Skip to content

Commit e65cd4a

Browse files
OVH-Team-GuidesOVH-Team-Guides
authored
Merge pull request #4469 from ovh/develop
Develop > Master deployment
2 parents 369968f + 6b41959 commit e65cd4a

File tree

279 files changed

+2318
-1171
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

279 files changed

+2318
-1171
lines changed

‎pages/account/customer/ovhcloud-account-connect-google-workspace/guide.en-asia.md

Lines changed: 192 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,192 @@
1+
---
2+
title: Enabling Google Workspace SSO connections with your OVHcloud account
3+
slug: connect-sso-googleworkspace
4+
excerpt: "Learn how to associate your Google Workspace service with your OVHcloud account via SAML 2.0"
5+
section: Advanced Usage
6+
order: 02
7+
updated: 2023-03-30
8+
---
9+
10+
**Last updated 30th March 2023**
11+
12+
## Objective
13+
14+
You can use unique **single sign-on** (SSO) to sign in to your OVHcloud account. To enable these connections, your account and Google Workspace accounts have to be configured using Security Assertion Markup Language (SAML) authentication.
15+
16+
**This guide explains how to associate your OVHcloud account with an external Google Workspace service.**
17+
18+
## Requirements
19+
20+
- Being an administrator of a Google Workspace service
21+
- An [OVHcloud account](https://docs.ovh.com/asia/en/customer/create-ovhcloud-account/)
22+
- Access to the [OVHcloud Control Panel](https://ca.ovh.com/auth/?action=gotomanager&from=https://www.ovh.com/asia/&ovhSubsidiary=asia)
23+
24+
## Instructions
25+
26+
> [!primary]
27+
>
28+
> In order for a service provider (i.e. your OVHcloud account) to establish an SSO connection with an identity provider (i.e. your Google Workspace service), the key is to establish a mutual trust relationship by registering the SSO connection in both services.
29+
>
30+
31+
### Registering OVHcloud into Google Workspace
32+
33+
Your Google Workspace acts as an identity provider. Requests to authenticate your OVHcloud account will only be accepted if you have first declared it as a trusted third party.
34+
35+
This means that it must be added as `Web and mobile apps`.
36+
37+
Log in to the [Google Workspace](https://admin.google.com) administration interface with your administrator account.
38+
39+
Go to `Apps`{.action} then `Web and mobile apps`{.action}.
40+
41+
![Add Web or mobile app](images/google_workspace_web_mobile_add_saml_app.png){.thumbnail}
42+
43+
Click `Add app`{.action} then `Add custom SAML app`{.action}.
44+
45+
In the "App details" step, add a name for this interconnection, **OVHcloud** for example. Click `Continue`{.action}.
46+
47+
![Add SAML Application, Step 1](images/google_workspace_web_mobile_add_saml_app_step1.png){.thumbnail}
48+
49+
In the step "Google Identity Provider details", download the metadata file by clicking `Download metadata`{.action} then click `Continue`{.action}.
50+
51+
![Add SAML Application, Step 2](images/google_workspace_web_mobile_add_saml_app_step2.png){.thumbnail}
52+
53+
In the step "Service provider details", complete the `ACS URL` and `Entity ID` fields with the values for your region:
54+
55+
- EU region: **ACS URL**: `https://www.ovhcloud.com/eu/auth/saml/acs` and **Entity ID**: `https://www.ovhcloud.com/eu/auth/`
56+
- CA region: **ACS URL**: `https://www.ovhcloud.com/ca/auth/saml/acs` and **Entity ID**: `https://www.ovhcloud.com/ca/auth/`
57+
58+
Click `Continue`{.action}.
59+
60+
![Add SAML application, step 3](images/google_workspace_web_mobile_add_saml_app_step3.png){.thumbnail}
