Smoothwall Connect extension for Chromebooks, anyone set this up?

[davie887]

As title, we are trying to set up a Google directory in Smoothwall and not having much luck. The official documentation seems to gloss over quite a few important bits or is for and older version of GSuite/Google API... I've tried a few times from scratch following this but always end up with "Failed: Code: 400, Message: Invalid Customer Id" in the Diagnose screen on SW Directories. Customer ID isn't a term used in Google that I can see, Client ID is but this doesn't work either. If anyone has done this recently, any pointers would be appreciated!

 

I've reached out to Smoothwall but they seem intent on sticking to their SLA come hell or high water.

[ibpalle]

Hi Davie

 

The setup can be a bit arduous - we have recently updated the KB associated with this to point at Google KBs instead of trying to keep up with updating our own to match the frequent changes in the Google admin interface. I am assuming you are getting the error from the authentication system when trying to diagnose the google connection? Customer ID is likely due to the ID of the service account being incorrect - I have done this myself a few times where I used the wrong ID. A while back I wrote a step-by-step for a customer. I have added it here but some of the instructions with regards to Google admin console are no longer as precise. Step 11 in the first section is the one I think may be going wrong. Also, here are 2 links to our KBs which should help as well.

 

https://kb.smoothwall.com/hc/en-us/articles/360004030519-Authorizing-the-Google-Service-Account

https://kb.smoothwall.com/hc/en-us/articles/360002031770-Creating-the-Client-ID-and-Client-Secret-for-Google-Authentication

 

 

 

Create a Google Service Account

1. Go to https://console.developers.google.com and log in as an admin user.

2. If it is the first time you log in you will be prompted to accept the Google terms and conditions.

3. Create a new project in “Apis and services - select project – create”. You cannot reuse an existing project if you have created any previously. Note: If you have previously created projects under the logged in username, you may find the menu options are “project_name > Create a project”, where “project_name” is a previously created project.

4. Enter a suitable Project Name as Smoothwall Login and click Create. The project name appears in the top left when it has been successfully created.

5. Click the menu icon at the top left, and select IAM & Admin, select Service accounts and click CREATE SERVICE ACCOUNT.

6. Enter “Smoothwall login” for the service account and use “Smoothwall directory connection” for the Service account description; then click Create.

7. This will then bring up the Service account permissions screen where you are asked to select Role - Do not select a role, just click Continue.

8. This will then bring up the Grant user access to this service account screen where you again are asked to provide role information; Service account user role - Do not enter any information; Service account admins role - Do not enter any information.

9. Create Key, click Create key and choose JSON key type, then click Create.

10. JSON key is downloaded automatically to your computer, click close on the popup and click Done.

11. Obtain the Unique ID number (previously this was the Client ID) - This is done by enabling the Unique key view in the ... (to the far right of the service account entry) options icon. This number will be required to authorize the service account.

12. Save the Unique ID number and also rename the downloaded json file to be tenant-name-service-account.json.

 

Authorize the service account

1. Go to https://admin.google.com and log in as an admin user.

2. Click Security, then API reference and Show more > Advanced Settings.

3. From the Authentication section, select Manage API client access.

4. In the Authorized API clients > Client Name field, enter the Unique ID number for the Google Service Account created in the step above.

5. Under One or More API Scopes, enter the following (All on one line, no breaks or spaces):

 

https://www.googleapis.com/auth/admin.directory.group.readonly,https://www.googleapis.com/auth/admin.directory.orgunit.readonly,https://www.googleapis.com/auth/admin.directory.user.readonly

 

6. Click Authorize.

 

Add the google directory

1. On the Smoothwall master, navigate to “Services - authentication – directories”.

2. Select “Add new directory”

3. In the Tenant field, select the applicable Tenant.

4. Select Google directory

5. Enter name as "Google tenant name"

6. Upload json file you downloaded from the dev console

7. Add the G-Suite admin username in the authorised user field and click add.

 

Run diagnostics - in case of issues, visit the URL shown and check that API have been enabled. Once any errors have been corrected, sync the Google directory. A Sync button will appear when you hover over the directory entry. The sync will take about 15 minutes.