1

My org is almost exclusively Linux and Mac based. We have all of our internal services configured to use our GSuite logins for identity and auth.

Now we need to use a Windows application, and I'd like to host it in GCP using Windows Server 2019 rather than maintaining on-prem windows desktop hardware (we're a distributed team). I've setup an AD instance, but I'd really like to allow users to sign on using GSuite logins, maintaining continuity our existing Google Identity based SSO setup.

I've read through: https://cloud.google.com/solutions/federating-gcp-with-active-directory-introduction, but it seems to be a solution for using Active Directory as the Master and syncing TO Google Identity. I want the reverse, I'd like Google Identity to be the master, and Active Directory uses it as the identity provider (ideally without syncing :-P).

How can I go about setting up Active Directory so it uses Google Identity as the identity provider?

2
  • I've only ever seen one-way syncs with Google Cloud. You can do two-way syncs with Azure AD, but that's a totally different product. Good luck, I'll be interested to see if you find a solution. Sep 2, 2019 at 2:09
  • Nothing so far.... Of course, what I want is a one-way sync, its just with Google Identity as the "master" and AD as the "slave"
    – Seth
    Sep 9, 2019 at 17:19

1 Answer 1

0

Unfortunately, accordingly to the documentation Federating Google Cloud with Active Directory you can configure only one-way synchronization :

This article describes how you can configure Cloud Identity or Google Workspace to use Active Directory as IdP and authoritative source.

Single sign-on: Whenever a user needs to authenticate, Google Cloud delegates the authentication to Active Directory by using the Security Assertion Markup Language (SAML) protocol. This delegation ensures that only Active Directory manages user credentials and that any applicable policies or multi-factor authentication (MFA) mechanisms are being enforced. For a sign-on to succeed, however, the respective user must have been provisioned before.

Active Directory Federation Services (AD FS) is provided by Microsoft as part of Windows Server.

In addition, have a look at Federating Google Cloud with Active Directory: Configuring single sign-on and Best practices for planning accounts and organizations to find more details.

Current level of integration was provided by Microsoft as part of Windows Server, you can try to request at Microsoft To Do UserVoice or at Microsoft Techcommunity enhance of this integration.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .