https://www.googleapis.com/auth/gmail.settings.basic`
`https://mail.google.com/`
`https://www.googleapis.com/auth/gmail.modify`
`https://www.googleapis.com/auth/gmail.readonly` | Gmail API aggregation | | `https://www.googleapis.com/auth/admin.directory.domain` | Managing a domain as an account type in GCP | | `https://www.googleapis.com/auth/admin.datatransfer` | Data transfer before account deletion | | `https://www.googleapis.com/auth/admin.reports.audit.readonly` | Account and Group Delta Aggregation | 7. Select **Authorize**. > **Note** > > If an error displays, the client ID might not be registered with Google or the scopes might contain duplicates or unsupported values. 8. Select the new **Client ID**. 9. Select **View details** and verify that each scope is listed. 10. If a scope is missing, select **Edit**, enter the missing scope, and select **Authorize**. You can't edit the client ID. The application should be available within minutes, but availability can take up to 24 hours. ### Assigning Scopes to the Service Account [![Service Account Scopes]()]() 1. Go to [Google Admin](). 2. Go to **Security \> Access and Data Control \> API controls**. 3. Select **Manage Domain Wide Delegation**. 4. Select the service account and assign the applicable scopes documented in this guide. ### Converting a Service Account Private Key to RSA Format 1. Open the downloaded JSON file. 2. Copy the private key value into a new file. For example: ```text -----BEGIN PRIVATE KEY-----\nMIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQDVAm/9T1/yBO2Z\nCCUn9xJbaoFloMUQcQyc7Xd2snXeKSWXGNMmHFPOMTXT4KNCMsxfGPXeHixYcgpu\nPGok/bqJjY9rWncYh8/UUy3gox4fr+J21rj4qCZ5gvOItF7oVKfjk/E4SQrSRvAp\nAc08W3u8vjNAmFoTBeUyEoKuHqCp48N5Gg3pM6htLXMrf2+q+wcv8IwtWAhopoG3\n8XpjAh4+/bff/gkfFoDdIFYwo3IJ5qlU9xawmbZzy3R+8eZTM2WFAkG75lWfX7id\nj87J32EiSe9etCyER9EtaKbxIKC/bww/JKcz3nIWweyXOAX4/tMDs8ThcsztBTa/\npseo4PI1AgMBAAECggEAEsdo+55OkV3lW4c4DV6vH9+TIlRK41DwIXqe/Fgt44Th\no0FFRjgbnFNC0Vfd1MV5No4TCP7EfpSpPkA1xGaZFizkfrymQMOiay/dHM+MpZMC\nRmNWQdfDMpW8pinurxFdjsb5bnKkEVc/L4JQ53gSP9jN2G1GDaTIqMIwgqzBEdER\nHpgrRv1l+MUrJRpyMyh5ZYApihEmFX4XDR2IYa3ZSMkBT4L6MdIcPURBrvVYdV+I\nXGvGWDhPvz/KcjfY7JD8JqVLqSIwgU851gewJJXKpekUS47aYo9Re91+0DB91ZnU\nWhmDmgorVCz90PM7WpKcW/0XkI45yPLWP3elBwsFKQKBgQD7XqKKGf0PChMNlWYV\n1SKEwiFzLipAHzEOJvhXD6v6vskbwqr/xS5j5SvWqpydow9pd2ExCcxmNtlwmpPX\nDXyRu8dmnaXUYCeYBFWheQ+NzlKd2N6wqE5aXrHdwW9xZRcHbyY+dKOv+gFAOQX+\nkakI4bvOcOernhnI6Fnhd94mCQKBgQDY7ukU6/6bVEahhdssakT+trcMOdhiHiPe\nGHaKYy1r3FpmdPmMLeJlECAOFfWqAB0DUiR9hGPXBSB2oIIICCQraQSFV1lu2R+k\nCaV7rFUrvx1b1yeOQDv34/MR6NdjbsjfhPmxSahWaBsvAyx88GRhh0ULgzesEqqk\nZ19PMV/VzQKBgQDrjkU2sR/pRgGQyx28+9u7GMiLzQkeyZwIrRAvVapN8Rc4gnYH\n9NmCFzG7mmnldvZsWMilUY9PgbrFwLUl46eGUbeMO9M4b1rrI7Sy+mVO97eH38Df\nPvkdyntXWXt7gcXQ26G1CUyTDe66JjWt1wXWIuMBk+AlfKShFsuTc+ajMQKBgFNB\nXbLp3409it3ywWsKXfBjr1zB1onRh3J1cQkrhwMeTpOD0UI7WefviF3fj6ju4jOk\nEt0ZMjgTf6IHd+AdP8RpSZLjMy+XpM0P5rLQMN/ZOStGJ6gwftNkaKU293Lx0aX3\nIt0np7OBwO0KCsjoeZ30jEse0P75KwRtp+Z8zIsBAoGAN47TexfJtaEK+ZQBoIn0\nh0mqV1si1QkPfMHSDvriKQ5d5tG8kF0vPVKAQV5kgytBeI+3bEO1iZC8i2FJzL7x\neN8ifRCcNXDRXjRdR0oPVIHImQ0XXwTB6JQmzVIFLWgxddDhZKpCQlA8GSRsbqEe\njtbTjDN0f5sX9llpKxd9xXw=\n-----END PRIVATE KEY-----\n ``` 3. Replace each literal `\n` with a line break. In private key syntax, `\n` denotes a new line. You can make this change in most text editors. For example, in Notepad++, replace each `\\n` with `\n`. The following is an example of the converted key: ```text -----BEGIN PRIVATE KEY----- MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQDVAm/9T1/yBO2ZCCUn9xJbaoFloMUQcQyc7Xd2snXeKSWXGNMmHFPOMTXT4KNCMsxfGPXeHixYcgpuPGok/bqJjY9rWncYh8/UUy3gox4fr+J21rj4qCZ5gvOItF7oVKfjk/E4SQrSRvApAc08W3u8vjNAmFoTBeUyEoKuHqCp48N5Gg3pM6htLXMrf2+q+wcv8IwtWAhopoG38XpjAh4+/bff/gkfFoDdIFYwo3IJ5qlU9xawmbZzy3R+8eZTM2WFAkG75lWfX7idj87J32EiSe9etCyER9EtaKbxIKC/bww/JKcz3nIWweyXOAX4/tMDs8ThcsztBTa/pseo4PI1AgMBAAECggEAEsdo+55OkV3lW4c4DV6vH9+TIlRK41DwIXqe/Fgt44Tho0FFRjgbnFNC0Vfd1MV5No4TCP7EfpSpPkA1xGaZFizkfrymQMOiay/dHM+MpZMCRmNWQdfDMpW8pinurxFdjsb5bnKkEVc/L4JQ53gSP9jN2G1GDaTIqMIwgqzBEdERHpgrRv1l+MUrJRpyMyh5ZYApihEmFX4XDR2IYa3ZSMkBT4L6MdIcPURBrvVYdV+IXGvGWDhPvz/KcjfY7JD8JqVLqSIwgU851gewJJXKpekUS47aYo9Re91+0DB91ZnUWhmDmgorVCz90PM7WpKcW/0XkI45yPLWP3elBwsFKQKBgQD7XqKKGf0PChMNlWYV1SKEwiFzLipAHzEOJvhXD6v6vskbwqr/xS5j5SvWqpydow9pd2ExCcxmNtlwmpPXDXyRu8dmnaXUYCeYBFWheQ+NzlKd2N6wqE5aXrHdwW9xZRcHbyY+dKOv+gFAOQX+kakI4bvOcOernhnI6Fnhd94mCQKBgQDY7ukU6/6bVEahhdssakT+trcMOdhiHiPeGHaKYy1r3FpmdPmMLeJlECAOFfWqAB0DUiR9hGPXBSB2oIIICCQraQSFV1lu2R+kCaV7rFUrvx1b1yeOQDv34/MR6NdjbsjfhPmxSahWaBsvAyx88GRhh0ULgzesEqqkZ19PMV/VzQKBgQDrjkU2sR/pRgGQyx28+9u7GMiLzQkeyZwIrRAvVapN8Rc4gnYH9NmCFzG7mmnldvZsWMilUY9PgbrFwLUl46eGUbeMO9M4b1rrI7Sy+mVO97eH38DfPvkdyntXWXt7gcXQ26G1CUyTDe66JjWt1wXWIuMBk+AlfKShFsuTc+ajMQKBgFNB XbLp3409it3ywWsKXfBjr1zB1onRh3J1cQkrhwMeTpOD0UI7WefviF3fj6ju4jOkEt0ZMjgTf6IHd+AdP8RpSZLjMy+XpM0P5rLQMN/ZOStGJ6gwftNkaKU293Lx0aX3It0np7OBwO0KCsjoeZ30jEse0P75KwRtp+Z8zIsBAoGAN47TexfJtaEK+ZQBoIn0h0mqV1si1QkPfMHSDvriKQ5d5tG8kF0vPVKAQV5kgytBeI+3bEO1iZC8i2FJzL7xeN8ifRCcNXDRXjRdR0oPVIHImQ0XXwTB6JQmzVIFLWgxddDhZKpCQlA8GSRsbqEejtbTjDN0f5sX9llpKxd9xXw= -----END PRIVATE KEY----- ``` 4. Save the converted private key in a new file. 5. Download and extract the latest version of OpenSSL. 6. From the OpenSSL `bin` folder, run one of the following commands: ```text openssl rsa -aes-256-cbc -in "" -out "" -traditional ``` For example: ```text $ openssl rsa -aes-256-cbc -in ConvertedGSuitePK.txt -out rsa.pem -traditional ``` Or: ```text openssl rsa -aes-128-cbc -in "" -out "" -traditional ``` For example: ```text $ openssl rsa -aes-128-cbc -in ConvertedGSuitePK.txt -out rsa.pem -traditional ``` 7. Enter the PEM passphrase. 8. Confirm the passphrase. > [!NOTE] > > Use the generated RSA-format private key and the passphrase as the private key and private key password in the connector configuration. # Integrating with Google Workspace #### Formerly G Suite > [!NOTE] > > Google Workspace is the new name for G Suite. This guide refers to the connector as "Google Workspace" except where "G Suite" is still used, such as in some user interface configurations. > [!IMPORTANT] > > To enable additional cloud governance features, such as visualization of effective access, for your GCP Cloud Infrastructure, you must purchase a SailPoint Cloud Infrastructure Entitlement Management (CIEM) license. Contact your SailPoint Customer Success Manager for more information and to request access. > > Refer to [Supported Features and Prerequisites]() for information on additional features supported with cloud governance. The SailPoint Google Workspace connector manages accounts, groups, and roles from all available domains of Google Workspace for Business, Education, or ISP when the service account provided in the application configuration has sufficient access to those domains. It also manages Gmail delegates for accounts, moves users between Organizational Units, and manages account and group attributes. The Google Workspace connector: - Uses the standard exponential backoff strategy recommended by Google to handle errors during aggregation. - Manages Identity and Access Management (IAM) in Google Cloud Platform (GCP). - Manages accounts, groups, and roles for the GCP organization infrastructure, including multiple user types and user access across resources through IAM policies. Google Cloud Platform is a suite of public cloud computing services offered by Google. The platform includes hosted services for compute, storage, and application development that run on Google hardware. > [!NOTE] > > To view the latest features, enhancements, and fixes for all SaaS connectors, refer to the [SaaS Release Notes]() page. #### Supported Features Refer to [Supported Features](). #### Prerequisites Refer to [Prerequisites](). #### Administrator Permission Refer to [Administrator Permissions](). # Machine Account Attributes Machine account attributes are used in provisioning configurations for machine accounts. After you have [created the required machine account subtypes](), you can use the machine account attributes to provision machine accounts in your SailPoint tenant. Refer to [Machine Identity Security Overview]() for more information. > [!NOTE] > > Attributes marked with an asterisk (\*) are mandatory. ## Machine Account Provisioning Attributes | Create Machine Account Attribute | Description | | --- | --- | | projectId\* | Google Cloud Project ID where the service account is created. | | serviceAccountId\* | Service account ID (short name) for the machine account. | | displayName\* | Display name of the service account. | | objectType | Object routing type used by the connector; set to `serviceAccount` for the machine-account flow. | | description | Optional description for the service account. | # Provisioning The Google Workspace connector supports provisioning, allowing you to create and manage accounts and entitlements in Google Workspace directly from SailPoint. **Prerequisite:** Your system is configured for provisioning. When SailPoint provisions new accounts to the source, it uses the attributes on the **Create Account** page as instructions or a template for what to include in the account. This page is also referred to as the *provisioning policy*. When new access is granted on a source where a user does not already have an account, SailPoint automatically includes account creation in the provisioning. This applies whether provisioning is started from an access request or from an automated role or lifecycle state assignment. For direct-connect sources, SailPoint automatically creates the account from this configuration. If the source is not configured as a direct-connect source, SailPoint creates and assigns a provisioning task to the source owner and includes the values for the source owner to use in manually creating the account. > [!IMPORTANT] > > This section describes the default **Create Account** configuration. SailPoint recommends that you work with Services to define a provisioning configuration specific to your company's needs. Be sure to verify large changes to the provisioning policy before implementation. Failure to do so might cause provisioning to fail. The Google Workspace connector supports all special characters in a password while provisioning. ## Default Create Account Attributes Attributes marked with an asterisk (\*) are required. | Attribute Name | Description | | --- | --- | | objectType | Type of the account to be created. Default value: User. When creating a Domain, the object type must be `domain`. When creating a Service Account, the object type must be `serviceAccount`. | | familyName\* | The user's last name. | | givenName\* | The user's first name. | | password\* | Password for the user account. | | primaryEmail\* | Primary email address of the user. | | domainName | Name of the domain to create. | | projectId | The ID of the project that owns the service account. | | serviceAccountId | Account ID of the service account. | | displayName | Name for the service account. | ## Configuring Complex Provisioning Policy Attributes The Google Workspace connector supports account provisioning with the following multi-valued complex attributes in JSON format: | Complex Attribute | Example JSON Input | | --- | --- | | emails | `{"address":"test1@google.com","type":"other"}` | | organizations | `{"name":"Sailpoint","title":"SysAdmin", "type":"work", "customType":"","department":"DP Operations","location":"Pune"}` | | phones | `{"value":"9876123345","type":"mobile"}` | | relations | `{"value":"David","type":"brother"}` | | addresses | `{"type":"work","streetAddress":"123 James street","locality":"Domino Park","region":"Lake Side","primary":true,"countryCode":"US"}` | | externalIds | `{"value":"1234","type":"account"}` | | ims | `{"type":"home","protocol":"gtalk","im":"12345","primary":true}` | | locations | `{"area": "Mountain View", "buildingId": "D1", "deskCode": "Desk1", "floorName":"First Floor", "floorSection":"B", "type":"desk"}` | If you need to set multiple values, separate each value in the JSON input with a comma. For example: ```text {"address":"user1@google.com","type":"home"}, {"address":"test1@google.com","type":"other"} ``` The Google Workspace connector supports the `aliases` multi-valued attribute. Aliases are the user's alias email addresses. The values can be a string or a list of email addresses. The connector also supports special characters in email addresses for entitlement operations. > [!NOTE] > > Ensure that complex attributes are multi-valued in the account schema and provisioning policy. Refer to [REST Resource: users]() in the Google Workspace documentation for more information on JSON representation of complex attributes and values. The Google Workspace API does not support adding or removing multiple aliases in a single call, so the connector needs a list of values to iterate over each one. The connector requires a Before Provisioning Rule to create a provisioning plan that ensures the alias values are in list format. The following provisioning plan example adds or removes multiple aliases: ```text { "ProvisioningPlan": { "AccountRequest": { "AttributeRequest": { "Value": { "List": { "String": [ "GoogleWorkspace1222@example.com", "GoogleWorkspace12230@example.com" ] } }, "name": "aliases", "op": "Set" }, "application": "Google workspace", "nativeIdentity": "11234567890", "op": "Modify" }, "nativeIdentity": "Test.google", "targetIntegration": "Google workspace" } } ``` To add or remove a single alias, use the string format: ```text { "AttributeRequest": { "name": "aliases", "op": "Set", "value": "GoogleWorkspace1222@example.com" } } ``` # Schema Reference The application schema is used to configure the objects returned from a connector. > [!NOTE] > > - The **Account Schema** tab is used to define the attributes for each object type in the application being configured. The schema attributes can be defined as **Entitlement** or **Multi-Valued**. Refer to [Managing Source Account Schemas]() for more information. > - The schema attributes that are not present by [default](<#default-account-schema>) must be defined as strings if not specified. The Google Workspace connector uses the following default correlation and object configurations. This connector currently supports the following types of objects: - Account - Account objects are used when building identity Link objects. - Group - Used to build AccountGroup objects that hold entitlements shared across identities. - Role - Used to build Account-Role objects that hold entitlements shared across identities. - IAM Role - Used to represent GCP IAM roles. - IAM Resource Permission - Used to represent GCP permissions over resources. - Folder - Used to represent GCP folders. - Project - Used to represent GCP projects. ## Default Correlation Configuration Before you aggregate accounts from this source, you can map account attributes with their corresponding identity attributes based on your requirements. You can customize the correlation configuration. Refer to [Assigning Source Accounts to Identities]() for more information. When you first create the Google Workspace source, the default correlation mapping is: | Identity Attribute | Operation | Account Attribute | | --- | --- | --- | | Work Email | Equals | primaryEmail | You can modify the correlation configuration in accordance with your requirements. ## Default Account Schema Each source supports a variety of details, or attributes, about each user who has an account, such as their name, email address, manager name, and location. The set of account attributes each source stores and how they're organized is known as the account's *schema*. To best represent your data, you can configure sources to use an account schema matching the one you use in the external connector. Refer to [Managing Source Account Schemas]() for more information. ### Default Account ID SailPoint requires that certain attributes remain in your configuration. These attributes are referred to as *account IDs*. > [!CAUTION] > > Changing the attribute marked as the account ID after aggregating accounts can result in duplicate accounts being created. To avoid this, either reset the accounts on this source before editing the account ID attribute or edit the account ID attribute before aggregating accounts. > > To resolve issues caused by changing account IDs, reconfigure them to their default values. The following table lists the default account IDs for this connector: | Account ID | Schema Object Type | | --- | --- | | objectID | `Account` | | objectID | `Group` | | objectID | `Role` | | name | `iamRole` | | objectID | `iamresourcePermission` | | objectID | `folder` | | objectID | `project` | ### Default Account Attributes The Google Workspace connector supports the following default account schema attributes and customer configurable attributes. The attributes must be defined as strings if not specified. > [!NOTE] > > To aggregate the Delegated Administrators, add the `delegatedadmins` attribute (supported with Service Account Authorization only) to the account schema manually. | Attribute Name | Description | | --- | --- | | objectID | Unique ID of the user. This is an Account ID which must not be changed. | | primaryEmail | User's primary email ID. The email ID domain must be a valid domain accessible to the service account provided in application configuration. | | name | User's full name. | | isAdmin | Indicates if a user is an administrator. | | isDelegatedAdmin | Indicates if a users is a delegated administrator. | | lastLoginTime | User's last login time. | | suspended | User's suspension status. | | suspensionReason | Reason for suspension. | | changePasswordAtNextLogin | Indicates if the user is required to change their password the next time they log in. | | ipWhiteListed | Indicate if user's IP address is whitelisted. | | ims | The user's Instant Messenger (IM) accounts. | | emails | A list of the user's email addresses. | | externalIds | A list of external IDs for the user, such as an employee or network ID. | | relations | A list of the user's relationships to other users. | | addresses | A list of the user's addresses. | | organizations | A list of organizations the user belongs to. | | phones | A list of the user's phone numbers. | | aliases | A list of the user's alias email addresses. | | nonEditableAliases | A list of the user's non-editable alias email addresses. | | customerId | The customer ID to retrieve all account users. | | orgUnitPath | The full path of the parent organization associated with the user. | | isMailboxSetup | Indicates if the user's Google mailbox is created. | | includeInGlobalAddressList | Indicates if the user's profile is visible in the Global Address List when the contact sharing feature is enabled for the domain. | | thumbnailPhotoUrl | URL used to set the user's thumbnail photo. | | contacts | A list of the user's contacts. | | givenName | User's first name. | | familyName | User's last name. | | delegatedAdmins | Delegated administrators of a user. | | Groups | Groups connected to the user. | | customSchemas | Aggregates custom schema attributes. | | Roles | Roles connected to the user. | | objectType | Object type of the account. | | domainName | The domain name of the customer. | | domainAliases | A list of domain alias. | | isPrimary | Indicates if the domain is a primary domain. | | verified | Indicates the verification state of a domain. | | projectId | The ID of the project that owns the service account. | | uniqueId | The unique and stable numeric ID for the service account. | | displayName | Name for the service account. | | description | Description for the service account. | | serviceAccountId | Account ID of service account. | | resourcePermissions | IAM resource permissions assigned to the user. | | archived | Indicates if a user is archived. Enable to archive the user.

**Important:** If you are updating from a version prior to SailPoint version SC 109.0, you must manually add this attribute to your schema attribute list. | ## Default Entitlement Attributes Entitlement attributes define the entitlements, such as groups or roles, that can be assigned to the managed system's user accounts. Refer to [Managing Entitlements]() for more information. > [!CAUTION] > > Changing the attribute marked as the Entitlement ID after aggregating accounts or entitlements can result in duplicate entitlements being created, or access profiles and roles breaking. To avoid this, edit the entitlement schema before performing any aggregations. ### Default Group Attributes The Google Workspace connector also supports groups. The following attributes must be configured on the managed system and in the SailPoint source schema to manage groups. > [!NOTE] > > To aggregate the `MANAGERS` and `OWNERS` attributes, add them to the group schema manually. | Attribute Name | Description | | --- | --- | | objectID | The group's unique ID. This is an Account ID which must not be changed. | | name | Name of the group. | | nonEditableAliases | List of the group's non-editable alias email addresses that are outside of the account's primary domain or sub domains. These are functioning email addresses used by the group. This is a read-only property. | | description | Description of the group. | | adminCreated | Whether it is created by administrator. | | aliases | Group aliases. | | email | Group email address. | | directMembersCount | Number of group members. | | whoCanJoin | Permissions to join the group. Available values: `ALL_IN_DOMAIN_CAN_JOIN` - Anyone in the account can join; `ANYONE_CAN_JOIN` - Anyone outside your domain can join; `CAN_REQUEST_TO_JOIN` - Non group members can request an invitation to join; `INVITED_CAN_JOIN` - Candidates for membership can be invited to join. | | whoCanViewMembership | Permissions to view membership. Available values: `ALL_IN_DOMAIN_CAN_VIEW` - Anyone in the account can view the group members list; `ALL_MANAGERS_CAN_VIEW` - The group managers can view group members list; `ALL_MEMBERS_CAN_VIEW` - Group members can view the group members list. | | whoCanViewGroup | Permissions to view group. Available values: `ALL_IN_DOMAIN_CAN_VIEW` - Anyone in your account can view this group's messages; `ALL_MANAGERS_CAN_VIEW` - Any group manager can view this group's messages; `ALL_MEMBERS_CAN_VIEW` - All group members can view the group's messages; `ANYONE_CAN_VIEW` - Any Google Workspace user can view the group's messages. | | whoCanInvite | Permissions to invite members. Available values: `ALL_MANAGERS_CAN_INVITE` - Only managers can invite a new member. This includes the group's owner; `ALL_MEMBERS_CAN_INVITE` - Managers and members can invite a new member candidate. | | allowExternalMembers | A Boolean indicating if Google Workspace users external to your account can view or become members of this group. | | MANAGERS | Managers of a group. | | OWNERS | Owners of a group. | | whoCanPostMessage | Permissions to post messages to the group. Available values: `ALL_IN_DOMAIN_CAN_POST` - Anyone in the account can post a message; `ALL_MANAGERS_CAN_POST` - Managers, including group owners, can post messages; `ALL_MEMBERS_CAN_POST` - Any group member can post a message; `ANYONE_CAN_POST` - Any Google Workspace user outside the account can access the Google Groups service and post a message; `NONE_CAN_POST` - The group is disabled and archived. No one can post a message to this group. | | allowWebPosting | A Boolean indicating if any member is allowed to post to the group web forum. | | primaryLanguage | Language tag for a group's primary language. | | maxMessageBytes | The maximum size of a message. | | isArchived | A Boolean indicating if the contents of the group to be archived. | | archiveOnly | A Boolean indicating if the group is to be only archived. | | messageModerationLevel | Moderation level for messages. Available values: `MODERATE_ALL_MESSAGES` - All messages are approved by the owner before they are sent to the group; `MODERATE_NEW_MEMBERS` - All messages from new members are approved by the owner before they are sent to the group; `MODERATE_NONE` - No moderator approval is required; `MODERATE_NON_MEMBERS` - All messages from non-group members are approved by the owner before they are sent to the group. | | spamModerationLevel | Moderation levels for detecting messages as spam. Available values: `ALLOW` - Post the message to the group; `MODERATE` - Send the message to the moderation queue; `SILENTLY_MODERATE` - Send the message to the moderation queue, but do not send notification to moderators; `REJECT` - Immediately reject the message. | | replyTo | The default reply to a message is sent here. Available values: `REPLY_TO_CUSTOM` - For replies to messages, use the group's custom email address; `REPLY_TO_IGNORE` - Group users individually decide where the message reply is sent; `REPLY_TO_LIST` - Reply message is sent to the group; `REPLY_TO_MANAGERS` - Reply message is sent to the group's managers; `REPLY_TO_OWNER` - Reply is sent to the owner(s) of the group; `REPLY_TO_SENDER` - Reply is sent to the author of message. | | customReplyTo | An email address used when replying to a message. | | sendMessageDenyNotification | A Boolean indicating if the members are notified if a message is denied by owner. | | defaultMessageDenyNotificationText | Text sent to the message's author as part of rejection notification. | | showInGroupDirectory | A Boolean indicating if group is listed in the Groups directory. | | allowGoogleCommunication | A Boolean allowing Google to contact group administrators. | | membersCanPostAsTheGroup | A Boolean indicating if members can post using the group email address. | | messageDisplayFont | Default message's display font. Available values: `DEFAULT_FONT` - Uses the account's default font; `FIXED_WIDTH_FONT` - Uses fixed width font. | | includeInGlobalAddressList | A Boolean indicating if the group is included in the [Global Address List](). | | resourcePermissions | IAM resource permissions assigned to the group. | ### Default Role Attributes The Google Workspace connector supports roles. The following attributes must be configured on the managed system and in the SailPoint source schema to manage roles. | Attribute Name | Description | | --- | --- | | objectID | The role's unique ID. This is an Account ID which must not be changed. | | roleName | Name of the role. | | roleDescription | Description of the role. | | rolePrivileges | Privileges of the role, a multivalued attribute. Available values: `GROUPS_ALL`; `APP_ADMIN`. | | isSystemRole | Indicates if the role is a system role. | | isSuperAdminRole | Indicates if the role is a Super Admin role. | ### IAM Role Attributes The following lists the IAM role attributes: | Attribute Name | Description | | --- | --- | | name | Name of the IAM role. This is an Account ID which must not be changed. | | description | A description for the IAM role. | | title | A title for the role. | | includedPermissions | The names of the permissions this IAM role grants when bound in an IAM policy. | | stage | The current launch stage of the IAM role. | | deleted | The current deleted state of the IAM role. | ### IAM Resource Permission Attributes The following lists the IAM resource permission attributes: | Attribute Name | Description | | --- | --- | | objectID | ID of the resource permission. This is an Account ID which must not be changed. | | displayName | Display name of the resource permission. This is a combination of the role display name and the resource display name. | | description | Description of the role associated with the resource permission. | | includedPermissions | Permissions over the resource included in the role. | | stage | Stage of the role associated with the resource permission. | | resourceName | Resource name associated with the resource permission. | | roleName | Role name associated with the resource permission. | | resourceType | Type of resource associated with the resource permission. | ### Default Folder Attributes The following lists the folder attributes: | Attribute Name | Description | | --- | --- | | objectID | ID of the folder in the format `folders/{numeric folder ID}`. This is an Account ID which must not be changed. | | name | The full resource name of the folder. | | assetType | Asset type of the GCP resource. | | displayName | Display name of the folder. | | location | Location of the folder. | | state | State of the folder. | ### Project Attributes The following lists the project attributes: | Attribute Name | Description | | --- | --- | | objectID | ID of the project in the format `projects/{alpha numeric project ID}`. This is an Account ID which must not be changed. | | name | The full resource name of the project. | | assetType | Asset type of the GCP resource. | | displayName | Display name of the project. | | labels | Labels used by the project. This attribute is multi-valued and must be manually added to the project schema in existing sources. | | location | Location of the project. | | state | State of the project. | | tags | Tags used by the project. This attribute is multi-valued and must be manually added to the project schema in existing sources. | ## Custom Schema Attributes The Google Workspace connector supports aggregation of custom schema attributes by adding the schema attributes in the following format: ```text customSchemas.SCHEMANAME.FIELDNAME ``` For example, if the custom schemas are as follows: ```text customSchemas = {SSO {"ADID":"101", "SAPID":"102"}, Address {"Postal_Code":"411018"}} ``` To display the attributes of the above custom schemas, you must add the following attributes in account schema: ```text customSchemas.SSO.ADID customSchemas.SSO.SAPID customSchemas.Address.Postal_Code ``` > [!NOTE] > > A schema cannot contain another schema within a managed system as follows: > > ```text > customSchemas= {SSO{Address{"Postal_Code":"411018"}}} > ``` > > The connector does not support managing multi-level custom attributes defined in Google Workspace. Multi-level custom attributes are used if you have a schema defined inside a custom schema. The name of the custom schema attribute must be the same as defined in the account schema. To add a custom schema attribute to the provisioning policy, it must also be present in the account schema. To support custom attribute provisioning, add the custom attribute names to the provisioning policy as described below: ```text customSchemas.. ``` For more information on adding an attribute to schema, refer to [Adding Attributes to a Source Schema](). For the Custom Schema attributes the Google Workspace source supports single valued and multi-valued attribute only. Provisioning of multilevel custom schema attributes is not supported. ## Using Multiple Group Entitlements with a Preexisting Connector To start using Multiple Group Entitlements with preexisting Google Workspace connectors, complete the following steps: 1. Use the `createSchema` API to create new group schema for your source. For more information refer to [Create Schema on a Source](). The following is an example of API body content used to add Project Roles to an existing source. ```text Example ------------------------ iamResourcePermission START ------------------------ { "nativeObjectType": "iamResourcePermission", "identityAttribute": "objectID", "displayAttribute": "displayName", "hierarchyAttribute": null, "includePermissions": false, "features": \[\], "configuration": {}, "attributes": \[ { "name": "objectID", "type": "STRING", "schema": null, "description": "Id of resource permission.", "isMulti": false, "isEntitlement": false, "isGroup": false }, { "name": "displayName", "type": "STRING", "schema": null, "description": "Display name of resource permission is combination of role dispaly name and resource display name.", "isMulti": false, "isEntitlement": false, "isGroup": false }, { "name": "description", "type": "STRING", "schema": null, "description": "Description of role associated with reource permission.", "isMulti": false, "isEntitlement": false, "isGroup": false }, { "name": "includedPermissions", "type": "STRING", "schema": null, "description": "Permission over the resource include in role.", "isMulti": true, "isEntitlement": false, "isGroup": false }, { "name": "stage", "type": "STRING", "schema": null, "description": "Stage of the role associated with resource permission.", "isMulti": false, "isEntitlement": false, "isGroup": false }, { "name": "resourceName", "type": "STRING", "schema": null, "description": "Resource name associated with the resource permission.", "isMulti": false, "isEntitlement": false, "isGroup": false }, { "name": "roleName", "type": "STRING", "schema": null, "description": "Role name associated with the resource permission.", "isMulti": false, "isEntitlement": false, "isGroup": false }, { "name": "resourceType", "type": "STRING", "schema": null, "description": "Type of the resource associated with the resource permission.", "isMulti": false, "isEntitlement": false, "isGroup": false } \], "name": "iamResourcePermission" } ------------------------ iamResourcePermission END ------------------------ ------------------------ iamRole START ------------------------ { "nativeObjectType": "iamRole", "identityAttribute": "name", "displayAttribute": "title", "hierarchyAttribute": null, "includePermissions": false, "features": \[\], "configuration": {}, "attributes": \[ { "name": "name", "type": "STRING", "schema": null, "description": "Name of the IAM role.", "isMulti": false, "isEntitlement": false, "isGroup": false }, { "name": "description", "type": "STRING", "schema": null, "description": "A human-readable description for the IAM role.", "isMulti": false, "isEntitlement": false, "isGroup": false }, { "name": "title", "type": "STRING", "schema": null, "description": "A human-readable title for the role.", "isMulti": false, "isEntitlement": false, "isGroup": false }, { "name": "includedPermissions", "type": "STRING", "schema": null, "description": "The names of the permissions this IAM role grants when bound in an IAM policy.", "isMulti": true, "isEntitlement": false, "isGroup": false }, { "name": "stage", "type": "STRING", "schema": null, "description": "The current launch stage of the IAM role.", "isMulti": false, "isEntitlement": false, "isGroup": false }, { "name": "deleted", "type": "BOOLEAN", "schema": null, "description": "The current deleted state of the IAM role.", "isMulti": false, "isEntitlement": false, "isGroup": false } \], "name": "iamRole" } ------------------------ iamRole END ------------------------ ------------------------ folder START ------------------------ { "nativeObjectType": "folder", "identityAttribute": "objectID", "displayAttribute": "displayName", "hierarchyAttribute": null, "includePermissions": false, "features": \[\], "configuration": {}, "attributes": \[ { "name": "objectID", "type": "STRING", "schema": null, "description": "Id of the folder in the format folders/{numeric folder id}.", "isMulti": false, "isEntitlement": false, "isGroup": false }, { "name": "name", "type": "STRING", "schema": null, "description": "The full resource name of folder.", "isMulti": false, "isEntitlement": false, "isGroup": false }, { "name": "assetType", "type": "STRING", "schema": null, "description": "Asset Type of the GCP resource.", "isMulti": false, "isEntitlement": false, "isGroup": false }, { "name": "displayName", "type": "STRING", "schema": null, "description": "Display name of the folder.", "isMulti": false, "isEntitlement": false, "isGroup": false }, { "name": "location", "type": "STRING", "schema": null, "description": "Location of the folder.", "isMulti": false, "isEntitlement": false, "isGroup": false }, { "name": "state", "type": "STRING", "schema": null, "description": "State of the folder.", "isMulti": false, "isEntitlement": false, "isGroup": false } \], "name": "folder" } ------------------------ folder END ------------------------ ------------------------ Project START ------------------------ { "nativeObjectType": "project", "identityAttribute": "objectID", "displayAttribute": "displayName", "hierarchyAttribute": null, "includePermissions": false, "features": \[\], "configuration": {}, "attributes": \[ { "name": "objectID", "type": "STRING", "schema": null, "description": "Id of the project in the format projects/{alpha numeric project id}.", "isMulti": false, "isEntitlement": false, "isGroup": false }, { "name": "name", "type": "STRING", "schema": null, "description": "The full resource name of project.", "isMulti": false, "isEntitlement": false, "isGroup": false }, { "name": "assetType", "type": "STRING", "schema": null, "description": "Asset Type of the GCP resource.", "isMulti": false, "isEntitlement": false, "isGroup": false }, { "name": "displayName", "type": "STRING", "schema": null, "description": "Display name of the project.", "isMulti": false, "isEntitlement": false, "isGroup": false }, { "name": "location", "type": "STRING", "schema": null, "description": "Location of the project.", "isMulti": false, "isEntitlement": false, "isGroup": false }, { "name": "state", "type": "STRING", "schema": null, "description": "State of the project.", "isMulti": false, "isEntitlement": false, "isGroup": false } \], "name": "project" } ------------------------ Project End ------------------------ ------------------------ Role Start ------------------------ { "nativeObjectType": "Role", "identityAttribute": "objectID", "displayAttribute": "roleName", "hierarchyAttribute": null, "includePermissions": false, "features": \[\], "configuration": {}, "attributes": \[ { "name": "objectID", "type": "STRING", "schema": null, "description": "Role Id of role.", "isMulti": false, "isEntitlement": false, "isGroup": false }, { "name": "roleName", "type": "STRING", "schema": null, "description": "Name of the role.", "isMulti": false, "isEntitlement": false, "isGroup": false }, { "name": "roleDescription", "type": "STRING", "schema": null, "description": "Description of role.", "isMulti": false, "isEntitlement": false, "isGroup": false }, { "name": "rolePrivileges", "type": "STRING", "schema": null, "description": "Privileges of the role.", "isMulti": true, "isEntitlement": false, "isGroup": false }, { "name": "isSystemRole", "type": "STRING", "schema": null, "description": "Is System Role.", "isMulti": false, "isEntitlement": false, "isGroup": false }, { "name": "isSuperAdminRole", "type": "STRING", "schema": null, "description": "Is Super Admin Role.", "isMulti": false, "isEntitlement": false, "isGroup": false } \], "name": "Role" } ------------------------ Role END ------------------------ ``` 2. Update the account schema using the following steps: 1. Get account schema using the `getSchema` API. For more information, refer to [Get Source Schema by ID.]() 2. Copy the schema to a file and search for the attribute corresponding to the group schema added in step 1. 3. Add/ Update the following two properties for the attribute you find: ```text "isGroup": true, ``` ```text "schema": {"type": "CONNECTOR_SCHEMA","id": "\","name": "\"} ``` 4. Add the modified schema to the payload to update account schema in source using the `replaceSchema` API. For more information, refer to [Update Source Schema (Full)](). # Migrate VA-based Source to a SaaS Source Some sources that are connected to virtual appliance (VA) clusters can be migrated to SaaS connections. This ensures data (users and entitlements) remain intact and can maintains your source configurations like access profiles, roles, password settings, and correlation configurations when switching from a VA cluster to a SaaS connection. To migrate a source from a VA-based source to a SaaS source, you will provide configuration details on a draft version of the source before publishing the source. > [!NOTE] > > - You must have an Admin or Source Admin user level to migrate a source. A draft version of the source is created. As your migration process is in progress the live source will continue to work as it is. For more information on the Google Workspace SaaS connector, refer to the [Google Workspace SaaS Supported Features](). ## Important Considerations Before Migrating - You do not need to edit additional configurations (other than connection credentials) to migrate the source. - If your source migration is in progress, please do not make any configuration changes to your live source as those can be overwritten once you apply the migration your draft version. - Once you've gone ahead with your migration, it can't be rolled back. Your source is permanently migrated to a SaaS source. - Any preview operations or configuration changes on the draft source will not impact the live source until you apply the migration. ## Migrating Sources To migrate your source, complete the following: 1. Go to **Admin \> Connections \> Sources**. 2. Select or edit the VA-based source you want to migrate. 3. Open the source configuration, and select **Migrate to SaaS**. 4. When prompted, select **Continue**. A draft version of the source is created. The live source will continue to work. 5. Select **Connection Settings**. 6. Re-enter encrypted configuration details. For example, you might need to re-enter the Client Secret, Password, Refresh Token, Personal Access Token (PAT), or Certificates to migrate from the VA cluster to the SaaS connection. > **Important** > > Avoid editing the other configuration options in the draft source. 7. Select **Review and Test**. 8. Select **Test Connection**. 9. (Optional) Select **Accounts**. If you successfully tested your connection in **Review and Test**, you can select **Preview** to display a subset of accounts from the application that will be mapped to SailPoint identities. This can help ensure you are accurately connecting identity data from the application with SailPoint identities. 10. (Optional) Select **Entitlements**. If you successfully tested your connection in **Review and Test** and your source type supports entitlement type configuration, you can select **Preview** to view a preview of entitlements using the current configuration settings. 11. When you've finished reviewing your changes and successfully tested your connection, select **Apply Migration**. Your changes will be applied to the live source and the draft source will be deleted. ## Viewing Source Migration Status You can view the status and creation date of draft sources. 1. Go to **Admin \> Connections \> Sources \> Source Migration Status**. 2. Select **Source Migration Status**. 3. To view or edit the draft source, select **Actions** ![]() **\> Preview** on the draft source. 4. To delete the draft source, select **Actions** ![]() **\> Delete** on the draft source. # Supported Features and Prerequisites ## Supported Features The SailPoint Google Workspace connector supports the following features: > [!IMPORTANT] > > You must purchase a SailPoint Cloud Infrastructure Entitlement Management (CIEM) license to enable Google Cloud Platform (GCP) features. Contact your SailPoint Customer Success Manager for more information and to request access. > [!NOTE] > > Before you can use an item marked with an asterisk (\*), SailPoint must activate the feature for your site. - Aggregation of Google Workspace accounts (user, service account, domain) - \*Provisioning of Google Workspace accounts (user, service account, domain) - \*Access Certifications (certification of entitlements connected to accounts) - Delta Aggregation - HTTP and HTTPS proxy configurations - Archive and unarchive Google Workspace users - Delete Accounts - Filtering of user records during full and delta aggregation. Refer to [Advanced Settings]() for more information. > [!NOTE] > > Archive and unarchive features apply only to Google Workspace users from the managed system. They do not apply to other account types. ### Multiple Account Type Support The following table details the supported feature set for each account type: | Feature | Google Workspace User/Cloud Identity | Service Account | Domain | | --- | --- | --- | --- | | Aggregate | Yes | Yes | Yes | | Create | Yes | Yes | Yes | | Password Management | Yes | N/A | N/A | | Enable and Disable | Yes | Yes | N/A | | Group Entitlements (Read, Request, and Revoke) | Groups, roles, and resource permission | Resource permission | Resource permission | | Archive and Unarchive | Yes | N/A | N/A | ### Group Entitlements SailPoint is capable of aggregating additional details of Group Entitlements from the managed system. These objects have a separate schema which defines a list of attributes. Aggregation tasks fetch the defined attributes as additional details when it runs aggregation processes for a specific Group Entitlement type. Supported Google Workspace objects include: - Groups - Roles - Resource Permissions > [!NOTE] > > Only Group, Role, and Resource Permissions can be requested as multiple group entitlements. Supported GCP objects include: - IAM Roles - Projects - Folders - Resource Permissions Google Workspace Groups are both accounts and entitlements in GCP support. GCP entitlement resource permissions can be assigned to Google Workspace Groups. #### Support for Managing Google Cloud Objects The Google Workspace connector can manage the following Google Cloud objects: - Google Accounts (Google Workspace Identities and managed Cloud Identities only) - Service Accounts - Domains (Google Workspace or Cloud Identity Domain) - Google Groups #### Supported Authentication Methods The Google Workspace connector supports the following authentication and authorization methods: - Client Credentials (OAuth 2.0 for Web Server Applications) - Service Account (OAuth 2.0 for Server to Server Applications) #### Support for Multiple Group Objects The Google Workspace connector supports multiple group objects. Entitlement aggregation is supported for the following: - Groups - Roles - IAM Roles - Projects - Folders - Resource Permissions ### Privilege Classification SailPoint Privilege Classification helps organizations systematically categorize and manage the privilege levels of entitlements within their sources. By classifying entitlements as high, medium, or low, administrators can better understand the potential risk and impact associated with specific access rights. This allows automatic assignment of privilege levels based on system recommendations, custom-defined criteria, or a same level across all entitlements. | Privilege Level | Description | | --- | --- | | High | Administrative level access to accounts | | Medium | Administrative level access for a specific role or function | | Low | Only basic access of data | > [!NOTE] > > To manage Privilege Classification, users must have administrative roles such as Org Admin, Source Admin or Source Sub-Admin. For more information, refer to [Managing Privilege Classification](). ### Supported Features Comparison with Cloud Governance > [!IMPORTANT] > > To enable additional cloud governance features (for example, visualization of effective access) for your GCP Cloud Infrastructure, you must have a CIEM license. If you already have a Cloud Access Management license, no additional license purchase is required. Contact your SailPoint Customer Success Manager to request access and for more information. | Supported Features | Google Workspace Connector (Standard Features) | Google Workspace Connector (with Cloud Governance) | | --- | --- | --- | | Account Management:
Manage Google Workspace Users as Accounts
