How to obtain authorization from Google for using HDP for SaaS for Google Workspace?

Applicable Products

HDP for SaaS
Starting from version 2.4, the product previously known as Boxafe has been renamed to HDP for SaaS.

• Purpose
• Overview
• Configure Drive SDK API
• Create a service key for HDP for SaaS in Google Workspace
• Enable Domain-Wide-Delegation
• Add Google Workspace Domain in HDP for SaaS

Purpose

This document guides you through completing the required configurations in your Google Workspace and then adding it to HDP for SaaS for initiating backup.

Overview

HDP for SaaS for Google Workspace leverages Google OAuth 2.0 for authorization, ensuring security by letting users delegate authorities to their service accounts.

Before using HDP for SaaS for Google Workspace, you must create a service key for HDP for SaaS in Google Workspace and allow HDP for SaaS to access Google Drive with the Drive SDK API. This article guides you through enabling users to access Google Workspace service APIs with the Drive SDK API, and to generate a service key for the authorization of HDP for SaaS for Google Workspace.

Configure Drive SDK API

1. Log in to Google admin console with the credentials of the domain admin which you wish to be backed up by HDP for SaaS.
2. Go to Apps > Google Workspace > Drive and Docs >Features and Applications
   
3. Click Drive SDK.
4. Check Allow users to access Google Drive with the Drive SDK API
5. Click SAVE.
   

Create a service key for HDP for SaaS in Google Workspace

1. Log in to https://console.cloud.google.com/apis/dashboard with the credentials of a domain super administrator.
2. Click the project dropdown selector.
   The Select a project window opens.
3. Click New Project.
   
   The New Project page opens.
4. Enter a Project name, Organization and Location.
5. Click Create.
   
   
   Note: We use the project name “BoxafeBackupSolution” in this tutorial.
   
   Your project is created, you receive a notification and are taken to the Dashboard.
   
   Important: If you are not automatically taken to the Dashboard, ensure that your new project is selected and go to > APIs & Services > Dashboard.
6. Click + ENABLE APIS AND SERVICES.
   
   The Welcome to the API Library page opens
7. Search for, and enable the following APIs:
   1. Admin SDK API
   2. Google People API
   3. Gmail API
   4. Google Calendar API
   5. Google Drive API
   
   
   
   
8. Go to > IAM & Admin > Service Accounts.
   
9. Click +CREATE SERVICE ACCOUNT.
   
10. Enter the Service account name (in this example: “BoxafeBackupSolution”).
11. Click CREATE AND CONTINUE.
    
12. Click Select a Role and select Basic > Owner.
13. Click CONTINUE.
14. Click DONE.
    

Enable Domain-Wide-Delegation

1. Go to > IAM & Admin > Service Accounts.
2. Find the Service account you created and click > Manage details.
   
3. Go to the KEYS tab.
4. Click ADD KEY > Create new key.
   
   The Create private key window opens.
5. Choose JSON as the Key type.
6. Click CREATE.
   
   Your web browser will try to open/save the JSON file. Save it to your computer.
7. Click CLOSE.
   
8. Go to > IAM & Admin > Service Accounts.
9. Click to copy the OAuth2 Client ID of the Service account.
   
10. Go to https://admin.google.com/
11. Click Security
12. Go to Access and data control > API controls
    
13. Click MANAGE DOMAIN WIDE DELEGATION.
    
14. Click Add new.
    
    The Add a new client ID window opens.
    
15. Configure the Client ID
    1. Client ID: Paste the OAuth2 Client ID
    2. Oauth scopes (comma-delimited): Copy and paste the following scopes:
       https://www.googleapis.com/auth/admin.directory.user.readonly,
       https://www.googleapis.com/auth/admin.directory.domain.readonly,
       https://www.googleapis.com/auth/calendar,
       https://www.googleapis.com/auth/calendar.events,
       https://www.googleapis.com/auth/drive,
       https://mail.google.com/, https://www.google.com/m8/feeds,
       https://www.googleapis.com/auth/userinfo.email,
       https://www.googleapis.com/auth/userinfo.profile,
       https://www.googleapis.com/auth/plus.me
16. Click AUTHORIZE

Add Google Workspace Domain in HDP for SaaS

1. Open HDP for SaaS.
2. Go to Domains.
3. Click Add Domain > Google Workspace.
   The Add Domain window opens.
   
4. Configure the Domain:
   1. Domain admin email address: Enter the Google Workspace administrator email address.
   2. Service Key: Upload the private key JSON file that was downloaded to your computer.
5. Click Authorize
6. Select the Domain Services to back up
   
7. Configure Add Users:
   1. Select Auto for HDP for SaaS to automatically add users that are added to the Google Workspace.
   2. Select Manual and you must click the Add Users button.
      
      The Add Users window appears.
      1. Click Sync User List to retrieve the users from the Google Workspace.
      2. Add or remove specific users using the checkbox next to their email address.
         
8. Configure Add Shared Drives:
   1. Select Auto for HDP for SaaS to automatically add shared drives to HDP for SaaS.
   2. Select Manual and you must manually add new shared drives before they can be used by HDP for SaaS.
      
9. Click Next.
10. Define a backup schedule policy for All applications or Individual applications:
    
    1. All applications: Select the settings for backing up Gmail, Contacts, Calendar, Drive, and Shared Drives.
    2. Individual applications: Select the settings for the specific application.
    3. Backup type: Select Continuous, Manual, or Scheduled.
       Note: Manual and Scheduled are not available for Gmail backup.
    4. Start date: Enter a date the task should start.
    5. Optional: Enable Stop backup on: and select a date.
    6. Optional: Enable Delete older versions of backed up data after: and select a monthly frequency.
11. Click Add.
    The Google Workspace domain is added to HDP for SaaS and backup tasks are processed based on your settings.