Configure Google Workspace - OpenID Connect

Before you begin

Retrieve the ClientID and Client Secret from Entra ID.

About this task

Use this task to configure your identity provider (IdP) using Google Workspace - OpenID Connect.

Procedure

Select Onboarding.
The welcome window displays.
Select Secure Hybrid Access [Secure Application Access or Secure Network Access].
The Secure Provider window displays with ExtremeCloud Universal ZTNA.
Select Next.
The Onboarding window displays.
Select OpenID Connect from the Single Sign-On Method drop-down list.
Follow the instructions under Setup Redirect URI.
Enter the ClientID.
Enter the Client Secret.
Note
Redirect URLs are on the IdP set up page on the Universal ZTNA UI. You can copy and update redirect URLs in Google Workspace. In Google Workspace, specify the following URLs under the URI section. These URLs redirect the user to the Google Workspace portal after a successful authorization by Google Workspace during log-in and sign-up.
- https://server URL/auth/api/v1/accounts/google/login/callback/
- https://server URL/auth/api/v1/accounts/invite/google/signup/callback/
Optional: Select All Domains or Custom and enter the domain.
If you select Custom, fill in the approved domains. Applicable for network and application access.
(Optional) Select Secure Network Access.

Note
This option uses Secure LDAP with Google Workspace to enable secure network access in Universal ZTNA.
1. Follow the instructions on the UI.
2. Upload the certificate.
Select Validate Information.
A message in the upper right corner confirms the validation test passed.
Select Update.
Update Identity Provider pop-up window displays. This message cautions you that the Identity Provider change logs out current users.
If you decide to continue, select Confirm.
Select Next.
The Onboarding - Access Groups window displays.
Configure Access Groups.
Configure Resources.
Configure Applications and Application Groups.
You can skip this step if you are using Secure Network Access.
Configure Policies.

Results

Your onboarding is complete. Your users, applications, and devices can now access the network securely.