Configure Connection

Google Workspace guide

Follow this focused guide to configure and validate Google Workspace in NIM.

1. Go to Systems > Overview.
2. Click Add.
3. Select Google for System Type.
4. Enter a System Name.
5. Click Save.
6. The new system is added to the Configured Systems pane.
7. In a new tab, go to the Google Cloud Platform console at https://console.cloud.google.com/.
8. Create a new project named NIM and switch to it.
9. Open Cloud Shell
10. Run the following commands - gcloud services enable admin.googleapis.com - gcloud services enable groupssettings.googleapis.com - gcloud services enable licensing.googleapis.com - gcloud services enable drive.googleapis.com - gcloud services enable gmail.googleapis.com - gcloud services enable classroom.googleapis.com
11. Expand the menu and go to APIs & Services > OAuth Consent Screen.
12. Select the Internal user type and click Create. Enter NIM for the App Name. Enter a relevant User Support Email and Developer Email Address. Click Save And Continue.
13. On the Scopes page, click Save And Continue.
14. On the Summary page, click Back To Dashboard.
15. Expand the menu and go to APIs & Services > Credentials.
16. Click Create Credentials > Service Account.
17. For the Service Account Name, enter NIM. Accept the default generated Service Account ID value. Click Create and Continue. Click Done.
18. Click the pencil icon to edit the newly created NIM service account. On the Details tab, Copy the Email and Unique ID to a local text editor application.
19. Go to the Keys tab. Click Add Key > Create New Key. Select P12. Click Create. The .p12 file is downloaded. Copy the Private Key Password (notasecret) to a local text editor application. Click Close.
20. Go to the Google Admin Console at https://admin.google.com/.
21. Go to Security > Access > API Controls.
22. Click Manage Domain-Wide Delegation.
23. Click Add New.
24. Paste the Unique ID you copied earlier into the Client ID field.
25. In the OAuth Scopes (Comma-Delimited) field:

https://www.googleapis.com/auth/admin.datatransfer,https://www.googleapis.com/auth/admin.datatransfer.readonly,https://www.googleapis.com/auth/admin.directory.device.chromeos,https://www.googleapis.com/auth/admin.directory.device.chromeos.readonly,https://www.googleapis.com/auth/admin.directory.device.mobile,https://www.googleapis.com/auth/admin.directory.device.mobile.readonly,https://www.googleapis.com/auth/admin.directory.group,https://www.googleapis.com/auth/admin.directory.group.readonly,https://www.googleapis.com/auth/admin.directory.orgunit,https://www.googleapis.com/auth/admin.directory.orgunit.readonly,https://www.googleapis.com/auth/admin.directory.rolemanagement,https://www.googleapis.com/auth/admin.directory.rolemanagement.readonly,https://www.googleapis.com/auth/admin.directory.user,https://www.googleapis.com/auth/admin.directory.user.readonly,https://www.googleapis.com/auth/admin.directory.user.security,https://www.googleapis.com/auth/admin.directory.userschema,https://www.googleapis.com/auth/apps.groups.settings,https://www.googleapis.com/auth/apps.licensing,https://www.googleapis.com/auth/classroom.courses,https://www.googleapis.com/auth/classroom.courses.readonly,https://www.googleapis.com/auth/classroom.guardianlinks.students,https://www.googleapis.com/auth/classroom.guardianlinks.students.readonly,https://www.googleapis.com/auth/classroom.rosters,https://www.googleapis.com/auth/classroom.rosters.readonly,https://www.googleapis.com/auth/drive,https://www.googleapis.com/auth/drive.readonly,https://www.googleapis.com/auth/gmail.settings.basic,https://www.googleapis.com/auth/gmail.settings.sharing,https://www.googleapis.com/auth/gmail.readonly,https://www.googleapis.com/auth/gmail.labels

26. Click Authorize. The new OAuth application is added with the scopes.
27. Go to Account > Account Settings > Copy Customer ID
28. Return to your NIM browser tab. Add a certificate using the .p12 certificate you downloaded earlier, and the password you copied (notasecret). Name the certificate Google.
29. In NIM, edit the Google system you created previously. See Edit a system.
30. For the Application (Client) ID, paste the service account Email you copied previously. For the Directory (Tenant) ID, enter the email address you use to log in to Google Cloud Platform. For the Certificate, select the Google certificate you just added. For Customer ID, paste the Customer ID you copied previously. :::info The account used for the Directory (Tenant) ID must possess, at a minimum, the following roles/permissions within your Google Workspace tenant: - User Management Admin (Built-In) - Groups Admin (Built-In) - License Admin (You must create this) :::
31. Click Save.
32. Click Test Connection. A success message is returned.