Google Workspace sync and Single Sign-On

This guide will walk you through the entire setup – from creating a service account to configuring the necessary APIs and OAuth credentials.

By completing these steps, you’ll enable CyberPilot to securely sync user and group data from your Google Workspace environment and allow users to log in to the CyberPilot platform using their Google accounts.

Let’s get started 👇

 

---

 

Prerequisites

Before you get started with this guide, make sure you have:

• Super Admin access to Google Admin Console (admin.google.com)

• Owner or Editor access to Google Cloud Console (console.cloud.google.com)

• Admin access to your CyberPilot account

• Your CyberPilot subdomain (find it under Settings > Account > General)

 

---

 

Part 1: Check your subdomain

Google Single Sign-On (SSO) and Google Workspace sync both need a subdomain on your CyberPilot account. New accounts get a subdomain automatically when they are created.

1. In CyberPilot, go to Settings › Account › General.
2. Check that a subdomain is shown.

If no subdomain is shown, contact your Customer Success Manager before you continue. Older accounts may need a subdomain added.

 

---

 

Part 2: Generate the Google config

To integrate Google Workspace with CyberPilot, you'll need to create a service account in Google Cloud Console. This enables CyberPilot to securely manage users and groups via API.

1. Create a project in Google Cloud Console

1. Go to: https://console.cloud.google.com/

2. Click the project dropdown and select "New Project"

3. Name it (e.g., CyberPilot) and click Create

2. Enable Admin SDK API

1. In your new project, go to APIs & Services > Library

2. Search for Admin SDK

3. Click it, then click Enable

3. Create a service account

1. Navigate to IAM & Admin > Service Accounts

2. Click Create Service Account

3. Name it, then click Create and Continue

4. Grant the role: Service Account Token Creator

5. Click Done

4. Generate a private key

1. Click on the service account you just created

2. Go to the Keys tab

3. Click Add Key > Create New Key

4. Choose JSON format

This will download a .json file containing:

• client_id
• client_email
• private_key

5. Delegate domain-wide authority

1. Under the service account settings, go to the Details tab

2. Click "Show Domain-Wide Delegation" and enable it

3. Note the Client ID – you’ll need it in the next step

6. Authorize API access in Google Admin Console

1. Go to: https://admin.google.com (requires super admin)

2. Navigate to: Security > Access and data control > API Controls > Domain-wide Delegation

   
   
   

3. Click "Add new"
   
   
   

4. Enter the Client ID from your service account

5. Add the following scopes:

   1. https://www.googleapis.com/auth/admin.directory.user.readonly

   2. https://www.googleapis.com/auth/admin.directory.group.readonly

   3. https://www.googleapis.com/auth/admin.directory.group.member.readonly

6. Click Save

7. Save the JSON key file

Keep the JSON key file somewhere safe. You upload the file to CyberPilot in Part 4. You don't need to copy or paste the private key.

---

Part 3: Set up and manage Google groups

You need to define which users will be synced to CyberPilot.
This is done through Google Groups. CyberPilot uses these groups to automatically identify and manage which users should be added or removed from your CyberPilot account.

1. Create or Select a Google Group

1. Go to your Google Admin Console

2. Navigate to Directory > Groups
   
   
   

3. Click Create Group

4. Enter a clear and descriptive name. For example:

   1. cyberpilot-users@example.com

5. Click Create
   
   

 

 

2. Add Members to the Group

1. Open the group you just created

2. Click Add Members

3. Enter the email addresses of the users you want to include

4. Assign each as Member, Manager, or Owner

 

Which users Google Workspace sync includes

• Google Workspace sync only includes users who are direct members of the group. If the group contains another group, the users in that nested group aren't synced, and the nested group can cause the sync to report an error. Add users to the group directly.
• Google Workspace sync doesn't use organizational units. Only group membership decides who is synced.

You can update group membership at any time, and CyberPilot will automatically reflect those changes during the next sync.

3. Find the group ID

Each Google Group has a unique Group ID that CyberPilot uses to identify which group(s) should be synced.
You’ll need to copy this ID and add it to your CyberPilot configuration.

Follow these steps:

1. Go to the Google Admin Console

2. Open Directory > Groups

3. Find and select the group you want to use

4. Look at the URL in your browser – the Group ID is included there

Example URL:

In this example, the Group ID is: 

 

 

---

Part 4: Add the Google group in CyberPilot

Once you have the Group ID from Part 3, connect the Google group to CyberPilot. Google Workspace sync then creates and updates users in CyberPilot automatically.

1. Log in to CyberPilot.
2. Go to Settings › Account.
3. Open the Integrations tab.
4. Select Google.
5. Under Google Config, select User Management.
6. Upload the JSON key file you downloaded in Part 2.
7. Select Enable Google Workspace sync.
8. Fill in the fields:
   • Google Workspace Group Object ID: paste the Group ID from Part 3.
   • Add to: choose where new users are placed in CyberPilot: the account, a branch or a group.
   • Default language: choose the language for new users.
9. Optional: to place users from different Google groups in different branches or groups, click + New mapping under Google Workspace Group to CyberPilot mapping. The branch or group must already exist in CyberPilot.
10. Click Sync now.

---

Part 5: Set up Google SSO

This part lets users log in to CyberPilot with their Google account using Single Sign-On (SSO).

Before you set up Google SSO

• The CyberPilot username of each user must be the same as their Google email. If the two don't match, the user can't log in with Google SSO.
• Keep at least one admin on manual login. To do this, open the admin in Users, click Edit and select Use manual login. If Google SSO is set up incorrectly, users on manual login can still log in at app.cyberpilot.io.
• Two-factor authentication for Google SSO users comes from your Google account. CyberPilot doesn't add a second login step.
  
  

1. Open Google Cloud Console Credentials

1. Go to: https://console.cloud.google.com/apis/credentials

2. Select the same project you created in Part 2.

2. Configure the OAuth consent screen

1. In the left sidebare, go to APIs & Services
2. Select OAuth consent screen
   
   
   

3. Under User type, select Internal.

4. Click create

5. Fill in the required fields:
   1. App name: for example, CyberPilot
   2. User support email: select your admin email adress from the dropdown
6. Scroll down to Developer contact information and enter your email adress
7. Click save and continue

8. On the Scopes page, click Save and continue. You don't need to add any scopes.

9. Click Back to dashboard to finish
   
   

3. Create OAuth 2.0 Credentials

1. Go to APIs & Services > Credentials

2. Click + Create Credentials > OAuth 2.0 Client ID

3. Select Web application

4. Give it a name (e.g., CyberPilot SSO)

4. Add the redirect URI in Google

1. Under Authorized redirect URIs, add this URI. Replace subdomain with your CyberPilot subdomain from Settings › Account › General: https://login.app.cyberpilot.io/realms/*subdomain*/broker/google-sso/endpoint

2.  

   If your CyberPilot account is set up through a partner, such as itm8, the redirect URI uses your partner’s login address instead. Your partner or your Customer Success Manager can confirm the correct address. 
   
   

3. Click Save

4. Copy the Client ID and Client Secret from the confirmation dialog
   
   

   

5. In CyberPilot, go to Settings > Account > Integrations > Google
   
   
6. Under the SSO section, paste your Client ID and Client Secret
7. Click Save. Google SSO is turned on for your account.
   
   

Check that Google SSO works

Open your CyberPilot login page in a private browser window and log in with a Google account whose email matches a CyberPilot username. You are sent to Google and then back to CyberPilot.

 

Still have a question?

Contact us at support@cyberpilot.io