GSuite APIs & Services registration

GSuite offers integration through oAuth-2 APIs. This guide will cover the steps needed to grant your LibraCyber Email Security Gateway permissions on your Gsuite Tenant. No changes are made to the GSuite Tenant itself by LibraCyber Email Security Gateway.

GSuite Tenant prepare

1. Open Google Developer Console (https://console.developers.google.com/) and log in with your GSuite credentials
2. From the Drop, Down menu select your Organization and then CREATE a PROJECT                     

   

3. Create a New Project called LibraCyber ESG                                                                                               

   

   S

4. Select the project Just created
5. Enable the Admin SDK API
   1. Search for “Admin SDK API” using the top search bar
   2. Click on the first result “Admin SDK API“
   3. Enable it
6. Enable the Gmail API if you want to use the Threat Remediation
   1. Search for “Gmail API” using the top search bar
   2. Click on the first result “Gmail API“
   3. Enable it
7. Enable “OAuth consent screen”
   1. From the Navigation Menu, go to API and Services -> OAuth consent screen
   2. Select User Type “Internal” and click “Create”
   3. Enter the Application name, call it “LibraCyber ESG”
   4. Provide a “User support email” & the “Developer contact information”
   5. Click Save & Continue
   6. Do not provide any Scopes and click “Save & Continue” again
   7. Click BACK TO DASHBOARD

OAuth2 Client ID and Secret

1. Go to the “APIs and Services -> Credentials” menu
2. Choose “Create Credentials” -> “OAuth Client ID”
3. Choose “Web application” as the type
4. Call it “LibraCyber ESG Authentication”
5. Add HTTPS://<esg public fqdn>/oauth-login as “Authorized redirect URI” and click Create
6. Take note of the Client ID and Client Secret

Service Account

×The step 3 is also described on this official google documentation page: https://developers.google.com/admin-sdk/directory/v1/guides/delegation

1. Create a new service account
   1. From the Navigation Menu, go to IAM & Admin – Service Accounts
   2. Click Create Service Account
   3. Call it libraesvaesg
   4. Continue with the default settings and Save
   5. Take note of the Service Account Email
2. Obtain a key for the service account
   1. Click on the “Service Account” created above
   2. Take note of the Unique Id
   3. Select “ADD KEY” -> “Create new key”
   4. Select “JSON” type
   5. Generate it and download the JSON key
   6. Open the JSON file with a text editor and take note of the private_key inside the quotation marks
3. Allow the service account to access your directory
   1. Go to your GSuite Administration console (https://admin.google.com/)
   2. Click on “Security -> Access and data control->API Controls ->Manage Domain Wide Delegation”
   3. Add a record with “Add New”
   4. Fill the “Client ID” field with the Unique Id copied before
   5. Copy the following text and paste it into the “Oauth Scopes” field https://www.googleapis.com/auth/admin.directory.user,https://www.googleapis.com/auth/admin.directory.group
   6. Provide also the https://mail.google.com/ scope to give the necessary permissions for the Threat Remediation
   7. Click authorize

G Suite tenant ID

Find your Organization Id by going to this page https://play.google.com/work/adminsettings?pli=1 (you can also find it in the Admin console, check the following guide https://krypted.com/uncategorized/get-your-customerid-from-g-suite/ )

Settings for Threat Remediation

×NOTE: Follow this guide if you have already created a G Suite Connector and you want to only add the permission needed for the Threat Remediation

1. Enable the Gmail API
   1. Open Google Developer Console (https://console.developers.google.com/) and log in with your GSuite credentials
   2. From the Drop Down menu, select the Project created for the G Suite Connector
   3. Search for “Gmail API” using the top search bar
   4. Click on the first result “Gmail API“
   5. Enable it
2. Add the scope needed for the email recall
   1. Go to your GSuite Administration console (https://admin.google.com/)
   2. Click on “Security -> API Controls -> Manage Domain Wide Delegation”
   3. Find the Service account already create by “Client ID” and click Edit
   4. Add the https://mail.google.com/ scope
   5. Click authorize