- \n
- You need to have a Google Cloud account with the permission to create new Google Cloud Projects . <\/li>\n\n\n\n
- You need to have Admin with Billing permissions to configure an IdP. <\/li>\n<\/ul>\n\n\n\n
Considerations<\/strong><\/p>\n\n\n\n
- \n
- Federated authentication will be applied to only specific user groups. See Routing Policies for Identity Providers<\/a> to learn more. <\/li>\n\n\n\n
- Creating the IdP won’t automatically result in users logging in with that IdP. <\/li>\n\n\n\n
- User Portal access will be available with a federated login. If you don\u2019t want User Portal access, you can create a policy to deny this, see Get Started: Conditional Access Policies<\/a> to learn more. <\/li>\n\n\n\n
- In order to provision users from your Google Workspace directory to JumpCloud, see Configure the Google Cloud Directory Sync<\/a> to learn more.<\/li>\n\n\n\n
- If you have third party SSO for your organization turned on in Google Workspace, you’ll need to turn it off for it to work with JumpCloud. See Configuring an Organization-wide Third Party SSO Profile<\/a> to learn more. <\/li>\n<\/ul>\n\n\n\n
Preparing your IdP to Configure with JumpCloud<\/strong><\/h2>\n\n\n\n
To prepare your connection:<\/strong><\/p>\n\n\n\n
- \n
- Log in to your Google Cloud Console.<\/li>\n\n\n\n
- Next to the logo in the top left corner, click the dropdown menu, then in the top right corner of the modal, click NEW PROJECT<\/strong>. Name it something associated with JumpCloud, like \u2018JumpCloud OIDC\u2019 and click CREATE<\/strong>.<\/li>\n<\/ol>\n\n\n\n
![\"\"](\"https:\/\/jumpcloud.com\/wp-content\/uploads\/2024\/03\/NewProject-1024x496.png\")
<\/figure>\n\n\n\n- \n
- Navigate to APIs & Services<\/strong>, then in the left menu, click OAuth consent screen<\/strong>. <\/li>\n\n\n\n
- Under User Type<\/strong>, select Internal<\/strong>, then click CREATE<\/strong>.<\/li>\n<\/ol>\n\n\n\n
![\"\"](\"https:\/\/jumpcloud.com\/wp-content\/uploads\/2024\/03\/APIOAauth-1024x692.png\")
<\/figure>\n\n\n\n- \n
- On the App Information<\/strong> page, enter an App name*<\/strong>, something associated with JumpCloud, like \u2018JumpCloud OIDC\u2019.<\/li>\n\n\n\n
- In the next dropdown menu, select a User support email*<\/strong>.<\/li>\n\n\n\n
- The sections App logo and App domain are optional fields.<\/li>\n<\/ol>\n\n\n\n
![\"\"](\"https:\/\/jumpcloud.com\/wp-content\/uploads\/2024\/03\/GoogleOAuthConsent-1024x687.png\")
<\/figure>\n\n\n\n- \n
- Scroll down to Authorized domains<\/strong>, under Authorized domain 1*<\/strong>, enter
jumpcloud.com<\/code><\/li>\n\n\n\n- Under Developer contact information<\/strong>, enter an Email address*<\/strong>. <\/li>\n\n\n\n
- Click SAVE AND CONTINUE<\/strong>.<\/li>\n<\/ol>\n\n\n\n
![\"\"](\"https:\/\/jumpcloud.com\/wp-content\/uploads\/2024\/03\/GoogleAuthorizedDomain-1024x681.png\")
<\/figure>\n\n\n\n- \n
- On the next page, you can manage the scopes. Click ADD OR REMOVE SCOPES<\/strong>.<\/li>\n\n\n\n
- Select the first three scopes; email<\/strong>, openID<\/strong>, and profile<\/strong>. <\/li>\n\n\n\n
- Click UPDATE<\/strong>. <\/li>\n<\/ol>\n\n\n\n
![\"\"](\"https:\/\/jumpcloud.com\/wp-content\/uploads\/2024\/03\/Scopes-1024x682.png\")
<\/figure>\n\n\n\n- \n
- On the Scopes<\/strong> page, click SAVE AND CONTINUE<\/strong>. <\/li>\n\n\n\n
- On the Summary<\/strong> page, verify the app registration is correct, then click BACK TO DASHBOARD<\/strong>. <\/li>\n<\/ol>\n\n\n\n
![\"\"](\"https:\/\/jumpcloud.com\/wp-content\/uploads\/2024\/03\/Summary-1024x682.png\")
<\/figure>\n\n\n\n- \n
- Under APIs & Services<\/strong>, click Credentials<\/strong> > +<\/strong> CREATE CREDENTIALS<\/strong>, and select OAuth client ID<\/strong> from the dropdown menu.<\/li>\n<\/ol>\n\n\n\n
![\"\"](\"https:\/\/jumpcloud.com\/wp-content\/uploads\/2024\/03\/API-Credentials-1024x346.png\")
<\/figure>\n\n\n\n- \n
- On the next page, click the Application type*<\/strong> dropdown menu and select Web application<\/strong>.<\/li>\n\n\n\n