Aggregate, Refresh Accounts, Aggregate and Provision Custom Schema Attributes
Create, Update, Delete
Enable, Disable, and Change Password
Add and Remove Entitlements
Manages Delegated Administrators and Alias on Accounts
Move User to Other Organization Unit | Yes | Yes | | GCP Accounts:
Service Account
Domain (Google Workspace or Cloud Identity Domain) | No | Yes | | Group Management:
Manage Google Workspace Groups as Account - Groups
Aggregate and Refresh Group | Yes | Yes | | Role Management:
Manage Google Workspace Roles as Account - Roles
Aggregate and Refresh Roles | Yes | Yes | | IAM Role Management:
Manage GCP IAM Roles as IAMRole
Aggregate and Refresh Role | No | Yes | | Project Management:
Manage GCP Project as Project
Aggregate and Refresh
Manages Delegated Administrators (Supported with Service Account Authorization Only) and Alias on Accounts | No | Yes | | Folder Management:
Manage GCP Folder as Folder
Aggregate and Refresh | No | Yes | | IAM Resource Permission Management:
Manage GCP Resource Permission as iamResourcePermission
Aggregate and Refresh | No | Yes | ### Password Management If Password Management is enabled for your organization, you can change the password for a user of the source. After enabling password management on the source, be aware of the following: - The password policy defined in SailPoint applies to accounts on this source. - If you change the password for an application connected to this source, the change will automatically be made to the source itself. For more information on configuring password management, refer to [Password Management Overview](). ## Prerequisites - A working instance of Google Workspace. - Configure at least one virtual appliance cluster and successfully test the connection. Refer to the [Virtual Appliance Reference Guide]() for more information. ### OAuth 2.0 Authentication Methods The Google Workspace connector uses the OAuth 2.0 protocol for API authentication and authorization, supporting the following two scenarios: - Client Credentials (OAuth 2.0 for Web Server Applications) - Service Account (OAuth 2.0 for Server to Server Applications) > **Note** > > SailPoint's Cloud Infrastructure Entitlement Management (CIEM) only supports Service Account as a grant type. Refer to [Service Account Authentication Settings]() for more information. #### API Access Permissions via Roles API access permissions are assigned to the Google Workspace user via roles, based on the type of credentials used: - Client Credentials - API access is performed on behalf of the Google Workspace user under whose context the credentials are generated. This user provides consent while generating the refresh token. Refer to [Required Roles for Google Workspace and GCP Management](<#required-roles-for-google-workspace-and-gcp-management>) for more information. - Service Account - API access is performed on behalf of an impersonating user. The roles assigned to the impersonating user take priority over the roles assigned directly to the Service Account. Refer to [Required Roles for Google Workspace and GCP Management](<#required-roles-for-google-workspace-and-gcp-management>) for more information. Refer to [Generating OAuth 2.0 Credentials]() for information on generating Client Credentials and a Service Account. ### Required Roles for Google Workspace and GCP Management The required roles for Google Workspace User, Group, and Role management are: - For Google Workspace User and Groups Management - User Management Admin Role and Group Admin Role. - For Google Workspace Roles Management - Super Admin Role. The required GCP IAM roles for GCP management are: - Cloud Asset Viewer - Organization Role Administrator - Service Account Admin - Folder IAM Admin - Organization Administrator - Project IAM Admin - Super Admin Role (for IAM Role Management and Domain Management) The necessary granular permissions for the user can be assigned through Service Account Scopes and Built-In Roles for an Impersonated User, or Service Account Scopes and Custom Roles for an Impersonated User. #### Google Reference Documents > [!NOTE] > > The documents listed in this section are not managed by SailPoint and are subject to change without notice. Refer to the following resources for more information about the prerequisites: - [GCP Organization]() - [Admin SDK API]() - [Groups Settings API]() - [Identity and Access Management (IAM) API]() - [Cloud Resource Manager API]() - [Cloud Asset API]() # Enable Connector Logging This topic provides the steps needed to enable logging on SailPoint using REST APIs. > [!NOTE] > > This topic only applies to VA-based integrations. > [!NOTE] > > The examples provided might not match your configuration. Use the logging levels and logging classes reference at the bottom of the topic to configure your API responses to match your connector. This process is broken up into four steps: 1. Identify the Virtual Appliance (VA) cluster on which you want to enable logging. 2. Get the logging configuration for the existing VA cluster. 3. Update the VA cluster to enable logging levels. 4. Observe logging changes to the logging levels. ### Identify the Virtual Appliance Cluster Select the VA on which you need to enable logging using REST API. If you already know the VA application's `id`, proceed to [Get the Logging Configuration](<#get-the-logging-configuration>). 1. Make the following call to the REST API to return a list of available VA clusters: GET /v3/managed-clusters The REST API returns a response that looks similar to the following: ```json [ { "id": "2c9180866166b5b0016167c32ef31a66", "name": "Development Cluster", "description": "Development Cluster", "clientType": "CCG", "ccgVersion": "373_535_70.2.0", "pinnedConfig": true, "logConfiguration": null }, { "id": "2c9180846a93ce60016ab29f039944de", "name": "Cloud Cluster", "description": "Cloud Cluster", "clientType": "CCG", "ccgVersion": "373_535_70.2.0", "pinnedConfig": true, "logConfiguration": { "clientId": null, "durationMinutes": 60, "expiration": "2020-12-15T19:13:36.079Z", "rootLevel": "DEBUG", "logLevels": { "sailpoint.connector.ADLDAPConnector": "DEBUG" } } } ] ``` > **Note** > > The previous example code shows two VA clusters. One VA cluster has a log configuration and the other does not (refer to the `logConfiguration` value in each returned VA cluster). This is because one of the clusters already has logging enabled. This is just an example configuration, and your environment may not have logging enabled on a cluster. 2. Identify the VA cluster that you want to enable logging on by its name or description and record its `id` attribute. ### Get the Logging Configuration Get your selected VA's cluster logging configuration and identify the values you need to update. 1. Make the following call to the REST API to return the VA cluster's logging configuration. Replace `{id}` with the VA cluster's `id` attribute value recorded earlier. GET /v3/managed-clusters/{id}/log-config - If the VA doesn't have a logging configuration currently set, it returns `204 No Content` as a response. - If the VA has an existing logging configuration, it returns something similar to the following: ```json { "clientId": null, "durationMinutes": 60, "expiration": "2020-12-15T19:13:36.079Z", "rootLevel": "DEBUG", "logLevels": { "sailpoint.connector.ADLDAPConnector": "DEBUG" } } ``` You'll need to configure the following information in the response: - `durationMinutes` is the number of minutes logging should remain enabled. - `rootLevel` is the default level for all logs. For more information, refer to [Logging Levels](<#logging-levels>). - `logLevels` is a map object with logging classes as keys and logging levels as values. - For keys, refer to [Logging Classes](<#logging-classes>) for commonly used logging classes. - For a list of available values, refer to [Logging Levels](<#logging-levels>). ### Update Logging Configuration Update the VA cluster configuration returned by the REST API to update the logging settings as needed. 