Google Workspace

BlokSec enables passwordless login to Google Workspace and also supports automatic user provisioning via the Google Directory API. This guide covers both the authentication setup (SAML) and optional provisioning configuration.

Prerequisites

• A BlokSec admin account with permission to create applications
• A Google Workspace account with Super Administrator access
• A Google Cloud project (required for provisioning only)

---

Part 1 — Authentication

1. Create the Google Workspace application in BlokSec

1. Sign in to the BlokSec admin console as a user with admin privileges
2. From the dashboard, click + Add Application and select Create From Template
3. Select the Google Workspace template
4. Complete the application details with the following values, replacing <your_domain> with your Google Workspace domain (for example, acme.com):

Field	Value
Name	Google Workspace (or your preferred name)
Entity ID	https://www.google.com/a/<your_domain>/acs
NameID Source	Account name
Assertion Consumer Service	https://www.google.com/a/<your_domain>/acs
Name ID Format	EmailAddress

5. Click Submit to save the configuration
6. Click View Cert and copy the certificate — save it to a file (for example, BlokSecGoogleCert.pem)
7. Note the SSO URI — you will need it in the next step

2. Configure SSO in the Google Workspace admin console

1. Sign in to the Google Workspace admin console as a Super Administrator
2. Navigate to Security → Authentication → SSO with third-party IdP
3. Click Add SSO profile and enter the following values:

Field	Value
Sign-in page URL	SSO URI from BlokSec (noted in step 7 above)
Sign-out page URL	https://mail.google.com/a/<your_domain>
Verification certificate	Upload BlokSecGoogleCert.pem from step 6 above

4. Click Save

Tip

Once SSO is configured, users access their passwordless Google Workspace login at https://mail.google.com/a/<your_domain>. Share this URL with your users — navigating directly to it initiates the BlokSec authentication flow.

Verify the authentication integration

1. Open a private/incognito browser window
2. Navigate to https://mail.google.com/a/<your_domain>
3. Approve the sign-in on the BlokSec mobile app
4. Confirm you are successfully signed in to Google Workspace

Test before rolling out

Verify authentication with a single user account before enabling SSO for your entire domain. Make sure the test user has the BlokSec app installed and their account fully provisioned in BlokSec.

---

Part 2 — Provisioning (optional)

Provisioning allows BlokSec to automatically create Google Workspace user accounts when a new user is registered in BlokSec, eliminating the need to create accounts in both systems separately.

1. Create OAuth 2.0 credentials in Google Cloud

1. Sign in to the Google Cloud Console and open your project
2. Navigate to APIs & Services → Credentials
3. Click Create Credentials and select OAuth 2.0 Client ID
4. Choose Web application as the application type
5. Under Authorized JavaScript origins, add: https://api.bloksec.io
6. Under Authorized redirect URIs, add: https://api.bloksec.io/oauth2callback
7. Click Create, then download the generated JSON credentials file

Note

Make sure the Admin SDK Directory API is enabled in your Google Cloud project. BlokSec uses this API to create and update user accounts in your Google Workspace directory.

2. Generate a refresh token

BlokSec requires a long-lived refresh token to make authenticated calls to the Google Directory API on behalf of your domain.

1. Go to Google OAuth 2.0 Playground
2. Click the gear icon (Settings) and check Use your own OAuth credentials
3. Enter the Client ID and Client Secret from the JSON file downloaded above
4. In the scope list, authorize: https://www.googleapis.com/auth/admin.directory.user
5. Click Authorize APIs and complete the sign-in with your Super Administrator account
6. Click Exchange authorization code for tokens
7. Copy the Refresh token from the response

3. Enable provisioning in BlokSec

1. In the BlokSec admin console, open the Google Workspace application and click the gear icon → Edit Application
2. Navigate to the Provisioning tab
3. Enable provisioning and set the integration type to Google Directory API
4. Open the JSON credentials file downloaded from Google Cloud and add the refresh token as a new field:

{
  "client_id": "YOUR_CLIENT_ID",
  "client_secret": "YOUR_CLIENT_SECRET",
  "refresh_token": "PASTE_REFRESH_TOKEN_HERE",
  ...
}

5. Paste the complete JSON (with the refresh_token field added) into the provisioning credentials field
6. Click Submit to save

Tip

Once provisioning is enabled, new users registered in BlokSec will automatically have a Google Workspace account created in your domain. The user’s first name, last name, and email are synced from BlokSec to Google Workspace on first login.