Google Drive & G Suite Integration (Automated Account Linking)

Posted on 8th November 2016

Foldr can automatically associate an on-premise Active Directory user account with a user in Google G-Suite.  This allows the administrator to present a users personal Google Drive cloud storage and also Team Drives to users as soon as they sign in, removing the need for the user to link the account manually.

The automatic linking option works by mapping a predefined Active Directory attribute to provide access to the correct cloud storage account.  i.e. the Foldr appliance will match the user’s LDAP attribute (email address or UPN) to the user in the Google G-Suite domain.

Activating Automated Linking with Google Drive:

1. Browse to https://console.developers.google.com/apis using your administrative account.

2. Create a new project – Click Go to Project (top right) >> Create a Project

If desired, you can select the location of the app engine (Europe West, US etc.) to be used under Advanced

3. Active the Drive API

Click + Enable APIs and Services

Search for Google Drive and select it

Click the Enable button

4.  Create the Service Account Key

Within the project, go back to the API Manager screen >> Credentials >> Create Credentials >> Service Account Key

goolge-sa2

5. Enter a services account name and account ID and choose ‘Owner‘ as the Role type

goolge-sa3

6.  A private key file (.JSON) will be created and download to your local workstation. Save this file and keep it in a secure location.  (This file cannot be downloaded later)

google-sa-pk

 

7. Enable DwD (Domain-wide delegation) for the service account

Click Manage service accounts

goolge-sa4

Click Options >> Edit for the new service account key

goolge-sa5

Click SHOW DOMAIN-WIDE DELEGATION in the Service account details screen

Check ‘Enable G Suite Domain-wide Delegation’ and give the product a name for the OAuth consent screen if this hasn’t already been configured at step 1.

goolge-sa6

Check the box labelled ‘Enable G Suite Domain-wide Delegation’ and give the product a name for the consent screen if this hasn’t already been configured.

Click Save to confirm the changes.

7. Create the matching Google service account within Foldr Settings >> General >> Service Accounts

– Select Account Type as Google

– Enter a description and paste the content of the JSON private key into Account Key (JSON) – Typical settings to map users personal Google Drive shown (note user attribute = Email Address)

8. Changing the default background access mode from manual to automated

Within Foldr Settings >> Services >> Google G Suite – change the background account access mode to ‘Use Service Account’ and select the service account created at step 7.

google-link-mode

9. Allow Google service account (Client ID) permission to use Google APIs (Drive & Profile)

 Log in with an administrative account at https://admin.google.com and click Security

  

Click Advanced settings

 Click Manage API client access

Enter the Client Name string (found at console.developers.google.com > Project > API Manager > Credentials > OAuth 2.0 Client IDs

Enter the following API scope (note this is comma-delimited)

https://www.googleapis.com/auth/drive,profile

Finally, Click Authorize

The client name should then be displayed as shown

 10. Create a new global share within Foldr Settings >> Shares for Google Drive using the Google service account.

Note – Share URI (Path) is configured %googledrive%

goolge-sa11

Select the Google service account created earlier.

Note – The ‘Use service account for all access’ toggle must not be enabled in the Advanced tab.

12.   Changing the default background access mode from manual to automated.

Within Foldr Settings >> Services >> Google G Suite change the background account access mode to ‘Use Service Account’ and select the service account created at step 7.

The integration for automatic account linking with Google Drive is now complete.  When a user logs into Foldr using the web, mobile or desktop apps, they should see their own personal Drive under My Files.  Microsoft Office documents that are hosted on-premise or in Drive may be edited in place using G-Suite productivity apps which will save back to their original location once the user has finished editing.  As part of enabling the Google integration the user will now see a ‘Edit with Google G-Suite’ button in the Foldr web app for Office and G-Suite files.

The Windows and macOS desktop apps will allow users to edit G Suite files (Docs, Slides and Sheets) straight from Explorer / Finder.

Need more help?

Get in touch with our friendly help desk who will be happy to assist you, [email protected]