1. Make the following call to the REST API to update the VA cluster's logging configuration. Replace `{id}` with the VA cluster's `id` attribute value recorded earlier. PUT /v3/managed-clusters/{id}/log-config 2. Submit your configuration changes to the REST API in a JSON body. - If the VA cluster did not already have a logging configuration and you received a `204 No Content` response, you can create a new one. - If the VA returned a configuration, you can edit it to include the changes. The JSON body should be as follows: ```json { "durationMinutes": 60, "rootLevel": "DEBUG", "logLevels": { "sailpoint.connector.ADLDAPConnector": "DEBUG" } } ``` Consider the following as you edit the JSON: - `durationMinutes` is the number of minutes logging should remain enabled. - `rootLevel` is the default level for all logs. For more information, refer to [Logging Levels](<#logging-levels>). - `logLevels` is a map object with logging classes as keys and logging levels as values. - For keys, refer to [Logging Classes](<#logging-classes>) for commonly used logging classes. - For a list of available values, refer to [Logging Levels](<#logging-levels>). If the update was successful, the REST API should return a response similar to the following: ```json { "clientId": null, "durationMinutes": 60, "expiration": "2020-12-15T19:13:36.079Z", "rootLevel": "DEBUG", "logLevels": { "sailpoint.connector.ADLDAPConnector": "DEBUG" } } ``` ### Observe Logging Changes Approximately five minutes after you update the configuration, the VA cluster starts generating log files you can review. You can view the log files in **ccg.log**. ### References The tables in this reference section list information that can be helpful when creating the JSON body you'll use to configure the VA cluster's configuration file. #### Logging Levels | Logging Level | Description | | --- | --- | | ERROR | Designates error events that might still allow the connector to continue. | | WARN | Designates potentially harmful situations. | | INFO | Designates information messages that highlight process at a coarse-grain level. | | DEBUG | Very verbose. Fine grain logging levels used for development and debugging. | | TRACE | Most verbose. Finer grain logging levels than debugging. | #### Logging Classes | Connector | Logging Class | | --- | --- | | Active Directory | sailpoint.connector.ADLDAPConnector sailpoint.connector.LDAPConnector | | AIX | openconnector.connector.unix.AIXConnector openconnector.connector.unix.UnixConnector | | Amazon Web Services | logger.aws.name=openconnector.connector.aws logger.aws.level=trace logger.aws.additivity = false logger.aws.appenderRef.rolling.ref = STDOUT | | Atlassian Suite Cloud | sailpoint.connector.OpenConnectorAdapter openconnector.connector.atlassian.AtlassianConnector | | Atlassian Data Center | sailpoint.connector.OpenConnectorAdapter openconnector.connector.atlassian.AtlassianDataCenterConnector | | Microsoft Entra ID | sailpoint.connector.AzureADConnector | | Box | openconnector.connector.BoxNetConnector sailpoint.connector.OpenConnectorAdapter | | Cerner | openconnector.connector.CernerConnector sailpoint.connector.OpenConnectorAdapter | | Delimited File | logger.DelimitedFileConnector.name = sailpoint.connector.DelimitedFileConnector logger.DelimitedFileConnector.level = debug logger.DelimitedFileConnector.additivity = false logger.DelimitedFileConnector.appenderRef.rolling.ref = STDOUT | | Dropbox | openconnector.connector.DropBoxConnector sailpoint.connector.OpenConnectorAdapter | | Epic | openconnector.connector.EPICConnector sailpoint.connector.OpenConnectorAdapter | | GE Centricity | openconnector.connector.GECentricity sailpoint.connector.OpenConnectorAdapter | | Google Apps / G Suite | openconnector.connector.GoogleAppsDirect sailpoint.connector.OpenConnectorAdapter | | IBM i | openconnector.connector.IBMiConnector | | Lotus Domino | sailpoint.connector.LotusDomino | | JDBC | sailpoint.connector.JDBCConnector | | Sun One LDAP | sailpoint.connector.LDAPConnector | | Linux | openconnector.connector.unix.LinuxConnector sailpoint.connector.OpenConnectorAdapter sailpoint.connector.UnixConnector | | Microsoft Office365 | sailpoint.connector.Office365Connector | | Microsoft SQL Server | sailpoint.connector.mssql.serviceimpl.MSSQLServerConnectorV2 | | Okta | logger.openconnector.name = openconnector.connector.okta.OktaConnector logger.openconnector.level = debug logger.openconnector.additivity = false logger.openconnector.appenderRef.rolling.ref = STDOUT | | Oracle Database | sailpoint.connector.OracleDBConnector sailpoint.connector.JDBCConnector | | Oracle E-Business | sailpoint.connector.OracleEBSConnector sailpoint.connector.JDBCConnector | | Oracle Fusion HCM | openconnector.connector.oraclefusionhcm.OracleFusionHCMConnector sailpoint.connector.OpenConnectorAdapter | | Oracle HCM Cloud | sailpoint.connector.oraclehcmcloud.OracleHCMCloudConnector | | Oracle HRMS | sailpoint.connector.OracleAppsHRMSConnector sailpoint.connector.JDBCConnector | | Oracle Netsuite | openconnector.connector.netsuite.NetsuiteConnector | | PeopleSoft ERP | openconnector.connector.PeopleSoftConnector sailpoint.connector.OpenConnectorAdapter | | PeopleSoft HRMS | sailpoint.connector.PeopleSoftHRMSConnector | | RemedyForce | sailpoint.connector.ForceConnector | | RSA Authentication Manager | openconnector.connector.RSAConnector openconnector.connector.rsa.RSAHTTPClient sailpoint.connector.OpenConnectorAdapter | | Salesforce | sailpoint.connector.ForceConnector | | SAP Concur | openconnector.connector.sapconcur.SAPConcurConnector | | SAP - Direct | sailpoint.connector.SAPConnector sailpoint.connector.SAPInternalConnector | | SAP GRC | logger.SAPGRCConnector.name = sailpoint.connector.sapgrc logger.SAPGRCConnector.level = debug logger.SAPGRCConnector.additivity = false logger.SAPGRCConnector.appenderRef.rolling.ref = STDOUT | | SAP HR/HCM | sailpoint.connector.SAPHRInternalConnector | | SCIM 1.1 | openconnector.connector.SCIMConnector sailpoint.connector.OpenConnectorAdapter | | SCIM 2.0 | openconnector.connector.scim2.SCIM2Connector sailpoint.connector.OpenConnectorAdapter | | ServiceNow | openconnector.connector.servicenow.ServiceNowConnector openconnector.connector.servicenow.ServiceNowRestClient sailpoint.connector.OpenConnectorAdapter | | ServiceNow Service Desk Integration | openconnector.connector.servicedesk.ServiceNowServiceDeskConnector sailpoint.connector.OpenConnectorAdapter | | Siebel | openconnector.connector.SiebelConnector sailpoint.connector.OpenConnectorAdapter | | Snowflake | openconnector.connector.snowflake.SnowflakeConnector sailpoint.connector.OpenConnectorAdapter | | Solaris | openconnector.connector.unix.SolarisConnector openconnector.connector.unix.UnixConnector sailpoint.connector.OpenConnectorAdapter | | SuccessFactors | sailpoint.connector.SuccessFactorsConnector | | Sybase | sailpoint.connector.SybaseDirectConnector sailpoint.connector.JDBCConnector | | Webex | openconnector.connector.Webex sailpoint.connector.OpenConnectorAdapter | | Workday | openconnector.connector.WorkDay sailpoint.connector.OpenConnectorAdapter | | Workday Accounts | openconnector.connector.workdayaccounts openconnector.connector.workdayaccounts.WorkdayAccountsConnector sailpoint.connector.OpenConnectorAdapter | | Web Services | sailpoint.connector.WebServices | | XML | openconnector.connector.XMLConnector sailpoint.connector.OpenConnectorAdapter | | Yammer | openconnector.connector.YammerConnector sailpoint.connector.OpenConnectorAdapter | | Zoom | openconnector.connector.zoom.ZoomConnector sailpoint.connector.OpenConnectorAdapter | # Troubleshooting If you encounter any of the following issues or errors, SailPoint recommends that you follow the guidance provided below to resolve the error before contacting SailPoint Support. For issues or errors that are not addressed in this connector guide, refer to the following resources for troubleshooting information: - [SailPoint Identity Services Documentation]() - [SailPoint Support Knowledge Base]() - [SailPoint Developer Community]() ## Account Aggregation Fails **Issue**: The account aggregation may fail due to insufficient permissions or if required services are not turned on. **Resolution**: To test a GET user (read) using an Admin SDK Directory API from a browser, use the following URL, but replace `` and `` values: ```text https://www.googleapis.com/admin/directory/v1/users/?access_token= ``` ## Entitlement Aggregation Fails **Issue**: The entitlement aggregation fails due to insufficient permissions or if required services are not turned on. **Resolution**: To test a GET group (read) using an Admin SDK Directory API from a browser, use the following URL, but replace the `` and `` values: ```text https://www.googleapis.com/admin/directory/v1/groups/?access_token= ``` To test a GET group (read) using the Google Groups Settings API (Read Group Details - Y) from a browser, use the following URL but replace the `` and `` values: ```text https://www.googleapis.com/groups/v1/groups/?access_token= ``` ## Internal Server and Service Unavailable Error **Issue**: The Internal Server and Service Unavailable error messages are sent by the Google Server. **Resolution**: To retry the request, use the `maxReadRetryCount` attribute. The retry count is set to 5 by default. Retry is performed using the standard Exponential Backoff strategy. Increase the retry count by adding the `maxReadRetryCount` attribute with the REST API: - **key** - `connector_maxReadRetryCount` - **value** - enter the number of retry options, for example, 10 ## Poor Aggregation Performance **Resolution**: For the Google Workspace source, the performance of account aggregation and entitlement aggregation can be improved by deleting the following schema attributes: - `delegatedAdmins` - `MANAGERS` - `OWNERS` The `MANAGERS` and `OWNERS` attributes must be deleted in combination. Deleting