.well-known file or the Admin console.
Before proceeding to the main integration guide located at
External Key Service Setup for Google Workspace CSE , choose and configure your preferred IdP. After configuring it, if you’re not usingVirtuCrypt, retain the following information required for integrating the IdP with both CryptoHub and Google Workspace:
- OpenID Connect Discovery URL
- OpenID Connect Client ID
- OpenID Connect PKI
Choose your IdP for CSE
If you don’t already use a third-party IdP with Google Workspace, you can set up your IdP for use with your key service in any of the following ways: -Use VirtuCrypt IdP: This is detailed in the main document. Choose this if you want to use Futurex VirtuCrypt as your IdP.- If you’re following this path, continue to the next paragraph. -Use Google identity: If your security model doesn’t require additional isolation of your encrypted data from Google, you can use the default Google identity as your IdP.
- Complete
- Use Okta IdP: Okta is a popular identity provider that integrates well with Google Workspace CSE.
- Complete
Choose how to connect to your IdP for CSE
You can set up your IdP by using either a.well-known file that you host on your organization website or the Admin console (which is your IdP fallback). The following table covers considerations for each method:
| Considerations | .well-known setup | Admin console setup (IdP fallback) |
|---|---|---|
| Isolation from Google | IdP settings are stored on your server. | IdP settings are stored on Google servers. |
| Admin responsibilities | An IdP admin can manage your setup instead of a Google Workspace Super Admin. | Only a Google Workspace Super Admin can manage your IdP setup. |
| CSE availability | CSE availability (uptime) depends on the availability of the server that hosts your .well-known file. | CSE availability corresponds to the general availability of Google Workspace services. |
| Ease of setup | Requires changing DNS settings for your server, outside of the Admin console. | Configure settings in the Admin console. |
| Sharing outside your organization | Your collaborator’s external key service can easily access your IdP settings. This access can be automated and ensures your collaborator’s service has immediate access to any changes to your IdP settings. | Your collaborator’s external key service can’t access your IdP settings in the Admin console. You must provide your IdP settings directly to your collaborator before you share encrypted files for the first time, as well as any time you change your IdP settings. |