KACE Systems Management Appliance 14.1 Common Documents

Add and edit Google Workspace credentials

To streamline the management of Google Workspace credentials used in Inventory, Distribution, Scripting, and Service Desk, add the applicable credentials to the Credentials Management page.

The appliance can obtain access to a Google Workspace Domain using the Google APIs. The following appliance-managed components can be authenticated through Google API:

•

Google Workspace Device Discovery and Inventory: This includes both Chromebooks and mobile devices that are managed by a Google Workspace Domain (formerly G Suite). This type of authentication requires the following:

◦

You have a Google Workspace Domain with Chrome Device Management support.

◦

You have a Google User admin account that is a member of the domain. The account must be assigned the Super User role.

◦

You have a Google account that can be used as your developer account in this procedure. This account does not have to be the same as the Admin account, nor does it have to be a member of the business or education domain.

•

Service Desk Queue Inboud Email: This includes email accounts that are part of a Google Workspace or a public Gmail account. This type of authentication requires the following:

◦

You have a Gmail account.

◦

The following applies to your Service Account:

▪

The Gmail account belongs to a Google Workspace Domain.

▪

You have a Google User admin account that is a member of the domain, The account must be assigned the Super Admin role.

◦

You have a Google account that can be used as your developer account in this procedure. This account does not have to be the same as the admin account, nor does it have to be a member of the business or education domain.

For each of these component types, the appliance supports the following methods authentication by a Google API. The method you choose depends on the components using the Google Workspace credential and the preference or role of the appliance administrator.

•

Service Account authentication consists of a Service Account Key that is associated with a unique Client ID. A Google Workspace Super Admin can use the Client ID to grant the Service Account Domain Wide Access to a resource.

◦

This is a preferred method for Chromebook and Mobile Device Discovery and Inventory.

◦

It requires a configuration step using the Google Workspace Console by a Super Admin.

◦

It grants domain-wide access to a specific resource type. In the case of Service Desk Queue emails, this means the service account is granted access to any email inbox. It is up to the administrator to ensure that it is only used with the desired Service Desk email.

•

OAuth Client authentication consists of a OAuth Client ID that is used along with a Client Secret to request and grant access to a particular Google resource using a browser-based workflow.

◦

This is a preferred method for Service Desk Queue Inboud Email integration.

◦

It requires that the browser used to configure the credential in the Administrator Console connects to the appliance using a host name that is considered public (no private domains).

◦

It can be used with public Gmail accounts.

Start by creating one or more Google Workspace Service Account or OAuth credentials, as applicable. After you add credentials, you can select them on configuration pages instead of entering them manually each time. In addition, you can add credentials from any of the configuration pages that use them. Credentials added on configuration pages are automatically added to the Credentials Management page. The appliance does not validate stored Google OAuth credentials as you enter them, but attempting to save any changes using invalid credentials result in an error.

Create and configure a Google Cloud Platform project.

Assign a new name and ID to the project.

Enable the desired Admin SDK API and/or Gmail API, as applicable.

Service Account credentials only.

While still logged in to the Google Cloud console, select IAM & Admin.

Create a Service Account with a desired name and description.

Add a Service Account Key and save the JSON key file.

Record the OAuth 2 Client ID of the Service Account for later use.

OAuth credentials only.

While still logged in to the Google Cloud console, select APIs & Services, and go to the OAuth consent screen.

If the developer account is part of the same Google Workspace domain as the resources being accessed, select Internal otherwise choose External.

Create an app and specify its name, Support email address, and Developer contact email address.

Add the following scopes:

▪

Device Discovery and Inventory only:

▪

https://www.googleapis.com/auth/admin.directory.device.chromeos

▪

https://www.googleapis.com/auth/admin.directory.device.mobile

▪

https://www.googleapis.com/auth/admin.directory.user

▪

Service Desk Queue email only:

▪

https://www.googleapis.com/auth/gmail.modify

Create a credential and select OAuth Client ID.

Choose Web Application as the Application type.

Assign a name to the client.

Provide the following URI: https://<appliance_hostname>/common/authorize.php, where appliance_hostname is the host name of the appliance Administrator Console.

Record the Client ID and Client Secret for later use.

Service Account credentials only (optional). Delegate a domain-wide authority to a Service Account. This step requires Super Admin access to the Google Workspace Admin console.

NOTE: When authorizing the Gmail modify scope to a Service Account, access is granted to that service account for all mailboxes on the domain. Ensure that the Service Account Key credentials are protected accordingly.

Under Security > Access and data control > API Controls > Manage Domain Wide Delegation, create a new delegation and provide the Client ID of the Service Account that you created in 2.

Add the following scopes:

▪

Device Discovery and Inventory only:

▪

https://www.googleapis.com/auth/admin.directory.device.chromeos

▪

https://www.googleapis.com/auth/admin.directory.device.mobile

▪

https://www.googleapis.com/auth/admin.directory.user

▪

Service Desk Queue email only:

▪

https://www.googleapis.com/auth/gmail.modify

Go to the Credentials Management page:

Log in to the appliance Administrator Console, https://appliance_hostname/admin. Or, if the Show organization menu in admin header option is enabled in the appliance General Settings, select an organization in the drop-down list in the top-right corner of the page next to the login information.

On the left navigation bar, click Settings, then click Credentials.

Select Choose Action > New.

On the Add Credential form, specify credential properties:

Option	Description
Name	A unique name for the credential. This name appears on the Credentials Management list and in the credential selection drop-down lists in component sections, such as Scripting. This name is used for identification in Administrator Console, and it is not part of the actual credential.
Type	The classification of the credential. Select Google Workspace or GMail, as applicable.

Service Account credentials only. While still on the Add Credential form, specify the credential properties:

Impersonation Account

•

Device Discovery and Inventory only: The email address of an administrator that has access to the devices in the Google Admin console.

•

Service Desk Queue email only: The email address from which you can receive inbound email.

Service Account Key

Navigate to the JSON file obtained in 2.

Notes

Any additional information you want to provide about the credential.

OAuth credentials only. While still on the Add Credential form, specify the credential properties:

Your Google developer API Client ID obtained in 3.

Client Secret

Your Google developer API Client Secret obtained in 3.

Show typing

Show the characters in the Client Secret field on the Add Credential form. This option is available only when you are adding credentials. If you are editing existing credentials, the characters in the Client Secret field cannot be displayed.

Authorize Credential

Click, log in, and grant access to the desired Google account on the page that appears.

•

Device Discovery and Inventory only: The account of an administrator that has access to the devices in the Google Admin console.

•

Service Desk Queue email only: The email address from which you can receive inbound email.

Notes

Any additional information you want to provide about the credential.

10.

Click Save.

The credential is available for selection in components that use credentials.

Add and edit SNMP credentials

To streamline the management of SNMP credentials used in Inventory, Distribution, and Scripting, add those credentials to the Credentials Management page.

•

You have the information required for SNMP authentication.

•

You have administrator privileges in the Administrator Console

After you add credentials, you can select them on configuration pages instead of entering them manually each time. In addition, you can add credentials from any of the configuration pages that use them. Credentials added on configuration pages are automatically added to the Credentials Management page.

Go to the Credentials Management page:

On the left navigation bar, click Settings, then click Credentials.

Select Choose Action > New.

On the Add Credential form, provide the following information:

Option	Description
Name	A unique name for the credential. This name appears on the Credentials Management list and in the credential selection drop-down lists in component sections, such as Scripting. This name is used for identification in Administrator Console, and it is not part of the actual credential.
Type	The classification of the credential. Select SNMP to specify SNMP credentials.

For SNMP v1 or v2c, provide the following information:

Option	Description
SNMP v1 or v2c	SNMP credentials that do not use authentication or encryption.
Community String	For SNMP v1 or v2c, the community string to query. The default is Public. The Public String is required for SNMP v1 or v2c.
Notes	Any additional information you want to provide about the credential.

For SNMP v3, provide the following information:

Option

Description

SNMP v3

SNMP credentials that require authentication and encryption algorithms to increase security.

Security Name

For SNMP v3, the name of the USM (user-based security model) user account. This account, and any passwords required for authentication and encryption, must be set up on target devices.