the `MANAGERS` or `OWNERS` attribute alone does not improve performance. ## Entitlements Do Not Display Friendly Names **Issue**: During the initial account aggregation, any entitlement associated with the accounts is aggregated as a unique identifier. **Resolution**: Configure and perform an entitlement aggregation to bring in the friendly entitlement names. ## The Create Account Operation Fails Because of a Time Delay to Provide Account Details Through the APIs **Issue**: The following errors are encountered: ```text error code 412 "User creation is not complete" error code 404 "Object not found" ``` **Resolution**: Add the `createAccountTimelag` attribute in the connector. This attribute introduces a delay (default 0 seconds) after the Account Create operation so that subsequent operations such as assigning groups, aliases, and GET Object will not encounter errors. Add the `createAccountTimelag` attribute with a value of 20 seconds using the REST APIs. Refer to [Best Practices: REST API Authentication]() and [REST API - Update Source (Partial)](). ## 403 Error - Not Authorized to Access This Resource/API During Create Account Operation **Resolution**: Ensure that the domain name of the primary email of the user being created contains the correct domain name across which a set of credentials are created. Also ensure the domain name is configured the same as the domain in the application configuration. ## Account Aggregation Fails With an Object Not Found Error Message **Issue**: Account aggregation fails with the following error message: ```text ObjectNotFoundException ] [ Error details ] Service Account iteration failed. Error: 404 null : Requested entity was not found. ``` **Resolution**: By adding the `serviceAccountAggWithAssetInventory` attribute to the source, API calls to aggregate service accounts are executed through the Asset Inventory API instead of the service account List API (which, by default, also tries to fetch service accounts from deleted projects/folders). The downside is that the service account description and disabled attributes are not provided by the Asset Inventory API. Add the following using the REST APIs: ```text curl --location --request PATCH 'https://.api.cloud.sailpoint.com/v3/sources/{source ID}' \ --header 'Content-Type: application/json-patch+json' \ --header 'Authorization: Bearer tokenValue' \ --data-raw '[ { "op": "add", "path": "/connectorAttributes/serviceAccountAggWithAssetInventory", "value": true } ]' ``` > [!NOTE] > > For more information on SailPoint's REST APIs, refer to [Best Practices: REST API Authentication]() and [REST API - Update Source (Partial)]() in the SailPoint Developer Community. ## Google Cloud Asset Aggregation Fails With "Permission Denied" (403) **Issue**: Account aggregation fails with the error: ```text Failed to preload IAM Policy, Error: 403 null: The caller does not have permission. ``` This error typically occurs when the connector attempts to call the `searchAllIamPolicies` API, specifically when querying for domain resources. The API endpoint referenced in error: ```text https://cloudasset.googleapis.com/v1/organizations/672370982061:searchAllIamPolicies?query=resource:(cloudresourcemanager OR iam) AND policy:("user:" OR "serviceAccount:" OR "domain:") ``` By default, the connector attempts to retrieve cloud resources for service accounts, users, and domains. Aggregating domain resources requires additional Google Cloud scopes and permissions that may not be configured. **Resolution**: If domain management or aggregation is not necessary for your use case, you can disable domain aggregation to resolve the permission error. To do this, add the `gcpAccountTypes` attribute to your source configuration via the REST API. For example: ```text [ { "op": "add", "path": "/connectorAttributes/gcpAccountTypes", "value": ["serviceAccount", "user"] } ] ``` > [!NOTE] > > If domain aggregation is required, ensure that the necessary additional scopes and permissions are granted to the connector's service account or identity. Refer to [Service Account Scopes and Built-In Roles for an Impersonated User]() for the specific permissions needed to aggregate domain resources. ## Delta Aggregation Takes a Long Time to Complete **Resolution**: In delta aggregation, you get the changed user details using the audit change event API and then make a single API call per changed user, consuming more aggregation time. If there is a large number of changed users during delta aggregation, the delta aggregation time degrades. In this case, SailPoint recommends running full aggregation instead of delta aggregation. For example, if full aggregation takes 4 hours to complete and delta aggregation with 4,000-6,000 users takes the same amount of time or longer, use full aggregation. If there are fewer changes and delta aggregation takes only 30 minutes, use delta aggregation. > [!NOTE] > > SailPoint recommends using delta aggregation based on your use case. ## Failing to Generate an Access Token With the Service Account **Issue**: You receive the following error message: ```text Ensure configuration details are correct. [ Error details ] Failed to generate access token with service account. class org.bouncycastle.pkcs.PKCS8EncryptedPrivateKeyInfo cannot be cast to class org.bouncycastle.openssl.PEMKeyPair (org.bouncycastle.pkcs.PKCS8EncryptedPrivateKeyInfo and org.bouncycastle.openssl.PEMKeyPair are in unnamed module of loader 'app') ``` **Resolution**: Verify the private key creation steps. Refer to [Convert Service Account Private Key to RSA Format](). # Timeout Errors and Settings Timeout errors might occur when SailPoint is waiting for a response from the Virtual Appliance (VA). These errors are applicable to all connectors and tend to occur during the setup of sources or when sources are down. This document is designed to give specific information that can be used to resolve these errors. Each timeout attribute has a default time value that is listed in seconds or minutes. Increasing the time value may resolve the error as it will allow for longer communication time between the two systems, thus avoiding the timeout error. > [!IMPORTANT] > > Add the necessary attributes or values before performing the "replace" operation, as missing attributes will cause the operation to fail. To increase the communication time, increase the value of the appropriate timeout attribute. Then submit the change to the VA using the SailPoint REST API. > [!NOTE] > > For more information on SailPoint's REST APIs, refer to [Best Practices: REST API Authentication]() and [REST API - Update Source (Partial)]() in the SailPoint Developer Community. ### aggregateTimeout **Description:** This parameter is set for the aggregation timeout, measured in seconds. **Resolution:** Increase the `aggregateTimeout` value gradually to optimize aggregation. Start with 180, then increase to 600, 900, and finally 1800. The maximum value is 3600 seconds. For example: If your current time value is 180 seconds, update the `aggregateTimeout` attribute as follows: ```json [ { "op": "replace", "path": "/connectorAttributes/aggregateTimeout", "value": 600 } ] ``` ### healthCheckTimeout **Description:** This parameter is set for the test connection and health check timeout. **Resolution:** The default value is 30 seconds. If the timeout error continues, increase the value in 15 second increments and try again. For example: If your current time value is 30 seconds, update the `healthCheckTimeout` attribute as follows: ```json [ { "op": "replace", "path": "/connectorAttributes/healthCheckTimeout", "value": 45 } ] ``` ### provisioningTimeout **Description:** This parameter is set for provisioning timeout. **Resolution:** Increase the `provisioningTimeout` value gradually to optimize provisioning. Start with 180, then increase to 360, and finally 600. The maximum value is 600 seconds. For example: If your current time value is 180 seconds, update the `provisioningTimeout` attribute as follows: ```json [ { "op": "replace", "path": "/connectorAttributes/provisioningTimeout", "value": 360 } ] ``` ### timeout **Description:** This parameter is set for pass-through authentication timeout. **Resolution:** The default value is 15 seconds. If the timeout error continues, increase this value in 15 second increments and try again. For example: If your current time value is 15 seconds, update the `timeout` attribute as follows: ```json [ { "op": "replace", "path": "/connectorAttributes/timeout", "value": 30 } ] ``` ### apiTimeout **Description:** This parameter is set for API time tracking; customers can check it using an external tool. **Resolution:** The default value is 60 seconds. If the error continues, increase the value by 15 second increments and try again. For example: If your current time value is 60 seconds, update the `apiTimeout` attribute as follows: ```json [ { "op": "replace", "path": "/connectorAttributes/apiTimeout", "value": "75" } ] ``` ### timeoutInSeconds **Description:** This parameter helps prevent the VA from waiting indefinitely for an API response, ensuring efficient handling of API requests. For example: If your current time value is 30 seconds, update the `timeoutInSeconds` attribute as follows: ```json [ { "op": "replace", "path": "/connectorAttributes/timeoutInSeconds", "value": "15" } ] ```