Google Workspace

Opal natively supports an integration with Google Workspace. This integration enables organizations to manage access to default and custom admin roles.

Configuration

1. Go to Inventory and select + App to add the Google Workspace App.

2. For Opal to manage your Google Workspace on your behalf, you'll need to create a Google service account with proper permission scopes to retrieve role and user information. Grant the service account the following scopes:

https://www.googleapis.com/auth/admin.directory.user, 
https://www.googleapis.com/auth/admin.directory.rolemanagement

The admin.directory.user scope is used to import users, and the admin.directory.rolemanagement scope is used to update user access.

3. Enable the Admin SDK API in the project that the service account was created in.

📘

In Google, role assignment privileges are only available to super administrator role. Opal needs the Google Workspace admin email to be a super administrator in order to import admin roles.

4. In Opal, the Google Workspace admin email should be a user with the Super Admin Role in order for the service account to read role assignments. You can find super admins in the admin console under Admin Roles > Super Admin. This email is not your service account email.

Run app validation checks

After you save your app, you can view existing sync issues from the Setup tab on the app detail page. Missing permissions and sync issues show in the App Validations section. Select the refresh icon to rerun validation checks.

You can hover over the validation icons to learn why Opal needs a given permission. To correctly sync your app to Opal, ensure you address any sync errors, marked with the red ! icon. Inspect warnings on a case-by-case basis: warnings might impact features you’re not using and may be safely ignored, but this depends on your use case.