- Then, enter a Name*<\/strong>, something associated with JumpCloud, like \u2018JumpCloud OIDC\u2019.<\/li>\n\n\n\n
- Under Authorized redirect URIs<\/strong>, enter
https:\/\/login.jumpcloud.com\/oauth\/callback<\/code><\/li>\n\n\n\n- Click CREATE<\/strong>.<\/li>\n<\/ol>\n\n\n\n
![\"\"](\"https:\/\/jumpcloud.com\/wp-content\/uploads\/2024\/03\/CreateClientID-1024x683.png\")
<\/figure>\n\n\n\n- \n
- You\u2019ll get a successful OAuth client created modal with the Client ID, Client secret, Creation date, and Status. <\/li>\n\n\n\n
- Copy the Client ID<\/strong> and Client secret<\/strong> to your clipboard. You\u2019ll need these to configure Google Cloud in JumpCloud. Then click OK<\/strong> to exit out of the modal. <\/li>\n<\/ol>\n\n\n\n
Now, you have a connection to JumpCloud in Google Cloud. Next, you\u2019ll want to configure the connection in JumpCloud.’<\/p>\n\n\n\n
Configuring Google Cloud as an IdP in JumpCloud<\/strong><\/h2>\n\n\n\n
To configure Google Cloud:<\/strong><\/p>\n\n\n\n
- \n
- Log in to your JumpCloud Admin Portal<\/a>.<\/li>\n\n\n\n
- Click DIRECTORY<\/strong> INTEGRATIONS<\/strong> > Identity Providers<\/strong>.<\/li>\n\n\n\n
- Click the Add Identity Provider<\/strong> dropdown menu, and select Google<\/strong>. <\/li>\n\n\n\n
- Enter an Identity Provider Name<\/strong>* as a display name (i.e. Google OIDC).<\/li>\n\n\n\n
- Under Google IdP URL*<\/strong>, enter https:\/\/accounts.google.com<\/a>. <\/li>\n\n\n\n
- For Client ID*<\/strong>, paste in the first URL that you copied into your clipboard. <\/li>\n\n\n\n
- For Client Secret<\/strong>, paste in the secret that you copied into your clipboard. <\/li>\n\n\n\n
- Click Save<\/strong>. <\/li>\n<\/ol>\n\n\n\n
Managing the IdP <\/strong><\/h2>\n\n\n\n
To manage the IdP:<\/strong><\/p>\n\n\n\n
- \n
- From your JumpCloud Admin Portal<\/a>, click DIRECTORY<\/strong> INTEGRATIONS<\/strong> > Identity Providers<\/strong>.<\/li>\n\n\n\n
- You can update the name, Google IdP URL, Client ID, and Client Secret. <\/li>\n\n\n\n
- Under Authentication<\/strong>, you\u2019ll see that Federation is applied to your users, allowing them to authenticate with an IdP. <\/li>\n\n\n\n
- Under Device Account Provisioning<\/strong>, you can configure either Self Service Account Provisioning<\/strong> or Automated Device Enrollment<\/strong> for whichever OS you\u2019re provisioning. The Status<\/strong> displays either Enabled or Disabled accordingly, click Configure<\/strong> to edit.\n
- \n
- See Provision New Users on Device Login<\/a> and Automated Device Enrollment<\/a> to learn more. <\/li>\n<\/ul>\n<\/li>\n<\/ol>\n\n\n\n
Deleting the IdP<\/strong><\/h2>\n\n\n\n
To delete the IdP:<\/strong><\/p>\n\n\n\n
- Click DIRECTORY<\/strong> INTEGRATIONS<\/strong> > Identity Providers<\/strong>.<\/li>\n\n\n\n
- Log in to your JumpCloud Admin Portal<\/a>.<\/li>\n\n\n\n
- Then, enter a Name*<\/strong>, something associated with JumpCloud, like \u2018JumpCloud OIDC\u2019.<\/li>\n\n\n\n
- On the next page, click the Application type*<\/strong> dropdown menu and select Web application<\/strong>.<\/li>\n\n\n\n
- On the Summary<\/strong> page, verify the app registration is correct, then click BACK TO DASHBOARD<\/strong>. <\/li>\n<\/ol>\n\n\n\n
- Select the first three scopes; email<\/strong>, openID<\/strong>, and profile<\/strong>. <\/li>\n\n\n\n
- Under Developer contact information<\/strong>, enter an Email address*<\/strong>. <\/li>\n\n\n\n
- In the next dropdown menu, select a User support email*<\/strong>.<\/li>\n\n\n\n
- Under User Type<\/strong>, select Internal<\/strong>, then click CREATE<\/strong>.<\/li>\n<\/ol>\n\n\n\n
- Navigate to APIs & Services<\/strong>, then in the left menu, click OAuth consent screen<\/strong>. <\/li>\n\n\n\n
- Federated authentication will be applied to only specific user groups. See Routing Policies for Identity Providers<\/a> to learn more. <\/li>\n\n\n\n