Google Groups Setup

Google Groups Authorization

For fine-grained authorization control when using Google authentication a Google Groups lookup provider is provided. This is very handy if your development group already using groups mailing lists.

The setup is a bit tricky, but the basic setups are:

1. Create a Google APIs service account
2. Edit JSON credentials file to add permissioned groups
3. Add Google G-Suite permissions to the service account
4. Run the cloudfront-auth build to bundle the authentication provider into the Lambda ZIP

Setup

1. Perform the following steps using the Google Developers Console
   • Select the Project you created following the main README
   • On the Dashboard page, choose Enable APIs and Services
   • Enable two services: Admin SDK and Google+ API
   • On the Credentials page select Service account key from the Create credentials menu
   • Choose New service account for the Service Account and enter a name (e.g groups-query); set Role selector to Project --> Viewer; set key type to JSON
   • Clicking create will download a JSON file; save the file as in your cloned cloudfront-auth project directory as google-authz.json
   • Edit the JSON file and add the key cloudfront_authz_groups with an array of groups to be checked: "cloudfront_authz_groups": [ "[email protected]", "[email protected]" ]. (Don't forget the comma required to separate key/value pairs. Use a JSON validator to ensure your file has no syntax errors.)

{
  "type": "service_account",
  "project_id": "example",
  "private_key_id": "h54h8t1eg65s1d6fg1re81r651g",
  "private_key": "-----BEGIN PRIVATE KEY-----\ndh54et5aa4rg5d4fht5e4h5d4fg5sdf54h5sh65s1651h51s\n-----END PRIVATE KEY-----\n",
  "client_email": "[email protected]",
  "client_id": "452521516513132321315",
  "auth_uri": "https://accounts.google.com/o/oauth2/auth",
  "token_uri": "https://accounts.google.com/o/oauth2/token",
  "auth_provider_x509_cert_url": "https://www.googleapis.com/oauth2/v1/certs",
  "client_x509_cert_url": "https://www.googleapis.com/robot/v1/metadata/x509/cloudfront-google-authz%40example.iam.gserviceaccount.com",
  "cloudfront_authz_groups": [ "[email protected]", "[email protected]" ]
}

1. Perform the following setup as an administrator using the G-Suite Console

2. When building ZIP:

   • Choose Google Groups Lookup as the authorization method
   • For Service Account Email enter an email address that the service account will impersonate to query the Groups API.