Skip to main content

Google Cloud Platform

info

GCP connector is not available currently and is coming soon

About GCP Connector

This guide will elaborate on the GCP connector details. Here you would learn about the connector, configuration, and deployment information about connector. The GCP connector will let you create and onboard GCP applications in IDHub.

Connector Operations

OperationSupported?
User Management-
Create userYes
Update userYes
Delete UserYes
Enable userYes
Disable userYes
Change or Reset passwordYes
Add Child (Assign/Remove to a user account)-
Add/Remove Nick NamesYes
Entitlement Grant Management-
Add/Remove Admin RoleYes
Add/Remove Project RoleYes
Add/Remove Organization RoleYes
Add/Remove GroupYes
Group Management-
Add GroupYes
Update GroupYes
Remove GroupYes

Connector Components

The components of the connector include Connector Application, Connector Application Configuration, Connector Service Provider Interface, Splice, and Splice configuration.

These connector components include connectivity and configuration details specific to your target system. The connector uses information from these files allowing you to onboard your applications quickly and easily using only a single and simplified UI.

Connector Architecture

The connector architecture is basically composed of connector application, GCP SDK controller and target system splice. The target system splice takes care of the native communication with the target system using the GCP Specific connector SPI implementation. This architecture is followed and design as it enables for easy and rapid deployment of the connector as well as more precise versioning capabilities.

The connector is configured to run in one of the following modes:

  • Target Resource reconciliation
    • If you use the GCP application as the trusted source then in this case users are directly created and modified on IDHub. The GCP SDK extracts user records that match the reconciliation criteria, which brings the records to IDHub. Each user record fetched from the target system is compared with existing IDHub Users. If a match is found between the target system record and the IDHub User, then the User attributes are updated with changes made to the target system record. If no match is found, then the target system record is used to create an IDHub User.
  • Account management
    • This involves creating, updating, or deleting users on the target system through IDHub. During provisioning, the connector calls the target system GCP SDK for provisioning operations. The SDK on the target system accepts provisioning data, carries out the required operation on the target system, and returns the response from the target system back to IDHub. Apps can use the GCP SDK to perform create, read, update, and delete (CRUD) operations on the target system.
note

We follow this basic architecture in the connector development. If there are any enhancements or additional specifications or configurations, that would be the connector customization part, so that would be handled accordingly by IDHub team as per your specific business requirement.

Connector Features

Full Reconciliation and Incremental Reconciliation

You can perform full reconciliation to bring all existing user data from the target system to IDHub. After the first full reconciliation run, you can configure your connector for incremental reconciliation if the target system contains an attribute that holds the timestamp at which an object is created or modified.

Limited Reconciliation

You can reconcile records from the target system based on a specified filter criterion. To limit or filter the records that are fetched into IDHub during a reconciliation run, you can specify the subset of added or modified target system records that must be reconciled. You can set a condition based on which the reconciliation would be performed.

Batched Reconciliation

You can break down a reconciliation run into batches by specifying the number of records that must be included in each batch.

info

The current version of the connector do not support incremental recon & batched recon and will be supported in the future release version of the connector.

Connection Pooling

A connection pool is a cache of objects that represent physical connections to the target. IDHub connectors can use these connections to communicate with target systems.

At run time, the application requests a connection from the pool. If a connection is available, then the connector uses it and then returns it to the pool. A connection returned to the pool can again be requested for and used by the connector for another operation. By enabling the reuse of connections, the connection pool helps reduce connection creation overheads like network latency, memory allocation, and authentication.

One connection pool is created for each set basic configuration parameters that you provide while creating an application. For example, if you have three applications for three installations of the target system, then three connection pools will be created, one for each target system installation.

Support for Connector Server

By using one or more connector servers, the connector architecture permits your application to communicate with externally deployed bundles. In other words, a connector server enables remote execution of an IDHub connector.

Support for Reconciliation of Account Status

Support for reconciliation of account status is one of the features where the connector fetches the status information during a reconciliation operation. During a reconciliation run, the connector can fetch status information along with the rest of the account data.

Reconciliation of Deleted Account Data

The Google Apps Target Resource User Delete Reconciliation task can be used to fetch details of deleted target system users. This information is used to revoke the corresponding Google Apps resources from IDHub.

Support for Connector Operations in Multiple Domains

The connector supports reconciliation and provisioning operations in multiple domains. By default, this connector supports reconciliation and provisioning operations within a single domain. However, you can configure the connector for performing connector operations in more than one domain by specifying a value for the supportMultipleDomain parameter in Advanced Settings.

Transformation and Validation of Account Data

You can configure transformation and validation of account data that is brought into or sent from IDHub during reconciliation and provisioning operations by writing Groovy scripts while creating your application.

Creating an Application by using the Connector

Prerequisites for creating the application using the connector

  1. Create a project and register your client application with the Google Cloud Platform in Google Cloud Console .

  2. Select APIs & Services, and then select Enabled APIs & services. Search for Admin SDK, Group Settings, Cloud Resource Manager, IAM (Identity and Access Management) API Services and enable them.

  3. Select APIs & Services, and then select Credentials. Click Create Credentials to create a API key, an OAuth client ID, and a Service account.

    1. To create OAuth client ID, configure your consent screen. Click CONFIGURE CONSENT SCREEN, select the User Type as Internal, and then click Create.
    2. Enter the application name, user-supported email, and developer email address, and then click SAVE AND CONTINUE.
    3. Click ADD OR REMOVE SCOPES and add all the required scopes and then click SAVE AND CONTINUE to create an application.
    4. To create an OAuth client ID, choose the Application type as web application, enter the name, and then click CREATE. You will get a client ID and a client secret.
  4. Open the service account created by you, note down the email ID. Click Create GCP Marketplace-compatible OAuth Client and select Continue and the copy the client ID.