61+
62+
In the "Attribute mapping" step, add the following mapping:
63+
64+
- **First Name**: Name
65+
- **Last Name**: Surname
66+
- **Primary email**: E-mail Address
67+
68+
Click `Finish`{.action}.
69+
70+
![Add SAML application, step 4](images/google_workspace_web_mobile_add_saml_app_step4.png){.thumbnail}
71+
72+
Enable access to this application by clicking `OFF for everyone`{.action} in the "User access" section. Click `ON for everyone`{.action} then the `SAVE`{.action} button.
73+
74+
![Enable app for all users](images/google_workspace_web_mobile_enable_app1.png){.thumbnail}
75+
76+
![Enable app for all users](images/google_workspace_web_mobile_enable_app2.png){.thumbnail}
77+
78+
> [!primary]
79+
>
80+
> Adding application access to users can take several hours to take effect.
81+
>
82+
83+
Your Google Workspace service now trusts OVHcloud as a service provider. The next step is to ensure that the OVHcloud account trusts your Google Workspace as an identity provider.
84+
85+
### Registering Google Workspace into the OVHcloud account and configuring the connection
86+
87+
To add Google workspace as a trusted identity provider, you need to provide the identity provider metadata in the [OVHcloud Control Panel](https://ca.ovh.com/auth/?action=gotomanager&from=https://www.ovh.com/asia/&ovhSubsidiary=asia).
88+
89+
Once logged in, click your profile at the top right.
90+
91+
![Top menu OVHcloud](images/ovhcloud_top_menu.png){.thumbnail}
92+
93+
Click on your name to access your profile management page.
94+
95+
![OVHcloud User Information](images/ovhcloud_user_infos.png){.thumbnail}
96+
97+
Open the `User Management`{.action} tab.
98+
99+
![OVHcloud menu profile](images/ovhcloud_profile_menu.png){.thumbnail}
100+
101+
Click the `SSO Login`{.action} button.
102+
103+
![OVHcloud SSO connection step 1](images/ovhcloud_user_management_connect_sso_1.png){.thumbnail}
104+
105+
Fill in the XML metadata of your Google Workspace service. Enter `Group` as the "Group Attribute Name". Click `Confirm`{.action}.
106+
107+
![OVHcloud SSO connection step 2](images/ovhcloud_user_management_connect_sso_2.png){.thumbnail}
108+
109+
Now you need to retrieve your Google Workspace as identity provider, as well as default groups.
110+
111+
![OVHcloud SSO connection step 3](images/ovhcloud_user_management_connect_sso_3.png){.thumbnail}
112+
113+
For more information, click on the link under “SSO Service URL”.
114+
115+
![OVHcloud SSO connection step 4](images/ovhcloud_user_management_connect_sso_4.png){.thumbnail}
116+
117+
The `...`{.action} button allows you to update or delete the SSO, and view its details.
118+
119+
![OVHcloud SSO connection step 5](images/ovhcloud_user_management_connect_sso_5.png){.thumbnail}
120+
121+
Your Google Workspace is now considered a trusted identity provider. However, you still need to add groups to your OVHcloud account.
122+
123+
> [!warning]
124+
> If you try to connect via SSO at this point, you will probably receive a `Not in valid groups` error message.
125+
>
126+
> That is because your OVHcloud account checks whether the authenticating user belongs to an existing group on the account.
127+
>
128+
129+
To resolve this, authorise the groups that will be transmitted from Google Workspace to OVHcloud. These groups are the same as those used to categorise your users.
130+
131+
To do this, log on to the [Google Workspace](https://admin.google.com) administration interface with your administrator account.
132+
133+
