SSO between AD and Google Workspace

[Caffeine11]

Hi All

 

We are a primary school and the new Head wants the pupils to log on to windows devices and ipads with their own user name and password and use SSO where possible. However, she also wants to move to the cloud and remove our domain server but we have no budget for Google device licences for Chrome OS Flex so we are stuck with windows in our Computer Room for the moment.

 

I was looking for a simple way to setup SSO between AD and Google Workspace, since we will be moving away from AD but, according to my research, I have to use Google Cloud Directory Sync with Google Password Sync. Is this correct?

 

However, it appears that the password sync only happens when the password is changed so you force the user to change their password at logon. We want to give our pupils a fixed password which they cannot change.

 

If I use Powershell and a CSV file to set a password for every pupil, will that be detected as a password change and synced to the pupil's Google account? I don't see any reason why this would not work and I am in the process of writing a script to test but I thought I'd check with you kind people to make sure I am heading in the right direction and not making it more difficult then it should be.  

 

Thank you.

  
 

[Alex0x7F]

Hey @Caffeine11 sounds like you're on the right track from the last time I set this up as a proof of concept. To sync AD with Google Workspace you need both Google Cloud Directory Sync (to handle user and group provisioning) and Google Password Sync (for pushing password changes), since GCDS alone doesn’t handle passwords. Google Password Sync captures any AD password change on a domain controller, therefore including ones set via PowerShell CSV, so your scripted bulk password reset will count as a change and sync to Google. The part to watch is that GCDS has an option to force users to change their password at first login, which you’ll need to disable if you want pupils to keep a fixed password, and you should also turn off the ability for pupils to change their password in Google Workspace itself (either in the Admin Console or with GAM) so that the fixed credentials remain unchanged.

[dhicks]

10 hours ago, Caffeine11 said:

we are stuck with windows in our Computer Room for the moment.

 

Another possible option is the Google redential Provider for Windows (GCPW), which lets users log lon to a Windows machine with their Google credentials. A search for "GCPW" on these forums or Google should get you further details.

[TwistedHelixis]

8 hours ago, dhicks said:

 

Another possible option is the Google redential Provider for Windows (GCPW), which lets users log lon to a Windows machine with their Google credentials. A search for "GCPW" on these forums or Google should get you further details.

This is what I have been testing for the past year. Seems to work really well and includes lots of policies for locking things down.

 

If you go with just the GCPW licenses on there own, its something like £4 per account per year, or there about.

[Caffeine11]

Hi All

 

Thank you for taking the time to reply. GCPW looks interesting. What settings would you would advise here? I cannot seem find the documentation for this section.

 

 

 

 

 

[robk]

You can still use ChromeOS Flex without device management (better with though). Might be worth testing...

 

Does mean you could switch everything over, then enrol in device management when budget becomes available.

[Caffeine11]

My screen shot is now unavailable. It is of User Accounts, Additional User Attributes Tab, Synchronise Passwords section.