  5. Click the Keys tab, click ADD Key, and then click Create new key. Select the Key type as P12 and click Create. The Private key is downloaded to the local computer.

  6. Specify the location of this Private key in the Service Account Private Key field when you perform the procedure

  7. Add scopes and authorize the registered client application. To do so:

    1. Login to the Google Admin Console using the https://admin.google.com link with an account that has administrative privileges in the Google instance.
    2. Choose Security and click Access and data controls.
    3. Click API Controls and search for Domain-wide delegation option, and click MANAGE DOMAIN-WIDE DELEGATION.
    4. Click Add new next to API clients, enter the multi-digit Client Number that was provided during the Google Service Account creation.
    5. In the One or More API Scopes field, enter the scopes listed in the Google Applications Scope field. These scope values must be separated by commas, but ensure that the double quotes (") are removed.
    6. Click Authorize.

    Once this is completed, the Test Application button will successfully run and connect to the Google Application instance.

  8. Create a user account on the target system. The connector uses this account to connect to the target system during each connector operation. Post account creation, assign the Groups Admin and User Management Admin admin roles to the newly created account.

  9. Enable access to various Google administrative APIs available in the Google Cloud Platform Business Domain. The administrative API allows you to manage user accounts and synchronizes Google Cloud Platform user accounts with your own user account

  10. Enable external user access to groups in Google Cloud Platform. Perform this step only if you want external users to access groups in Google Cloud Platform.

Onboard the Application in IDHub

tip

Click here for the detailed steps for onboarding the application to IDHub

Configuring the Connector

While creating a target or an authoritative application, you must configure connection-related parameters that the connector uses to connect to IDhub with your target system and perform connector operations. These are the connection-related parameters that IDHub requires to connect to an GCP application.

Basic Configuration of the Connector

ParameterMandatory?Description
Service Account IDYesEnter the email address of the service account created.
Service Account UserYesEnter the user name of account that you created to log in to the client application. Sample value: [email protected]
Service Account Private KeyYesEnter the name and complete the path to the directory containing the private key Sample value: /scratch/34567890sdfghjk.p12
Google Application NameYesEnter the name of the project that was created as part of registering the client application.
Google Domain NameYesEnter the name of your Google Cloud Platform Connector domain. Sample value: mydomain.com
GCP Project IDYesEnter the name of Google Cloud Platform Project ID
ScopeYesEnter the scope of your client application. Default value:"https://www.googleapis.com/auth/cloud-platform", "https://www.googleapis.com/auth/admin.directory.user", "https://www.googleapis.com/auth/admin.directory.group", "https://www.googleapis.com/auth/admin.directory.group.member", "https://www.googleapis.com/auth/admin.directory.rolemanagement", "https://www.googleapis.com/auth/admin.directory.orgunit", "https://www.googleapis.com/auth/apps.groups.settings"
Connector Server NameNoEnter the name of Connector Server IT resource, if you are using the Google Cloud Connector together with a Java Connector Server.
Proxy HostNoEnter the proxy host name.This is useful when a connector must be used in the network protected by the web proxy. Check with your network administrator
Proxy PasswordNoEnter the proxy password.This is useful when a connector must be used in the network protected by the web proxy. Check with your network administrator
Proxy PortNoEnter the proxy port number.This is useful when a connector must be used in the network protected by the web proxy. Check with your network administrator for more information about proxy configuration.
Proxy UsernameNoEnter the proxy user name.This is useful when a connector is to be used in the network protected by the web proxy. Check with your network administrator for more
GCP Organisation IDYesEnter the unique ID of Google Cloud Platform “organization”.

Advanced Settings Parameters

There are some advanced settings that you can configure in the connector.

info

These advanced settings are not supported in the current version of the connector & will be supported in the future release version of the connector.

ParameterMandatory?Description
Connector NameYesThis parameter holds the name of the connector class. Default value: org.identityconnectors.gcp.GCPConnector
Connector Package NameYesThis parameter holds the name of the connector bundle package. Default value: org.identityconnectors.gcp
Connector Package VersionYesThis parameter hods the version of the connector bundle class. Default value: 12.3.0
supportMultipleDomainNoThis entry specifies whether the connector can perform connector operations in a single or multiple domain. By default, the connector performs connector operations only on the domain specified as the value of the Google Domain Name basic configuration parameter.Set the value of this entry to true if you want the connector to perform connector operations in all the domains present in Google Cloud Platform Connector. Default value: false
supportDeleteIdentityNoThis entry specifies whether the connector can delete the account in directory or just remove the entitlements & keeps the account. Set the value to true if you want to delete the account in Directory as well. Default value: false
Pool Max IdleNoMaximum number of idle objects in a pool. Sample value: 10
Pool Max SizeNoMaximum number of connections that the pool can create. Sample value: 10
Pool Max WaitNoMaximum time, in milliseconds, the pool must wait for a free object to make itself available to be consumed for an operation. Sample value: 150000
Pool Min Evict Idle TimeNoMinimum time, in milliseconds, the connector must wait before evicting an idle object. Sample value: 120000
Pool Min IdleNoMinimum number of idle objects in a pool. Sample value: 1

Connector Application Configuration

Connector application is designed such that it works as the wrapper application to the different scim adapters. This majorly consists of the following:

Authentication

  • Basic Authentication is required
  • The encrypted values of username and password will be stored in the properties file

Resource Type

These are the two resource types available for the IDHUB connector. The "resourceName" attribute value in rest api calls will have one of these values.

  • Account - user account in the target system - this will include entitlement membership
  • Entitlement -available entitlements in the target system

Deploying the GCP Connector

tip

The documentation for deploying the connector is coming soon