Admin ConsoleUser Management

Sync with Google Workspace

This article will help you get started using Directory Connector to sync users and groups from your Google Workspace (formerly "G Suite") Directory to your Bitwarden organization.

Google Workspace setup

To setup directory sync with Google Workspace (formerly "G Suite"), you will need access to the Google Workspace Admin Portal and Google Cloud Platform Console. Directory Connector will require information obtained from these processes to function properly.

Create a cloud project

Complete the following steps to create a Google Cloud project to use to connect Directory Connector to your directory. If you already have a Google Cloud project available, skip to Enable Admin SDK:

  1. In the GCP Console, select the Create Project button.

  2. Enter a Bitwarden-specific name for the project (for example, bitwarden-dc-project) and select the Create button.

Enable Admin SDK

Complete the following steps to enable the Admin SDK API, to which Directory Connector will make requests:

  1. In the GCP Console, select the created or pre-existing project.

  2. From the left-hand navigation, select APIs & ServicesLibrary.

  3. In the search box, enter Admin SDK and open the Admin SDK API service.

  4. Select the Enable button.

Create service account

Complete the following steps to create a service account to use when making API calls:

  1. In the GCP Console, select the created or pre-existing project.

  2. From the left-hand navigation, select APIs & ServicesCredentials.

  3. Select the Create Credentials button, and select Service account from the dropdown.

  4. Fill in the Service account details section, and select the Create button.

  5. In the Grant this service account access to project section, select Project → Owner from the Role dropdown and select the Continue button.

  6. Select the Done button.

Obtain service account credentials

Complete the following steps to obtain the appropriate permissions for the created service account:

  1. In the GCP Console, select the created or pre-existing project.

  2. From the left-hand navigation, select IAM & AdminService Accounts.

  3. Select the created service account.

  4. On the Service Account Details page, select the Add Key button and select Create new key from the dropdown.

  5. Select the Key type JSON and select the Create button to download a JSON-formatted key to your local machine.

  6. Back on the details page of your service account, select the Show Domain-wide Delegation dropdown.

  7. Follow these steps to enable delegate domain-wide authority.

  8. Enter a Product name for the consent screen.

  9. Select Save.

Allow read-access to Google Workspace

Complete the following steps to authorize the client to read your directory:

  1. Open the Google Admin Portal.

  2. From the left-hand navigation, select SecurityAPI Controls.

  3. Select the Manage Domain Wide Delegation button.

  4. Select the Add new button.

  5. In the Client ID field, paste the created Client ID.

    To retrieve the created Client ID, open the GCP Console and navigate to API & ServicesCredentials.

  6. In the OAuth scopes field, paste the following value to grant only read-access:

    Bash
    https://www.googleapis.com/auth/admin.directory.user.readonly,https://www.googleapis.com/auth/admin.directory.group.readonly,https://www.googleapis.com/auth/admin.directory.group.member.readonly
  7. Select the Authorize button.

Connect to your directory

Complete the following steps to configure Directory Connector to use your Google directory:

  1. Open the Directory Connector desktop app.

  2. Navigate to the Settings tab.

  3. From the Type dropdown, select G Suite (Google).

    The available fields in this section will change according to your selected type.

  4. Enter the Domain of your Google account.

  5. Enter the email address of an Admin User with full access to your Google directory.

  6. If you have one, enter the Customer ID of your directory. Many users will not have or be required to enter a Customer ID.

  7. Select the Choose File button and select the downloaded JSON key.

Configure sync options

チップ

When you're finished configuring, navigate to the More tab and select the Clear Sync Cache button to prevent potential conflicts with prior sync operations. For more information, see Clear Sync Cache.

Complete the following steps to configure the setting used when syncing using Directory Connector:

  1. Open the Directory Connector desktop app.

  2. Navigate to the Settings tab.

  3. In the Sync section, confiture the following options as desired:

Option

Description

Interval

Time between automatic sync checks (in minutes).

