Appendix B: Google IdP Configuration
This appendix provides detailed instructions for configuring the Google Identity Provider (IdP) for use with Google Workspace Client-Side Encryption (CSE), including the following tasks:
- Configure Google Cloud Console.
- Configure for Google IdP.
- Configure Google Admin Console.
- Review the setup for users, licenses, and organizational units.
To set up and manage Google Workspace CSE with Google IdP, you must have:
- Google Admin Rights to access:
- Google Admin Console
- Google Cloud Console
- Google Workspace Access with the necessary licenses to use Client-Side Encryption (CSE)
- CryptoHub Access to deploy the Google CSE service
Perform the following steps to configure Google Cloud Console:
Visit: https://console.cloud.google.com/ to access the Google Cloud Console.
To create a new project, select [ Create Project ].
Configure the following settings:
- Project Name: Choose a meaningful name for your project
- Organization: Select the domain under which this project will be created
- Location: Use your domain name (such as futurex.com)
After you create the project, go to the Google section on the left-hand menu and select APIs & Services.
Select [ Create Credentials ] and select OAuth Client ID. Then, configure the following settings:
- Select the Application Type as Web Application.
- Choose an appropriate Name for the OAuth client.
To create an OAuth2.0 client, select [ Create Credentials ] button and select OAuth Client ID. COnfigure the following settings:
- Select the Application Type as Web Application.
- Choose an appropriate Name for the OAuth client.
For Configure Authorized Redirect URIs, enter all of the following URIs:
- https://client-side-encryption.google.com/callback
- https://client-side-encryption.google.com/oidc/cse/callback
- https://client-side-encryption.google.com/oidc/drive/callback
- https://client-side-encryption.google.com/oidc/gmail/callback
- https://client-side-encryption.google.com/oidc/meet/callback
- https://client-side-encryption.google.com/oidc/calendar/callback
- https://client-side-encryption.google.com/oidc/docs/callback
- https://client-side-encryption.google.com/oidc/sheets/callback
- https://client-side-encryption.google.com/oidc/slides/callback
- https://krahsc.google.com/callback
(Optional) If required, perform the following steps to complete the OAuth consent screen:
- Under Application Home Page, enter: https://workspace.google.com/cse
- Under Application Privacy Policy, enter: https://policies.google.com/privacy
- Under Application Terms of Service, enter: https://policies.google.com/terms
- Under Authorized Domains, add:
- google.com
- Your organization's domain (such as futurex.com)
- For Developer Contact Information, enter your email address.
- Under the Audience tab, set the User Type to Internal.
After you finish the setup, the system generates a Client ID, that looks similar to the following sample:
Save this Client ID for use in the Admin Console configuration.
Perform the following steps to configure for Google IdP:
Log in to as an Admin.
Search for the Google CSE Service and deploy it
During deployment, configure the following details for Service Info:
- New Users: Enabled by default
- Email Domain: Your domain (such as futurex.com)
- Issuance Policy: Configure as needed (can be done later)
- The KACLS URL is automatically populated
- Identity Provider Type: Select OpenID Connect
Leave the remaining fields empty and deploy the service
Perform the following steps to configure Google Admin Console:
Go to the Google Admin Console at https://admin.google.com/.
Go to Data > Compliance > Client-Side Encryption.
Perform the following steps to configure the external Key Service:
- Select [ Add ].
- Enter a name for your key service.
- Enter the URL from CryptoHub (such as https://exampleuser.useast1-cryptohub-uat.virtucrypt.com/v0/key-encrypt/client).
- Test the connection to verify it works
Under Identity provider configuration, select [ Configure IdP fallback ] and provide the following information:
- Name: A descriptive name (such as Google IdP).
- Client ID: The Client ID obtained from the Google Cloud Console.
- Discovery URL: https://accounts.google.com/.well-known/openid-configuration
- Grant Type: Set to Implicit for Google as the IdP.
- Test the connection to verify it works.
When setting up CSE with Google IdP, ensure that:
- You create all users who will use CSE in Google Workspace with appropriate licenses.
- Users have the necessary Google Workspace licenses to access CSE functionality.
- You properly set up Organizational Units (OUs) to define groups for different encryption policies.
- You assign the correct key services to each OU in the Google Admin Console.
- You enable CSE for the appropriate OUs with the correct key service selected.
After completing all these steps, your Google CSE with Google IdP integration should be operational. You can test by creating an encrypted document in Google Drive.