Security Level

For SNMP v3, the level of security. Security levels include:

•

authPriv: The highest level of SNMP v3 security, which uses both authentication and encryption. To use this level, you must specify all the SNMP V3 Authentication and Privacy settings.

•

authNoPriv: The mid-range of SNMP v3 security, which uses authentication only. Communications are not encrypted. To use this level, you must specify the Authentication settings.

•

noAuthNoPriv: The lowest level of SNMP v3 security. Communications are not encrypted.

Authentication Password

For SNMP v3, the password used to authenticate communications when authPriv or authNoPriv security levels are selected. This password is associated with the USM user and must be set up on target devices.

Protocol

For SNMP v3, the protocol used for communications. Protocols include:

•

SHA: Secure hash algorithm, SHA-1.

•

MD5: Message Digest 5. Faster than SHA, but considered to be less secure.

Privacy Password

For SNMP v3, the password used to authenticate communications when the authPriv security level is selected. This password is associated with the USM user and must be set up on target devices.

Protocol

For SNMP v3, the protocol used for the privacy password. Protocols include:

•

DES: Data Encryption Standard. This algorithm has a 56-bit key size and is considered to be less secure than AES.

•

AES: Advanced Encryption Standard. The appliance supports the 128-bit key size.

Notes

Any additional information you want to provide about the credential.

Click Save.

The credential is available for selection in components that use credentials.

Add and edit Microsoft Office 365 OAuth credentials

To easily use Office 365 credentials used in Service Desk email communication, add them to the Credentials Management page.

•

You have an Office 365 account, and have created a Microsoft Active Directory app in Microsoft Azure with a Client ID and Client Secret. For more information, visit https://docs.microsoft.com/en-us/azure/active-directory/develop/howto-create-service-principal-portal.

•

You have administrator privileges in the Administrator Console.

After you add credentials, you can select them in configuration pages instead of entering them manually each time. In addition, you can add credentials from any of the configuration pages that use them. Credentials added on configuration pages are automatically added to the Credentials Management page. The appliance does not validate stored Office 365 credentials as you enter them, but attempting to save any changes using invalid credentials result in an error.

NOTE: This feature is only available when SSL (secure) access to the appliance is enabled. For more information, see Configure security settings for the appliance.

Go to the Credentials Management page:

On the left navigation bar, click Settings, then click Credentials.

Select Choose Action > New.

On the Add Credential form, specify credential properties:

Option

Description

Name

A unique name for the credential. This name appears on the Credentials Management list and in the credential selection drop-down lists in component sections, such as Service Desk email settings. This name is used for identification in Administrator Console, and it is not part of the actual credential.

Type

The classification of the credential. Select Office365 OAuth to specify credentials for Office 365.

Client ID

Your Office 365 Client ID.

Client Secret

Your Office 365 Client Secret.

Show typing

Azure AD Tenant Type

Select your Azure AD tenant type from the available options. The tenant type must match the one selected when registering your Azure AD application in the Azure AD admin portal.

•

Multitenant & Personal Microsoft Accounts - Default: Use this option to grant access to the widest range of Microsoft identities and to enable multi-tenancy. All users with a work or school, or personal Microsoft account can access your application or API using this credential. It applies to schools and businesses that use Office 365 as well as personal accounts that are used to sign in to services like Xbox or Skype. This is the default setting.

•

Azure AD directory - Multitenant: Use this option to grant access to business or educational users, and to enable multitenancy. All users with a work or school account from Microsoft can use your application or API. This includes schools and businesses that use Office 365.

•

Personal Microsoft Accounts only: Use this option to grant access to personal accounts that are used to sign in to services like Xbox or Skype.

•

Organizational directory only (Single tenant): Use this option to grant access to the users associated with your organization.

Authorize Credential

Click, log in, and grant access to the desired Office 365 account on the page that appears.

Azure AD Endpoint URL

Use this option to select required azure portal URL according to the region.

Azure AD Endpoint URL - Share the Azure URL

Use this option to select required azure portal URL according to the region.

Notes

Any additional information you want to provide about the credential.