Home / server / Questions / 981511
In Process
Seth
Asked: 2019-09-02 13:07:56 +0800 CST

How can I achieve SSO to Windows RDS Services using Google Identity / GSuite?

  • 772

My org is almost exclusively Linux and Mac based. We have all of our internal services configured to use our GSuite logins for identity and auth.

Now we need to use a Windows application, and I'd like to host it in GCP using Windows Server 2019 rather than maintaining on-prem windows desktop hardware (we're a distributed team). I've setup an AD instance, but I'd really like to allow users to sign on using GSuite logins, maintaining continuity our existing Google Identity based SSO setup.

I've read through: https://cloud.google.com/solutions/federating-gcp-with-active-directory-introduction, but it seems to be a solution for using Active Directory as the Master and syncing TO Google Identity. I want the reverse, I'd like Google Identity to be the master, and Active Directory uses it as the identity provider (ideally without syncing :-P).

How can I go about setting up Active Directory so it uses Google Identity as the identity provider?

active-directory

1 Answers

  1. Unfortunately, accordingly to the documentation Federating Google Cloud with Active Directory you can configure only one-way synchronization :

    This article describes how you can configure Cloud Identity or Google Workspace to use Active Directory as IdP and authoritative source.

    Single sign-on: Whenever a user needs to authenticate, Google Cloud delegates the authentication to Active Directory by using the Security Assertion Markup Language (SAML) protocol. This delegation ensures that only Active Directory manages user credentials and that any applicable policies or multi-factor authentication (MFA) mechanisms are being enforced. For a sign-on to succeed, however, the respective user must have been provisioned before.

    Active Directory Federation Services (AD FS) is provided by Microsoft as part of Windows Server.

    In addition, have a look at Federating Google Cloud with Active Directory: Configuring single sign-on and Best practices for planning accounts and organizations to find more details.

    Current level of integration was provided by Microsoft as part of Windows Server, you can try to request at Microsoft To Do UserVoice or at Microsoft Techcommunity enhance of this integration.

    • 0