Go to `Apps`{.action} then `Web and mobile apps`{.action}.
134+
135+
![Manage web and mobile apps](images/google_workspace_web_mobile_add_saml_app.png){.thumbnail}
136+
137+
Click on the line for the application you added in the previous step.
138+
139+
![List of web and mobile apps](images/google_workspace_web_mobile_list_app.png){.thumbnail}
140+
141+
Click `SAML attribute mapping`{.action} to edit the mapping of information shared between Google Workspace and OVHcloud.
142+
143+
![SAML Application Detail](images/google_workspace_web_mobile_show_app.png){.thumbnail}
144+
145+
In the "Group membership (optional)" section, add any groups that you want to allow to connect to OVHcloud. In the "App attribute" field, enter `Group`.
146+
147+
You must then assign **roles** to these user groups at OVHcloud. Otherwise, your OVHcloud account does not know what the user is allowed to do and, by default, no rights are assigned.
148+
149+
![Configuring user groups](images/google_workspace_web_mobile_setup_groups.png){.thumbnail}
150+
151+
From the OVHcloud Control Panel, add a group by clicking the `Declare a group`{.action} button and filling in the fields:
152+
153+
- **Group name**: Group name within Google Workspace
154+
- **Role**: Level of rights granted to this group
155+
156+
![Google Workspace User Management Groups](images/ovhcloud_user_management_groups_1.png){.thumbnail}
157+
158+
![Google Workspace User Management Groups](images/ovhcloud_user_management_groups_2.png){.thumbnail}
159+
160+
You can then verify that the group is added to your OVHcloud account in the "Groups" section:
161+
162+
![Google Workspace User Management Groups](images/ovhcloud_user_management_groups_3.png){.thumbnail}
163+
164+
When you later log in with a user from the **Intern** group, your OVHcloud account will recognise that the user has the role "UNPRIVILEGED" specified by his group.
165+
166+
You will then be able to log out of your account and log back in with your Google Workspace as an identity provider.
167+
168+
### Connecting via SSO
169+
170+
On [the OVHcloud login page](https://ca.ovh.com/auth/?action=gotomanager&from=https://www.ovh.com/asia/&ovhSubsidiary=asia), enter your [login](https://docs.ovh.com/asia/en/customer/create-ovhcloud-account/#what-is-my-nic-handle) followed by **/idp** without a password and click the `Login`{.action} button.
171+
172+
![Connection to OVHcloud federation](images/ovhcloud_federation_login_1.png){.thumbnail}
173+
174+
You are then redirected to your Google Workspace login page. Enter the login and password for a user of your Google Workspace, then click the `Sign in`{.action} button.
175+
176+
![OVHcloud Federation login Redirection Google Workspace](images/ovhcloud_federation_login_2.png){.thumbnail}
177+
178+
You are now logged in with the same customer ID, but through your Google Workspace user.
179+
180+
![OVHcloud User Info Federation](images/ovhcloud_user_infos_federation.png){.thumbnail}
181+
182+
## Go further
183+
184+
[Creating an OVHcloud account](https://docs.ovh.com/asia/en/customer/create-ovhcloud-account/)
185+
186+
[Securing my OVHcloud account and managing my personal information](https://docs.ovh.com/asia/en/customer/all-about-your-username/)
187+
188+
[Setting and managing your account password](https://docs.ovh.com/asia/en/customer/manage-password/)
189+
190+
[Securing your OVHcloud account with two-factor authentication](https://docs.ovh.com/asia/en/customer/secure-account-with-2FA/)
191+
192+
Join our community of users on <https://community.ovh.com/en/>.

‎pages/account/customer/ovhcloud-account-connect-google-workspace/guide.en-au.md

Lines changed: 192 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,192 @@
1+
---
2+
title: Enabling Google Workspace SSO connections with your OVHcloud account
3+
slug: connect-sso-googleworkspace
4+
excerpt: "Learn how to associate your Google Workspace service with your OVHcloud account via SAML 2.0"
5+
section: Advanced Usage
6+
order: 02
7+
updated: 2023-03-30
8+
---
9+
10+
**Last updated 30th March 2023**
11+
12+
## Objective
13+
14+
You can use unique **single sign-on** (SSO) to sign in to your OVHcloud account. To enable these connections, your account and Google Workspace accounts have to be configured using Security Assertion Markup Language (SAML) authentication.
15+
16+
**This guide explains how to associate your OVHcloud account with an external Google Workspace service.**
17+
18+
## Requirements
19+
20+
- Being an administrator of a Google Workspace service
21+
- An [OVHcloud account](https://docs.ovh.com/au/en/customer/create-ovhcloud-account/)
22+
- Access to the [OVHcloud Control Panel](https://ca.ovh.com/auth/?action=gotomanager&from=https://www.ovh.com.au/&ovhSubsidiary=au)
23+
24+
## Instructions
25+
26+
> [!primary]
27+
>
28+
> In order for a service provider (i.e. your OVHcloud account) to establish an SSO connection with an identity provider (i.e. your Google Workspace service), the key is to establish a mutual trust relationship by registering the SSO connection in both services.
29+
>
30+
31+
### Registering OVHcloud into Google Workspace
32+
33+
Your Google Workspace acts as an identity provider. Requests to authenticate your OVHcloud account will only be accepted if you have first declared it as a trusted third party.
34+
35+
This means that it must be added as `Web and mobile apps`.
36+
37+
Log in to the [Google Workspace](https://admin.google.com) administration interface with your administrator account.
38+
39+
Go to `Apps`{.action} then `Web and mobile apps`{.action}.
40+
41+
![Add Web or mobile app](images/google_workspace_web_mobile_add_saml_app.png){.thumbnail}
42+
43+
Click `Add app`{.action} then `Add custom SAML app`{.action}.
44+
45+
In the "App details" step, add a name for this interconnection, **OVHcloud** for example. Click `Continue`{.action}.
46+
47+
![Add SAML Application, Step 1](images/google_workspace_web_mobile_add_saml_app_step1.png){.thumbnail}
48+
49+
In the step "Google Identity Provider details", download the metadata file by clicking `Download metadata`{.action} then click `Continue`{.action}.
50+
51+
![Add SAML Application, Step 2](images/google_workspace_web_mobile_add_saml_app_step2.png){.thumbnail}
52+
53+
In the step "Service provider details", complete the `ACS URL` and `Entity ID` fields with the values for your region:
54+
55+
- EU region: **ACS URL**: `https://www.ovhcloud.com/eu/auth/saml/acs` and **Entity ID**: `https://www.ovhcloud.com/eu/auth/`
56+
- CA region: **ACS URL**: `https://www.ovhcloud.com/ca/auth/saml/acs` and **Entity ID**: `https://www.ovhcloud.com/ca/auth/`
57+
58+
Click `Continue`{.action}.
59+
60+
![Add SAML application, step 3](images/google_workspace_web_mobile_add_saml_app_step3.png){.thumbnail}
61+
62+
In the "Attribute mapping" step, add the following mapping:
63+
64+
- **First Name**: Name
65+
- **Last Name**: Surname
66+
- **Primary email**: E-mail Address
67+
68+
Click `Finish`{.action}.
69+
70+
![Add SAML application, step 4](images/google_workspace_web_mobile_add_saml_app_step4.png){.thumbnail}
71+
72+
Enable access to this application by clicking `OFF for everyone`{.action} in the "User access" section. Click `ON for everyone`{.action} then the `SAVE`{.action} button.
73+
74+
![Enable app for all users](images/google_workspace_web_mobile_enable_app1.png){.thumbnail}
75+
76+
![Enable app for all users](images/google_workspace_web_mobile_enable_app2.png){.thumbnail}
77+
78+
> [!primary]
79+
>
80+
> Adding application access to users can take several hours to take effect.
81+
>
82+
83+
Your Google Workspace service now trusts OVHcloud as a service provider. The next step is to ensure that the OVHcloud account trusts your Google Workspace as an identity provider.
84+
85+
### Registering Google Workspace into the OVHcloud account and configuring the connection
86+
87+
To add Google workspace as a trusted identity provider, you need to provide the identity provider metadata in the [OVHcloud Control Panel](https://ca.ovh.com/auth/?action=gotomanager&from=https://www.ovh.com.au/&ovhSubsidiary=au).
88+
89+
Once logged in, click your profile at the top right.
90+
91+
![Top menu OVHcloud](images/ovhcloud_top_menu.png){.thumbnail}
92+
93+
Click on your name to access your profile management page.
94+
95+
![OVHcloud User Information](images/ovhcloud_user_infos.png){.thumbnail}
96+
97+
Open the `User Management`{.action} tab.
98+
99+
![OVHcloud menu profile](images/ovhcloud_profile_menu.png){.thumbnail}
100+
101+
Click the `SSO Login`{.action} button.
102+
103+
![OVHcloud SSO connection step 1](images/ovhcloud_user_management_connect_sso_1.png){.thumbnail}
104+
105+
