Google Workspace Integration - Revision history

Ltalaschus at 14:46, 23 June 2025

2025-06-23T14:46:43Z

Chansen: /* Create OAuth 2.0 Client for User Authentication */

2022-05-14T10:31:50Z

Create OAuth 2.0 Client for User Authentication

Rrommelrath at 17:00, 18 January 2022

2022-01-18T17:00:29Z

Bmeyn at 14:52, 14 January 2022

2022-01-14T14:52:45Z

Ltalaschus: /* Grant Access on Google Workspace Account to Project */

2021-12-28T16:23:05Z

Grant Access on Google Workspace Account to Project

Ltalaschus: /* Grant Access on Google Workspace Account to Project */

2021-12-28T16:04:11Z

Grant Access on Google Workspace Account to Project

Ltalaschus: /* Create OAuth 2.0 Client for User Authentication */

2021-09-03T07:18:52Z

Create OAuth 2.0 Client for User Authentication

Ltalaschus: /* Create OAuth 2.0 Client for User Authentication */

2021-09-03T07:10:13Z

Create OAuth 2.0 Client for User Authentication

Ltalaschus at 12:30, 2 September 2021

2021-09-02T12:30:14Z

Bmeyn: /* Create Service Account */

2021-04-21T15:11:36Z

Create Service Account

@@ Line 1: / Line 1: @@
 {{DISPLAYTITLE:Synchronizing User Accounts with Google Workspace}}
 {{Directory Services Preamble|Google Workspace account|Google Workspace}}
 == Prerequisites, Recommendations, Limitations ==
@@ Line 135: / Line 130: @@
 The authentication settings define how MailStore Server should authenticate users at login, that have been synchronized from Google Workspace.
 * '''Client ID'''<br/>Enter the client ID from the [[#Create_OAuth_2.0_Client_for_User_Authentication|Create OAuth_2.0 Client…]] step.
 * '''Client Secret'''<br/>Enter the client secret from the [[#Create_OAuth_2.0_Client_for_User_Authentication|Create OAuth_2.0 Client…]] step.

@@ Line 88: / Line 88: @@
 * Click ''Create'' to finish.
 * Copy the client ID and client secret from the ''Your Client ID'' and ''Your Client Secret'' fields to a safe place (e.g. password safe or similar) and click ''OK''.
-::{| class="wikitable"
+<div class="resp-table">
 |+ Examples of valid redirect URIs
 |-
@@ Line 112: / Line 113: @@
 |-
 |}
 == Configure MailStore Server ==

@@ Line 14: / Line 14: @@
 == Register Project with Google ==
-Irregardless of whether own or third-party applications such as MailStore Server are supposed to interact with a Google Workspace account through Google APIs, they must be registered as a project with Google first. This is necessary to ensure that access by external applications is limited to a necessary  minimum and that each application uses its own set of credentials to authenticate with Google.
+Regardless of whether own or third-party applications such as MailStore Server are supposed to interact with a Google Workspace account through Google APIs, they must be registered as a project with Google first. This is necessary to ensure that access by external applications is limited to a necessary  minimum and that each application uses its own set of credentials to authenticate with Google.
 === Create New Project ===
@@ Line 38: / Line 38: @@
 * Under ''User Type'' select ''Internal''.
 * Click ''Create''.
-* Type in a meaningful name into the ''App name'' field, e.g. <tt>MailStore Server</tt>.
+* Enter a meaningful name into the ''App name'' field, e.g. <tt>MailStore Server</tt>.
 * Fill out the other fields according to the policies of your organization.
 * Click ''Save and Continue''.
@@ Line 49: / Line 49: @@
 * Click ''+ Create Credentials'' and select ''Service account'' from the drop-down list.
 * On the ''Create service account'' page, enter a name for the service account, e.g. <tt>MailStore Server Service</tt>.
-* You can leave the the service account id in the default.
+* You can leave the the service account id at default settings or customize it.
 * Enter a description such as: <tt>Service account for MailStore Server to synchronize users and access mailboxes</tt>.
 * Click ''Create and Continue''.

@@ Line 19: / Line 19: @@
 To register a project  for MailStore Server with Google, proceed as follows:
-* Go to the [https://console.developers.google.com Google Developers Console].
+* Go to the [https://console.cloud.google.com Google Cloud Platform Console].
 * If prompted, login using a Google account of you Google Workspace organization. Logging in with a user that has admin privileges is highly recommended.
 * If no project exists, click ''Create Project'' on the dashboard. Otherwise, open the project list by clicking on the project drop-down in the header bar and click ''New project''.
@@ Line 31: / Line 31: @@
 * Open the ''Navigation menu'' (☰) and select ''APIs & Services'' > ''Library''.
 * In the ''API Library'', search and enable the following APIs and services:
-*: <tt>Admin SDK</tt>
+*: <tt>Admin SDK API</tt>
 *: <tt>Gmail API</tt>
@@ Line 49: / Line 49: @@
 * Click ''+ Create Credentials'' and select ''Service account'' from the drop-down list.
 * On the ''Create service account'' page, enter a name for the service account, e.g. <tt>MailStore Server Service</tt>.
 * Enter a description such as: <tt>Service account for MailStore Server to synchronize users and access mailboxes</tt>.
-* Click ''Create''.
+* Click ''Create and Continue''.
-* The service account does not require permissions on project level, therefore do not select a role.
+* The service account does not require permissions on project level, therefore do not select a role. Also, users do not need access to the service account, so no changes are needed in the ''Grant users access to this service account'' step.
-* Click ''Continue''.
+* Click ''Done''.
-* Users do not need access to the service account, so no changes are needed in the ''Grant users access to this service account'' step.
+* In the list of service accounts that is now displayed, click on the newly created service account to open its properties.
 * Under ''Keys'' click on ''Add Key'' and select ''Create new key''.
 * Select ''JSON'' as key type and click ''Create''.
 * The JSON file will be downloaded automatically. Save the JSON file in a secure location as it allows access to cloud resources of your organization.
 * Click ''Close''.
-* Back under ''Details'', click ''Show Domain-wide Delegation''.
+* Back under ''Details'', click ''Show Advanced Settings''.
-* Check the ''Enable Google Workspace Domain-wide Delegation'' box.
+* In the ''Domain-wide Delegation'' section, copy the ''Client ID'' to the clipboard.
-* Click ''Save''.
+* Open the [https://admin.google.com/ Google Workspace Admin Console] by clicking on the button and log in with your Google Workspace domain admin credentials.
+* Open the ''Navigation menu'' (☰) and select ''Security'' > ''Access and data control'' > ''API controls''.
-On the ''Credentials'' page, there should be a service account listed under ''Service Accounts'' with a corresponding client listed under ''OAuth 2.0 Client IDs''.
+* Under ''Domain wide delegation'', click ''Manage domain wide delegation''.
 === Create OAuth 2.0 Client for User Authentication ===
-To allow users to log in to MailStore Server by authenticating with Google using the OpenID Connect mechanism, an OAuth 2.0 client must be created as described below.
+To allow users to log in to MailStore Server by authenticating with Google using the OpenID Connect mechanism, another OAuth 2.0 client must be created as described below.
 * Open the ''Navigation menu'' (☰) and select ''APIs & Services'' > ''Credentials''.
 * Click ''+ Create Credentials'' and select ''OAuth client ID'' from the drop-down list.
@@ Line 107: / Line 112: @@
 |-
 |}
 == Configure MailStore Server ==

@@ Line 115: / Line 115: @@
 * Under ''Domain wide delegation'', click ''Manage domain wide delegation''.
 * On the ''Domain-wide delegation'' page, click ''Add new''.
-* Enter the ''Client ID'' of the OAuth 2.0 Client that is linked with the service account.
+* Enter the ''Client ID'' (numeric only, not the email address) of the OAuth 2.0 Client that is linked with the service account.
 * Under ''OAuth Scope'', add the following scopes:
 *: <tt><nowiki>https://mail.google.com/, https://www.googleapis.com/auth/admin.directory.group.readonly, https://www.googleapis.com/auth/admin.directory.user.readonly</nowiki></tt>

@@ Line 88: / Line 88: @@
 ! style="width:80px;" | Product
 ! style="width:80px;" | FQDN
-! style="width:40px;" | TCP Port
+! style="width:40px;" | Port
 ! Resulting Redirect URI
 |-

@@ Line 88: / Line 88: @@
 ! style="width:80px;" | Product
 ! style="width:80px;" | Computername
 ! style="width:40px;" | TCP Port
 ! Resulting Redirect URI
 |-
 | align="center"| MailStore Server
-| align="center"| mailstore
+| align="center"| mailstore.example.com
 | align="center"| 8462
 | <code><nowiki>https://mailstore.example.com:8462/oidc/signin</nowiki></code><br/><br/>Redirect URI with fully qualified domain name and MailStore Web Access default port.
 |-
 | align="center"| MailStore Server
-| align="center"| mailstore
+| align="center"| mailstore.example.com
 | align="center"| 443
 | <code><nowiki>https://mailstore.example.com/oidc/signin</nowiki></code><br/><br/>If the HTTPS default port 443 is used for MailStore Web Access or as source of a port forwarding rule on a firewall, specifying the port as part of the redirect URI can be omitted.
 |-
 | align="center"| MailStore SPE
-| align="center"| archive
+| align="center"| archive.example.com
 | align="center"| 443
 | <code><nowiki>https://archive.example.com/<instanceid>/oidc/signin</nowiki></code><br/><br/>The ''instanceid'' of the instance is part of the Redirect URI.