If you’re using 3-legged OAuth as your Google authentication method, you can skip this step and go to Download & install.
To use a service account as your authentication method, you need to create an account and set it up before you install Password Sync. How you create the account depends on whether you want to run an automated script (recommended) or manually create a service account.
You're on step 3 of 7
Option 1: Use an automated script to create the account
This GitHub script is not supported by Google Workspace support. If you have issues using the script, follow the steps to manually create the account instead. Learn more about using the script.
- Sign in as a super administrator and, in a browser window, open Cloud Shell.
- In the editor, enter python3 <(curl -s -S -L https://git.io/password-sync-create-service-account).
- Complete the steps in the Cloud Shell window.
- Click Download to download the JSON file that contains the service account's client ID to your computer.
- Go to Download & install.
Learn more about using the script.
Option 2: Manually create a service account
Step 1: Create a project- Go to Google Cloud and sign in as a super administrator. If it's your first time signing in to the console, agree to the Terms of Service.
- Click IAM & Admin
Manage Resources. You might have to click Menu
first.
- At the top, click Create Project and enter a project name.
- (Optional) To add the project to a folder, for Location, click Browse, navigate to the folder, and click Select.
- Click Create.
- By default, only the creator of the project has rights to manage the project. To ensure the project can be maintained if the creator leaves the organization, you should assign at least one other person the role of Project Owner. For details, go to Manage access to projects, folders, and organizations.
Tip: When adding the email addresses below, use shared administrator email accounts.
- Click APIs & Services
- For User Type, select Internal.
- Click Create.
- For App name, add the name of your application.
- Select a User support email for users to contact with questions.
- For Developer contact information, enter email addresses so Google can contact you about changes to your project.
- Click Save and Continue
- Click APIs & Services
- Click Create Credentials
- For Service account name, enter a name for the service account and optionally add a description.
- Click Create and Continue
- Make a note of the Unique ID value for the service account. You'll need it later. This value is also the service account’s client ID.
Tip: You can also find the value on the Details tab of the service account or in the JSON file.
- Click Done
- At the top, click Keys
- Make sure the key type is set to JSON and click Create.
You'll get a message that the service account's private key JSON file was downloaded to your computer.
- Make a note of the file name and where your browser saves it. You'll need it later.
- Click Close.
-
In the Admin console, go to Menu
Security
You must be signed in as a super administrator for this task. -
Click Add new and enter your service account client ID.
You can find the ID (also known as the Unique ID) in the JSON file that you downloaded when you created the service account or in Google Cloud (click IAM & Admin
- For OAuth scopes, enter the following scope:
https://googleapis.com/auth/admin.directory.user
- Click Authorize.
Google, Google Workspace, and related marks and logos are trademarks of Google LLC. All other company and product names are trademarks of the companies with which they are associated.
