Google Workspace

​

Overview

The Google Workspace connector allows you to access, manage, and synchronize data across Gmail, Google Calendar, and Google Drive.

Google Workspace (formerly G Suite) is a collection of cloud computing, productivity, and collaboration tools developed by Google. This connector provides access to core Google Workspace services through a unified API.

​

Authentication

The Google Workspace connector uses OAuth 2.0 for authentication. This requires users to grant permission for the application to access their Google Workspace data within the scopes specified.

​

How to configure and enable the Google Workspace Connector

​

Step 1: Create a Google Cloud Project & Set Up Admin Access

1. Sign in as Super Administrator:
   Log in to the Google Cloud Console using an account with super administrator privileges.

2. Create a New Project:

   • Click on the project dropdown at the top of the console and select New Project
   • Enter a project name and (optionally) assign it to a folder or organization
   • Click Create

​

Step 2: Enable Required APIs

1. Navigate to APIs & Services > Library in the Cloud Console

2. Search for and enable the following APIs:

   • Google Drive API
   • Gmail API
   • Google Calendar API
   • Admin SDK API
   • Google Docs API
   • Google Sheets API
   • Google Slides API

​

Step 3: Create a Service Account

1. Navigate to IAM & Admin > Service Accounts in the Cloud Console
2. Click Create Service Account

3. Enter a Service Account Name and an optional Description
4. Click Create and Continue, then Done

5. Copy the Unique ID for use in the next step

​

Step 4: Delegate Domain-Wide Authority

1. Sign in to the Google Admin Console with a super administrator account
2. Navigate to Security > Access and data control > API controls
3. Click Manage Domain Wide Delegation
4. Click Add new and paste the service account’s client ID
5. Add the following OAuth scopes:

https://www.googleapis.com/auth/admin.directory.group.readonly,https://www.googleapis.com/auth/admin.reports.audit.readonly,https://www.googleapis.com/auth/admin.directory.user.readonly,https://www.googleapis.com/auth/admin.directory.domain.readonly,https://www.googleapis.com/auth/admin.directory.orgunit,https://www.googleapis.com/auth/gmail.readonly,https://www.googleapis.com/auth/drive.readonly,https://www.googleapis.com/auth/calendar.readonly,https://www.googleapis.com/auth/documents.readonly,https://www.googleapis.com/auth/spreadsheets.readonly,https://www.googleapis.com/auth/presentations.readonly

6. Click Authorize

​

Step 5: Create a JSON Key for the Service Account

1. In the Service Accounts list, select your newly created service account
2. Click on the Keys tab
3. Click Add Key and select Create new key
4. Choose JSON as the key type and click Create
5. Save the automatically downloaded JSON key file

​

Configuring and enabling connector

1. Navigate to the Connectors tab under settings tab in Company Profile
2. Click on “Click to View” Button
3. If not configured, click on settings button which will open a configuration dialog
4. In the Configuration Dialog:
   • Enter the Admin Email (Admin user’s email with which you created the Google Cloud credentials)
   • Select the JSON key file to upload and click on Save button.

5. To enable the connector, click on the enable button so that data can be shared

​

Enable Service Account Key Creation

If you encounter an error while creating the service account key due to organization policy constraints, follow these steps:

​

1. Switch to the Organization Context

At the top of the Google Cloud Console (where the project name is shown), click the drop-down to see a list of organizations and projects.

Select your organization rather than a specific project.

If you don’t see an organization listed, make sure you’re signed in with an account that has access to the organization.

​

2. Add Organisation Policy Administrator Role

Navigate to IAM & Admin > IAM in the Cloud Console

Find the current user and Click on the Pencil icon.

Click on the Add another role button.

Search for the Organisation Policy Administrator role.

Click on the Add button.

Click on the Save button.

​

3. Disable the Service Account Key Creation constraint

Navigate to IAM & Admin > Organization Policies in the Cloud Console

Search for "iam.disableServiceAccountKeyCreation"

Select the policy

Click on the Manage Policy button

In Policy source, Select Override parent’s policy. Add a rule and set the enforcement to “Off”

Click on the Save button

After completing these steps, return to Step 5 and try creating the service account key again.

​

Google PubSub Configuration

PubSub setup enables real-time updates for Gmail content. While optional, it’s highly recommended for maintaining up-to-date content in Enterprise search.

​

Step 1: Set Up a Cloud Pub/Sub Topic

1. Navigate to Pub/Sub > Topics in the Cloud Console sidebar
2. Click Create Topic
3. Enter a unique name (e.g., projects/your-project-id/topics/gmail-webhook-topic)
4. Check “Add a default subscription”
5. Click Create to confirm

​

Step 2: Configure the Subscription

1. Go to Pub/Sub > Topics
2. Select the subscription created with the topic
3. Click Edit
4. Change Delivery type to “Push”
5. Set Endpoint URL as “your_base_url/gmail/webhook”
6. Adjust Expiry Period as needed
7. Click Update

​

Step 3: Set Topic Permissions

1. In Pub/Sub > Topics, select your topic
2. Open the Info Panel (right side)
3. Click Add Principals
4. Add gmail-api-push@system.gserviceaccount.com
5. Assign the Pub/Sub Publisher role

6. Click Save