Setting up federated authentication between Google and Apple School Manager - issue

[TwistedHelixis]

Primary school has decided to get all the teachers an iPad. I have just verified our domain in Apple School Manager, so have a blank canvas to start off with. I will also be using Mosyle as the MDM.

 

The school has been using Google Workspace for about 6 years. I noticed a section in ASM that lets it use the accounts in Google Workspace as the Apple account ID, so thought I would see how that works.

 

Stuck at the first click. When I click 'Sign in with Google' I get the following error. Apparently it should just ask me for my account details.

 

Authorisation ErrorError 400:

admin_policy_enforcedAccess to your account data is restricted by policies within your organisation.

Please contact the administrator of your organisation for more information.

 

If you’re the app developer, make sure that these request details comply with Google policies.

access_type: offlineresponse_type: codetrampoline: 1redirect_uri: https://gsa-ws.apple.com/grandslam/GsService2/acsstate:

client_id:?????? (removed my id)

 

scope: openid https://www.googleapis.com/auth/userinfo.profile https://www.googleapis.com/auth/userinfo.email https://www.googleapis.com/auth/admin.directory.user.readonly https://www.googleapis.com/auth/admin.reports.audit.readonly https://www.googleapis.com/auth/admin.directory.domain.readonly

 

 

When I search online I don't find anything specific to my issue. Any ideas?

 

As its only 16 devices, is it worth the hassle of setting up federated login?

[DGardiner]

Primary school has decided to get all the teachers an iPad. I have just verified our domain in Apple School Manager, so have a blank canvas to start off with. I will also be using Mosyle as the MDM.

 

The school has been using Google Workspace for about 6 years. I noticed a section in ASM that lets it use the accounts in Google Workspace as the Apple account ID, so thought I would see how that works.

 

Stuck at the first click. When I click 'Sign in with Google' I get the following error. Apparently it should just ask me for my account details.

 

 

 

When I search online I don't find anything specific to my issue. Any ideas?

 

As its only 16 devices, is it worth the hassle of setting up federated login?

 

you need to log into google and add the client ID to the trusted api applications

 

https://admin.google.com/ac/owl

 

im fairly sure the proccess sorted itself though, so might have done domain wide delegation - do you have the admin rights to do that?

Edited November 24, 2022 by DGardiner

[TwistedHelixis]

im fairly sure the proccess sorted itself though, so might have done domain wide delegation - do you have the admin rights to do that?

Yes, I am the main admin for Google Workspace at that school.

 

Why is there no step by step from Apple about this?

 

Ill have a look at the link you provided, thanks

[TwistedHelixis]

o might have done domain wide delegation

 

Is it 'Domain wide delegation' that I should be setting this up under?

[DGardiner]

Is it 'Domain wide delegation' that I should be setting this up under?

im not sure, i cant find any mention of apple on ours - its working so i did it, i just got the usual oauth screen to allow it to do what it needed.

[TwistedHelixis]

i just got the usual oauth screen to allow it to do what it needed.

I'm not even getting that :-(

[Brimstone]

Here are Apple's support documents...

 

https://support.apple.com/en-gb/guide/apple-school-manager/axmaef1a0154/web

 

https://support.apple.com/en-gb/guide/apple-school-manager/axma05ecb9d5/web

 

And a video from a reseller

 

[TwistedHelixis]

Here are Apple's support documents...https://support.apple.com/en-gb/guid...maef1a0154/webhttps://support.apple.com/en-gb/guide/apple-school-manager/axma05ecb9d5/webAnd a video from a resellerhttps://www.youtube.com/watch?v=CPfO6W67d3A

 

I'm not even getting the login box near the start of the process. Rather than the login box, I am getting the error message I posted before.

 

Ill have a play later

[TwistedHelixis]

Managed to get the login box to display by opening ASM in incogneto browser mode, but get the following error

 

Access to your account data is restricted by policies within your organisation. Please contact the administrator of your organisation for more information.

 

Ill have a look at the client ID api or Domain wide delegation later, as it must be something to do with that.

[TwistedHelixis]

So I am a bit stumped :-(

 

I could create a new Domain Wide Delegation, using the 'client_id:' and 'scope: openid' from the original error message, but I am not sure if this is the correct way to go about this.

 

The last time I needed to create or change something in the Workspace API section, the third party company had proper steps to follow to get their software connected to Google Workspace, so why doesn't Apple do the same.

 

If someone doesn't have an answer, I'll probably push this to one side and move on.

[TwistedHelixis]

Sent Apple an email asking for an update last night, but had nothing back yet :-(

[TwistedHelixis]

Sent another email, still nothing back from Apple, so just called them. Originally they said that I need to speak to Google, so called them. Google said that Apple need to supply the correct Workspace settings based on their product, so called Apple back. Got transferred around the houses, eventually got through to someone that understood Apple would need to supply me with the correct details, but he needed to pass this over to another department and I would need to send over screen recordings of the issue etc, at this point I stopped him and said not to bother, its been going on for too long now, I needed to hand out the iPads to the staff last week, and it will be much simpler for me to just type in each user directly into ASM.