Help us improve your experience.

Let us know what you think.

Do you have time for a two-minute survey?

 
ON THIS PAGE
 

Integrate Google Workspace as an Identity Provider

Follow these steps to integrate Google Workspace with HPE Mist Networking.

HPE Mist Networking Access Assurance allows you to integrate with Google Workspace as Identity Provider (IdP) to leverage secure Lightweight Directory Access Protocol over SSL (LDAPS) connector for the following use cases:

  • For certificate-based (EAP-TLS or EAP-TTLS) authorization:
    • Retrieves user group membership information to support authentication policies based on this user identity
    • Gets the status—active or suspended—of an user account

  • EAP-TTLS with PAP

    • Checks the username and password for authentication with Google’s Identity Provider
Note:

Some of the screenshots included in this document are sourced from third-party applications. Be aware that these screenshots may change over time and may not always match the current version of the applications.

Configuration on Google Workspace

The following procedure shows you how to configure Google Workspace as an identity provider (IdP) with HPE Mist Networking.

Note:

The screenshots from third-party applications are correct at the time of publishing. We have no way to know when or if the screenshots will be accurate at any future time. Please refer to the third-party website for guidance about changes to these screens or the workflows involved.
  1. Log in to your Google Workspace portal by using your Google administrator credentials.

    The Google Admin dashboard appears.

  2. Create an LDAP client.
    1. From the Google Admin console, on the left-navigation bar, go to Apps > LDAP and click Add Client.
      Google Admin console interface showing the LDAP section under Apps category with Add Client option highlighted for managing LDAP clients and permissions.
    2. Provide an LDAP client name and an optional Description and click Continue.
      LDAP client setup interface showing the current step as Client details. Includes fields for LDAP client name filled as HPE Mist Networking Access Assurance and an empty description field. Note states LDAP client name is required. Buttons at the bottom: CANCEL and CONTINUE.

      The Access permissions page is displayed after adding the LDAP client.

  3. Configure Access Permission for verifying user credentials.

    The following options are available:

    • Verify user credentials—Allows user credential authentication using EAP-TTLS/PAP. This setting specifies which organizational groups the LDAP client can access to verify the user’s credentials.
    • Read user Information—Allows you to read basic user information. This setting specifies which organizational units and groups the LDAP client can access to retrieve additional user information.
    1. Select Entire domain for both the options if no specific organization is required.
      Configuration screen for access permissions showing verify user credentials and read user information sections. Entire domain deaflyz.net selected for both. System attributes checkbox selected. Options for limiting access to organizational units or groups not selected.
    2. Scroll down to Read group information. This setting specifies whether the LDAP client can read group details and check a user’s group memberships.
      User interface screen for configuring reading group information with toggle switch set to On, Back button at bottom left, and ADD LDAP CLIENT button at bottom right.

      After you finish configuring access permissions and added LDAP client, the certificate is generated automatically on the same page.

  4. Download the generated LDAPS client certificate.
    1. Click Download certificate and save the downloaded certificate in a secure place. You'll need this certificate when you set up an IdP on the HPE Mist management portal.
      Setup process for connecting a client to LDAP service with steps to download a certificate, upload it to the LDAP client, and configure the application. Buttons for downloading the certificate and continuing to client details are included.
    2. Click Continue to Client Details.

      The Settings for <LDAP client name> page appears.

    3. Expand the Authentication section.
      HPE Mist Networking Access Assurance LDAP configuration interface with status off, options to edit details and more, and dropdown arrow.
    4. Under Access Credentials, click Generate New Credentials.
      HPE Mist Networking Access Assurance interface for LDAP settings showing status as OFF, certificate details like name, expiration date, SHA-256 fingerprint, and options to download, edit, or delete. Includes a message about no access credentials and a highlighted button to generate new credentials.

      You can view the username and password on the Access credentials page.

      Credentials screen for HPE Mist Networking Access Assurance showing Username field with value Coordinate, hidden Password field, copy password option, warning about password storage, and CLOSE button.

      Copy and save the username and password. You need these details for the LDAPS client configuration on the HPE Mist management portal.

  5. Enable the LDAP client service by changing the service status to On for the LDAP client. This step enables you to set up a client with the Secure LDAP service.
    1. From the Google Admin console, go to Apps > LDAP. Select your client and click Service Status.

      The service status, displayed at the top right of the page, is initially set as OFF.

      Settings page for HPE Mist Networking Access Assurance in LDAP application. Service status is OFF. Access permissions set to Entire domain and System attributes. Authentication includes 1 certificate and 1 access credential. Options include Edit Details and More buttons.

      Select On for everyone to turn on the service. Allow some time for the changes to apply on the Google side.

      Settings interface for HPE Mist Networking Access Assurance with service status set to ON for everyone, unsaved change noted, and options to cancel or save changes.

Add Google Workspace as an Identity Provider

  1. From the left menu of the management portal, select Organization > Access > Identity Providers.

    The Identity Providers page displays any configured identity providers.

    Figure 1: Identity Providers Page Identity Providers section with no providers configured and Add IDP button to add a new identity provider.
  2. Click Add IDP to add a new IdP.
  3. On the New Identity Provider page, enter the required information to integrate with Google Workspace.
    Figure 2: Update Identity Provider Details Configuration interface for setting up a new identity provider with fields for name, IDP type, LDAP settings, filters, server hosts, domain names, credentials, certificates, and buttons to create or cancel.

    Now configure the LDAPS connector to integrate with the Google Workspace LDAP endpoint.

    • Name—Enter an IdP name. (In this example, enter Google Workspace.)
    • IDP Type—Select LDAPS.
    • LDAP Type—Select Custom.
    • Group Filter—Select memberOf. This option is required to obtain group memberships from Group attribute.
    • Member Filter—Select memberOf.
    • User Filter—Enter (mail=%s).
    • Server Hosts—Enter ldap.google.com.
    • Domain Names—Enter your Google Workspace domain name. For example: abc.com.
    • Bind DN—Use the username provided by Google in the previous step.
    • Bind Password—Enter the password for the above username.
    • Base DN—Configure your base dn matching your Google Workspace domain. For example, if your domain is abc.com, then your base DN is dc=abc,dc=com.
  4. In the CA Certificates section, click Add Certificate and paste the following two certificates:
    Figure 3: Add CA Certificate Certificate Authority details with signed certificate in PEM format, properties like ldap.google.com as Common Name, validity from 03/13/2023 to 06/05/2023, issuer as Google Trust Services LLC, serial number 0eb6a9cb5f11079e0a6579daee7ad2ba, TLS Web server authentication, OCSP link, CRL link, and Save and Cancel buttons.
  5. Under Client Certificate, add a client certificate you downloaded from Google. Place the file ending with .key under Private Key, and the file ending with .crt under Signed Certificate as shown in the following sample:
    Figure 4: Add Client Certificate Client Certificate configuration interface with sections for Private Key, Signed Certificate, certificate properties like Common Name LDAP Client, validity dates, issuer Google Inc., and Serial Number 01882da047cd. Save and Cancel buttons at the bottom.

    Click Save.

On the HPE Mist management portal, go to Monitoring > Insights > Client Events.

When a user authenticates using EAP-TTLS , you can see the NAC IDP Authentication Success and NAC IDP Group Lookup Success events that fetch user group membership information.

When a user authenticates using EAP-TTLS with Google Workspace, you can see the event NAC IDP Group Lookup Success that fetches user group membership information.
Figure 5: IDP Group Lookup Success Authentication Event Dashboard displaying client network access and authentication events with timestamps, event types, and client details. Highlighted IdP Roles include it_admin, itsuperusers, and vip.

In case of EAP-TTLS authentication, you can see the NAC IDP Authentication Success event. This event indicates that Google Workspace has validated user credentials.

Figure 6: IDP Authentication Success Event Network client event log interface showing client events like Authorization Association, NAC Client Access Allowed, NAC Authentication Success, and summary details including client Google, BSSID a8:f7:d9:98:a7:d1, authentication type 802.1X, AP BRQLAB-APJ-2, SSID mist-aa, and user name slava@deaflyz.net.

You may leverage IDP Roles from Google Workspace in your Auth policy rules to perform network segmentation based on user roles.

About EAP-TTLS and Azure AD using ROPC

Extensible Authentication Protocol–Tunneled TLS (EAP-TTLS) leverages LDAPS OAuth flow with Azure AD to perform user authentication. This implies the use of legacy authentication, which involves the use of a username and password without MFA. There are several factors to consider when employing this method:

  • Configure client devices with the correct Wi-Fi profile, either from GPO or MDM. Providing only username and password at the login prompt does not work for some operating systems.
  • Users must use Google Email ID (username@domain) username format for entering the username.
  • Configure clients to trust server certificate. See Use Digital Certificates.

See Also