Google Drive connector authentication
Before you start
- You need access to the Google Cloud Platform console.
- You need a super administrator for your Google Cloud domain to grant the service account access.
Overview
To let the Google Drive connector make requests to the relevant Google Drive APIs, apply the relevant credentials to the connector config. To do this, set up a service account with the relevant permissions in the Google Cloud Platform, then create a key file and insert it into the connector config credentials.
Sign in to the Google Cloud Platform and go to the console.
Step 1: Create and configure a Google Cloud project
If you do not already have a relevant project, create one in the console by selecting Create a Google Cloud Project. Specify a name for your project. You can specify a Project ID, then proceed with creating the project.
Enable APIs within the project
Within the project, enable the Drive API. Go to Enable Google APIs, choose APIs & Services, and select Enable APIs and Services. Enable:
- Drive API
- Admin SDK API (needed for evaluation of permissions, and for using domain-wide delegation)
Step 2: Create and configure a service account
In APIs & Services, select Credentials, then Create credentials to create a service account. Specify a name for the service account and a service account ID. Select Done to create the service account.
The service account needs access to at least the following scope:
https://www.googleapis.com/auth/drive.readonly
A super administrator for your Google Cloud domain must grant the service account access. Google's domain-wide delegation documentation describes the steps to enable Google Workspace domain-wide delegation. Grant the following OAuth scopes to your service account:
https://www.googleapis.com/auth/admin.directory.group.readonlyhttps://www.googleapis.com/auth/admin.directory.user.readonlyhttps://www.googleapis.com/auth/drive.readonlyhttps://www.googleapis.com/auth/drive.metadata.readonly
These scopes allow the Google Drive connector to:
- Access user data and group memberships in a Google Workspace organisation
- Access Google Drive data in drives associated with Google Workspace members
Step 3: Create a key file for the connector config
In the Cloud console, go to IAM and Admin, then the Service accounts page. Go to the service account you want to create a key file for and select the Keys tab. Select the Add key dropdown, then Create new key.
For Key Type, select Json, then select Create. This downloads a JSON file containing the service account credentials. Insert the values from the JSON file into the Google Drive connector config Credentials JSON.
Step 4: Configure shared drives
If you have enabled domain-wide delegation for the service account, it should automatically have access to shared drives, and nothing further is needed.
If you have not enabled domain-wide delegation, you must explicitly share the relevant drives with the service account for the Google Drive connector to synchronise their content. To share a drive or folder, and all of its children (files and folders), right-click it and select Share. Share the drive with the service account configured for the Google Drive connector.