Remove disabled users during sync

Check this box to remove users from the Bitwarden organization that have been disabled in your directory.

Overwrite existing organization users based on current sync settings

Check this box to always perform a full sync and remove any users from the Bitwarden organization if they are not in the synced user set.

More than 2000 users or groups are expected to sync

Check this box if you expect to sync 2000+ users or groups. If you don't check this box, Directory Connector will limit a sync at 2000 users or groups.

Sync users

Check this box to sync users to your organization.

Checking this box will allow you to specify a User Filter.

User Filter

See Specify sync filters.

Sync groups

Check this box to sync groups to your organization.

Checking this box will allow you to specify a Group Filter.

Group Filter

See Specify sync filters.

Specify sync filters

Use comma-separated lists to include or exclude from a sync based on user email or group.

The Admin SDK API provides limited filtering capabilities for users and groups with a query parameter. To learn more:

User filters

The following filtering syntaxes should be used in the User Filter field:

Include/Exclude users by email

To include or exclude specific users from a sync based on email address:

Bash
include:joe@example.com,bill@example.com,tom@example.com
Bash
exclude:joe@example.com,bill@example,tom@example.com
Concatenate with query

To concatenate a user filter with the query parameter, use a pipe (|):

Bash
include:john@example.com,bill@example.com|orgName=Engineering orgTitle:Manager
Bash
exclude:john@example.com,bill@example.com|orgName=Engineering orgTitle:Manager
Use only query

To use only the query parameter, prefix the query with a pipe (|):

Bash
|orgName=Engineering orgTitle:Manager

Group filters

備考

Syncing nested groups is not supported by Google Workspace.

The following filtering syntaxes should be used in the Group Filter field:

Include/Exclude groups

To include or exclude groups from a sync based on Group Name:

Bash
include:Group A,Group B
Bash
exclude:Group A,Group B
Include groups with wildcard
Bash
|name:*marketing*

Wildcards * are supported on both sides of the search parameter. Additionally, the search is not case sensitive.

Concatenate with query

To concatenate a group filter with the query parameter, use a pipe (|):

Bash
include:name='Engineering'|email:admin*
Bash
exclude:name='Engineering'|email:admin*
Use only query

To use only the query parameter, prefix the query with a pipe (|):

Bash
|memberKey=user@company.com

Test a sync

チップ

Before testing or executing a sync, check that Directory Connector is connected to the right cloud server (e.g. US or EU) or self-hosted server. Learn how to do so with the desktop app or CLI.

To test whether Directory Connector will successfully connect to your directory and return the desired users and groups, navigate to the Dashboard tab and select the Test Now button. If successful, users and groups will be printed to the Directory Connector window according to the specified sync options and filters:

Test sync results
Test sync results

Start automatic sync

Once sync options and filters are configured and tested, you can begin syncing. Complete the following steps to start automatic syncing with Directory Connector:

  1. Open the Directory Connector desktop app.

  2. Navigate to the Dashboard tab.

  3. In the Sync section, select the Start sync button.

    You may alternatively select the Sync now button to execute a one-time manual sync.

Directory Connector will begin polling your directory based on the configured sync options and filters.

If you exit or close the application, automatic sync will stop. To keep Directory Connector running in the background, minimize the application or hide it to the system tray.

備考

If you on the Teams Starter plan, you are limited to 10 members. Directory Connector will display an error and stop syncing if you try to sync more than 10 members.

Make a suggestion to this page

サポートチームへのお問い合わせ

For technical, billing, product, and Family/Premium questions.

お名前*
ビットワルデン*
アカウントのメールアドレスを確認してください*
製品*
あなたは自己ホスト型ですか?*
件名*
お問い合わせ内容を入力してください...*

クラウドのステータス

ステータスを確認する

© 2024 Bitwarden, Inc. 利用規約 プライバシー クッキーの設定 サイトマップ

このサイトは日本語でご利用いただけます。
Go to EnglishStay Here