Google Workspace (G Suite)

1. Go to these instructions for Creating access credentials for Google Workspace. Follow the steps under the headings Service account credentials, including Optional: Set up domain-wide delegation for a service account to create a service account and set up domain-wide delegation of authority. 
   
   1. Service Account
      • No roles need to be added to the service account, click Continue.
      • No user access needs to be added to the service account, click Continue.
        
   2. Domain-wide Delegation
      • The Unique ID shown under Advanced Settings > Domain-wide Delegation will be used for the Client ID in the domain-wide delegation

      • When configuring domain-wide delegation, enter the following API scopes where required:

        • • https://www.googleapis.com/auth/admin.directory.group
          • https://www.googleapis.com/auth/admin.directory.user
          • https://www.googleapis.com/auth/admin.directory.userschema 
            
            

Google Workspace Marketplace OAuth Client

Click on the Service Account that was created, expand Advanced settings, and under the Google Workspace Marketplace-Compatible OAuth Client section, click on Configure.

Under the OAuth consent screen, select Internal in the User Type section. Click Create.

Under App Information, the following fields will be filled out:

• App Name : Example, ThoughtFarmer Google Workspace
• User support email : Select the email provided on the dropdown 
• Developer contact information > Email address: Administrator's email address
  
  
  • Click Save and Continue
  • No scopes will be added. Click Save and Continue.

 

ThoughtFarmer sync configuration

1. Go to the Google API Library. At the top, make sure your ThoughtFarmer project is selected.
   
   
   
   1. In the search bar, search for and select Admin SDK API.
   2. Click the Enable button.
2. In ThoughtFarmer, go to the Admin panel: Users & security section > Employee Directory Connector page.
3. Click +Add new external user store.
4. On the New external user store page, give the user store a name and select Google from the Type dropdown menu. 
   
5. Click Save.
6. Navigate to the Configuration tab. Copy the code below and paste it into the Configuration tab. Ensure that you replace the placeholder values, preserving the double quotes.

   {
   "domain": "yourDomain",
   "privateKey": "-----BEGIN PRIVATE KEY-----yourKeyHere-----END PRIVATE KEY-----\n",
   "clientEmail": "email@yourOrganization.iam.gserviceaccount.com",
   "customer": "yourCustomerValue",
   "adminUser": "adminUserEmail@domain.com", "group": "yourGroupName"
   }

   1. Domain: Your organization's domain that is managed through Google Workspace.
   2. PrivateKey: 
      1. Go to Google's Service Accounts page.
      2. Select your ThoughtFarmer project.
      3. If you haven't generated a private key, access the ellipsis menu next to the service account name and choose Manage keys.
         
      4. On the Keys page, select Add Key, then create a new key in JSON format. The file will be saved to your local Downloads folder automatically.
      5. Open the file and note the private_key value. For best viewing, use an editor like NotePad++.
   3. ClientEmail: The email of the service account you created. 
   4. Customer: Navigate to https://play.google.com/work/adminsettings?pli=1, and copy the Organization ID.
   5. AdminUser: The username of an active admin user. The sync will impersonate this user.
   6. Group: The name of the group containing users to whom you want to give ThoughtFarmer access. It is recommended to create this group in advance.

7. Click the Field Mappings tab to add additional fields.

8. To create a field mapping:
   1.  Click +Add.
   2. Select the relevant ThoughtFarmer field from the dropdown menu.
   3. Input the corresponding Google field mapping into the External store field box.
   4. Select Google as the Data owner.
   5. Click the Save icon.
   6. Repeat as necessary to add additional field mappings.
      

   7. The following table lists the accepted field mappings from Google:

      givenName	familyName	primaryEmail
      manager	thumbnailPhotoUrl	EmailHome
      EmailWork	EmailCustom	EmailOther
      PhoneHome	PhoneWork	PhoneMobile
      AddressHome	AddressWork	AddressOther
      EmailAlias	EmployeeID	JobTitle
      Department	CostCenter	BuildingID
      FloorName	FloorSection

9. Click the Synchronization Settings tab.
   
   • Select Validate credentials. If your configuration settings are accurate, the credential validation should be successful. You might need to refresh the page to view the status of the credential validation.
   • In the Daily synchronization section, you have the option to establish a schedule for executing your chosen synchronization tasks at specific times and frequencies. If you need to run a synchronization immediately, just select the checkboxes for the tasks you wish to sync and click Synchronize now.
10. In case it fails:
    • You can find out more about the reason for the failure under the ThoughtFarmer Admin panel: Logs & statistics section > System Logs page.
    • If it is unclear, please open a support request on the Helpdesk.
11. If a user doesn't have a ThoughtFarmer account, but they are a member of the Google Workspace group that ThoughtFarmer is syncing with, you can have their account automatically created after they log in without having to run a sync first. If you want this enabled, click the Basic Information tab. Select the User auto-creation checkbox. Click Save.

Limitations

There is a current limitation from Google in regard to profile images.

Regardless of the size of the photo being uploaded, the API automatically downsizes it to 96x96 pixels.

Custom Attributes

If you wish to use custom field mappings from Google, under the ThoughtFarmer External Store Field column, the customs attribute has to be in the following format: