Skip to main content

Google Workspace SSO

Integrating Google Workspace SSO with Osano​

Connecting to Google Workspace SSO​

In order for Osano to discover data stored in your systems, we must connect to those data providers via an API. We require, at minimum, read-only access to establish a connection to these providers. Each provider you connect may require different information. Please see the linked vendor documentation for instructions on where and how to obtain this data.

This integration discovers the applications connected to your Google Workspace account. It supports SSO_SCAN only, with no user search or data deletion.

What Osano accesses​

Osano requests one read-only scope:

https://www.googleapis.com/auth/admin.reports.audit.readonly

With it, Osano reads these Google Reports API endpoints:

  • GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin
  • GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/saml
  • GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/token

Known limitations​

  • Google keeps activity reports for 6 months, so an application nobody has used or changed in that time may not appear.
  • An application that is rarely used may occasionally be missing from a scan and shown as inactive until it is used again. If it was mapped to a data store, map it again.
  • Renaming an application in Google shows up as a new application, so any data store mapping needs to be redone.
  • Google's own services, such as Gmail, Drive and Calendar, are not listed.
  • The list can include Google's own apps (such as Google Chrome) and Osano itself. Mark them as ignored if you do not need them.

We recommend comparing the application list in your Google Admin console with what Osano discovers, and adding anything missing by hand.

Prerequisites​

  • A Google Workspace administrator account with the Reports privilege. A super administrator also works, but is not required.
  • That account must have signed in at least once and accepted the Google Terms of Service.
  • No Google Cloud project, service account, key or domain-wide delegation is needed.
  • If your organization restricts third-party apps, a super administrator or an administrator with the Service Settings privilege must allow the Osano app once. See If your organization restricts third-party apps.

The connection uses the administrator you connect with. If that account is suspended or deleted, reconnect with another administrator.

Granting the Reports privilege​

  1. Sign in to the Google Admin console as a super administrator.
  2. Navigate to Account > Admin roles.
  3. Select the role held by the administrator, or create a new one.
  4. Click Privileges and enable Reports.
  5. Save, then assign the role to the administrator.

If your organization restricts third-party apps​

If your organization blocks apps an administrator has not reviewed, connecting shows an Access denied window instead of the consent screen. Allow the Osano app in one of two ways.

Option 1: request access

This works if Allow users to request access to unconfigured third-party apps is turned on under Security > Access and data control > API controls > Settings. Google Workspace for Education uses different request-access settings, so on an Education edition use Option 2.

  1. In the Access denied window, click Request access and submit the request.
  2. An administrator with the Service Settings privilege goes to Security > Access and data control > API controls > Manage App Access, and allows the Osano app under Apps pending review.
  3. Connect again from Osano.

Option 2: configure the app ahead of time

  1. As an administrator with the Service Settings privilege, go to Security > Access and data control > API controls > Manage App Access.

  2. Click Configure new app and search for Osano's OAuth client ID:

    721309378399-1pldgppmc8de8pc9q4rgurae9134llap.apps.googleusercontent.com

  3. Select the Osano app and choose Specific Google data with the scope above (recommended), or Trusted.

  4. Save, then connect from Osano.

Step by step guide​

  1. Access Data Mapping Settings:

    • Navigate to the Data Mapping page in the Osano application.
    • Select Sources from the left-hand navigation menu.

  2. Select SSO as Source type

  3. From the available SSO sources, select Google Workspace.

  4. Configure Google Workspace SSO Integration:

    • Click Connect and sign in to Google as an administrator with the Reports privilege.
    • Review the requested scope on the Google consent screen and click Allow.
    • Click Save.

  5. View Google Workspace SSO Integration:

    • Once saved, you will see your Google Workspace SSO integration in the list of configured SSO sources.

  6. Click into the Applications to view the applications that synced from Google Workspace.

  7. Create a new data store:

    • To proceed with creating a new data store, click on Review.
    • Follow the prompts to create a new data store.

Troubleshooting​

  • A message asks for an administrator with the Reports privilege. Grant the privilege as described in Granting the Reports privilege, or reconnect with an administrator who has it.
  • An Access denied window appears when you connect. Allow the Osano app as described in If your organization restricts third-party apps. The error details in that window show the client ID and scope to give your Google administrator.
  • You cannot find API controls in the Google Admin console. Sign in as a super administrator or an administrator with the Service Settings privilege.
  • The integration asks you to reconnect. Reconnect with an active administrator.
  • If you encounter any other issues during the integration process, please reach out to Osano support for assistance.