Breadcrumbs

Google: Set up FileCloud Integration for SSO Group/User Import

To configure FileCloud/Google integration in Google for SSO group/user import:

  1. Log in to the Google Workspace Admin Center at admin.google.com.

  2. In the left navigation pane, go to Apps > Web and mobile apps.

    image-20251111-160105.png

  3. Click Add app and choose Add custom SAML app.

    image-20251111-160117.png

  4. Enter an App name, and click CONTINUE.

    image-20251111-160143.png

  5. Click CONTINUE.

    image-20251111-160154.png

  6. Fill in the fields as follows, replacing your-domain.com with your FileCloud domain. Click CONTINUE.
    ACS URL: https://your-domain/simplesaml/module.php/saml/sp/saml2-acs.php/default-sp
    Entity ID: https://your-domain/simplesaml/module.php/saml/sp/metadata.php/default-sp
    Start URL: https://your-domain/
    Name ID Format: TRANSIENT
    NameID: Basic Information > Primary Email

    image-20251111-160207.png

  7. Click ADD MAPPING.

    image-20251111-160218.png

  8. Choose the Google Directory attributes below, and add the specific values shown to App attributes. Then click FINISH.

    image-20251111-160229.png


    You should see a screen similar to the following.

  9. Click DOWNLOAD METADATA.

    image-20251111-160240.png

  10. In the Download metadata popup, click DOWNLOAD METADATA.
    The file GoogleIDPMetadata.xml is automatically downloaded.

  11. Click the copy icon next to Entity ID, and save it. You will need it to complete your configuration in FileCloud.

    image-20251111-160321.png

  12. Click CLOSE.

  13. Click the down arrow in the User access box.

    image-20251111-160338.png

  14. Select ON for everyone.
    If you want to only enable this for certain groups, click the Groups down arrow and add the groups.

    image-20251111-160350.png

  15. Click SAVE.

Now, create a key file and grant OAuth scopes.

Create a key file and grant FileCloud access to Google

Using your superadmin account, create a service account that grants FileCloud the necessary access to the Google api for SSO authentication. If you do not have a superadmin account, have a superadmin perform the following steps for you.

To create the service account:

  1. Log in to https://console.cloud.google.com/iam-admin/serviceaccounts.

  2. Select your project, or create a new one.

  3. Click Create service account.

    image-20251111-160404.png

  4. Enter a Service account name and click Create and continue.

    image-20251111-160415.png

  5. Continue through the Permissions and the Principals with access sections without entering any values, and click Done.
    The service account is saved.

    image-20251111-160428.png

Create and download the private key file

  1. On the Service accounts page, click the service account you created.

  2. Click the Keys tab, and then click Add key and choose Create new key.

    image-20251111-160439.png

  3. Select JSON, and click Create.
    The private key file is saved in a json file. Note its name so you are able to upload it later when you set up Google/FileCloud SSO  integration in FileCloud.

    image-20251111-160450.png


    To enter the values into the FileCloud side, see SSO API: Configure Import of SSO Groups and Users.

Enable the Admin SDK API library

  1. Go to https://console.cloud.google.com/apis/library

  2. Search for Admin SDK.

  3. Click it, and then click Enable.
    Status should appear as Enabled.

    image-20251111-160535.png

Get the service account Client ID:

  1. In the left navigation pane, go to IAM & Admin > Service Accounts.

    image-20251111-160544.png

  2. Click your service account to open it.

    image-20251111-160554.png

  3. At the bottom of the page, click Advanced settings.

    image-20251111-160607.png

  4. Click the copy icon next to Client ID, and save it.

    image-20251111-160618.png


    You will paste it into the Client ID field in the next section.

Grant OAuth Scopes via the Admin Console

  1. Log back into Google Workspace Admin Center and go to https://admin.google.com/ac/owl/domainwidedelegation.

  2. Click Add new.

    image-20251111-160632.png

  3. In the Add a new client ID dialog box, and enter the following values:
    Client ID- Enter the Client ID you saved in the previous section from https://console.cloud.google.com.
    OAuth scopes- Enter the following as a string with the commas included: 

    https://www.googleapis.com/auth/admin.directory.user.readonly,
    https://www.googleapis.com/auth/admin.directory.group.readonly,
    https://www.googleapis.com/auth/admin.directory.group.member.readonly

  4. Click AUTHORIZE.

    image-20251111-160650.png

  5. The OAuth scopes are now added to the Client ID. 

    image-20251111-160702.png


    To enter the integration values into the FileCloud side, see SSO API: Configure Import of SSO Groups and Users.