Fill in the XML metadata of your Google Workspace service. Enter `Group` as the "Group Attribute Name". Click `Confirm`{.action}.
106+
107+
![OVHcloud SSO connection step 2](images/ovhcloud_user_management_connect_sso_2.png){.thumbnail}
108+
109+
Now you need to retrieve your Google Workspace as identity provider, as well as default groups.
110+
111+
![OVHcloud SSO connection step 3](images/ovhcloud_user_management_connect_sso_3.png){.thumbnail}
112+
113+
For more information, click on the link under “SSO Service URL”.
114+
115+
![OVHcloud SSO connection step 4](images/ovhcloud_user_management_connect_sso_4.png){.thumbnail}
116+
117+
The `...`{.action} button allows you to update or delete the SSO, and view its details.
118+
119+
![OVHcloud SSO connection step 5](images/ovhcloud_user_management_connect_sso_5.png){.thumbnail}
120+
121+
Your Google Workspace is now considered a trusted identity provider. However, you still need to add groups to your OVHcloud account.
122+
123+
> [!warning]
124+
> If you try to connect via SSO at this point, you will probably receive a `Not in valid groups` error message.
125+
>
126+
> That is because your OVHcloud account checks whether the authenticating user belongs to an existing group on the account.
127+
>
128+
129+
To resolve this, authorise the groups that will be transmitted from Google Workspace to OVHcloud. These groups are the same as those used to categorise your users.
130+
131+
To do this, log on to the [Google Workspace](https://admin.google.com) administration interface with your administrator account.
132+
133+
Go to `Apps`{.action} then `Web and mobile apps`{.action}.
134+
135+
![Manage web and mobile apps](images/google_workspace_web_mobile_add_saml_app.png){.thumbnail}
136+
137+
Click on the line for the application you added in the previous step.
138+
139+
![List of web and mobile apps](images/google_workspace_web_mobile_list_app.png){.thumbnail}
140+
141+
Click `SAML attribute mapping`{.action} to edit the mapping of information shared between Google Workspace and OVHcloud.
142+
143+
![SAML Application Detail](images/google_workspace_web_mobile_show_app.png){.thumbnail}
144+
145+
In the "Group membership (optional)" section, add any groups that you want to allow to connect to OVHcloud. In the "App attribute" field, enter `Group`.
146+
147+
You must then assign **roles** to these user groups at OVHcloud. Otherwise, your OVHcloud account does not know what the user is allowed to do and, by default, no rights are assigned.
148+
149+
![Configuring user groups](images/google_workspace_web_mobile_setup_groups.png){.thumbnail}
150+
151+
From the OVHcloud Control Panel, add a group by clicking the `Declare a group`{.action} button and filling in the fields:
152+
153+
- **Group name**: Group name within Google Workspace
154+
- **Role**: Level of rights granted to this group
155+
156+
![Google Workspace User Management Groups](images/ovhcloud_user_management_groups_1.png){.thumbnail}
157+
158+
![Google Workspace User Management Groups](images/ovhcloud_user_management_groups_2.png){.thumbnail}
159+
160+
You can then verify that the group is added to your OVHcloud account in the "Groups" section:
161+
162+
![Google Workspace User Management Groups](images/ovhcloud_user_management_groups_3.png){.thumbnail}
163+
164+
When you later log in with a user from the **Intern** group, your OVHcloud account will recognise that the user has the role "UNPRIVILEGED" specified by his group.
165+
166+
You will then be able to log out of your account and log back in with your Google Workspace as an identity provider.
167+
168+
### Connecting via SSO
169+
170+
On [the OVHcloud login page](https://ca.ovh.com/auth/?action=gotomanager&from=https://www.ovh.com.au/&ovhSubsidiary=au), enter your [login](https://docs.ovh.com/au/en/customer/create-ovhcloud-account/#what-is-my-nic-handle) followed by **/idp** without a password and click the `Login`{.action} button.
171+
172+
![Connection to OVHcloud federation](images/ovhcloud_federation_login_1.png){.thumbnail}
173+
174+
You are then redirected to your Google Workspace login page. Enter the login and password for a user of your Google Workspace, then click the `Sign in`{.action} button.
175+
176+
![OVHcloud Federation login Redirection Google Workspace](images/ovhcloud_federation_login_2.png){.thumbnail}
177+
178+
You are now logged in with the same customer ID, but through your Google Workspace user.
179+
180+
![OVHcloud User Info Federation](images/ovhcloud_user_infos_federation.png){.thumbnail}
181+
182+
## Go further
183+
184+
[Creating an OVHcloud account](https://docs.ovh.com/au/en/customer/create-ovhcloud-account/)
185+
186+
[Securing my OVHcloud account and managing my personal information](https://docs.ovh.com/au/en/customer/all-about-your-username/)
187+
188+
[Setting and managing your account password](https://docs.ovh.com/au/en/customer/manage-password/)
189+
190+
[Securing your OVHcloud account with two-factor authentication](https://docs.ovh.com/au/en/customer/secure-account-with-2FA/)
191+
192+
Join our community of users on <https://community.ovh.com/en/>.

0 commit comments

Comments
 (0)