After you set up your external key service and connect it to Google Workspace, you need to connect Google Workspace to your identity provider (IdP). Your external key service uses the IdP to authenticate users before they can encrypt files or access encrypted files.
Choose your IdP for CSE
If you don't already use a third-party identity provider (IdP) with Google Workspace, you can set up your IdP for use with your key service in either of two ways:
- Use a third-party IdP (recommended)—Use a third-party IdP if your security model requires more isolation of your encrypted data from Google.
Already use a third-party IdP for SAML-based Single-Sign-On (SSO)? It's recommended that you use the same IdP for CSE that you use for access to Google Workspace services. Learn more about using SAML-based SSO with Google Workspace.
- Use Google identity—If your security model doesn't require additional isolation of your encrypted data from Google, you can use the default Google identity as your IdP.
Choose how to connect to your IdP for CSE
You can set up your IdP—either a third party IdP or Google identity—using either a .well-known file that you host on your organization's website or the Admin console (which is your IdP fallback). There are several considerations for each method, as described in the table below.
|Considerations||.well-known setup||Admin console setup (IdP fallback)|
|Isolation from Google||IdP settings are stored on your own server.||IdP settings are stored on Google servers.|
|Admin responsibilities||An IdP admin can manage your setup instead of a Google Workspace Super Admin.||Only a Google Workspace Super Admin can manage your IdP setup.|
|CSE availability||CSE availability (uptime) depends on availability of the server that hosts your .well-known file.||CSE availability corresponds to the general availability of Google Workspace services.|
|Ease of setup||Requires changing DNS settings for your server, outside of the Admin console.||Configure settings in the Admin console.|
|Sharing outside your organization||Your collaborator's external key service can easily access your IdP settings. This access can be automated and ensures your collaborator's service has immediate access to any changes to your IdP settings.||
Your collaborator's external key service can't access your IdP settings in the Admin console. You must provide your IdP settings directly to your collaborator before you share encrypted files for the first time, as well as any time you change your IdP settings.
To connect Google Workspace to your identity provider (IdP), you can use a .well-known file or the Admin console. After you establish the connection, you need to allowlist your IdP in the Admin console.
(Option 1) To connect to your IdP using a .well-known file
To set up your third-party or Google IdP, you need to place a .well-known file on your organization’s public website. This file establishes which IdP you use and allows your external collaborators to discover your IdP settings.
1. Place your .well-known file on your server
Your IdP configuration must be placed at this URI on your domain:
where subdomain.domain.tld should match the domain in your email address. For example, if the domain in your email address is solarmora.com, you would place your .well-known file at:
Note: The prefix https://cse. is required because the .well-known URI is not registered with the IETF (RFC 8615).
The contents of your .well-known file, at well-known/cse-configuration, must be JSON encoded (RFC 8259) and contain these fields:
||The name of the IdP—you can use any name you like. This name will appear in IdP error messages for users in Google services, such as Drive and Docs Editors.|
The OpenID Connect (OIDC) client ID that the CSE client application uses to acquire a JSON Web Token (JWT).
If you're using a third-party IdP: You generate this ID using your IdP's admin console.
If you're using Google identity: You generate this ID using the Google Cloud Platform (GCP) Admin console. For details, go to "Create a client ID for Google identity" below.
The OIDC discovery URL, as defined in this OpenID specification.
If you're using a third-party IdP: Your IdP provides you with this URL, which usually ends with
If you're using Google identity: Use
The OAuth flow used for OIDC.
If you're using a third-party IdP: You can use either the
If you're using Google identity: You can use only the
If you're using a third-party IdP, your .well-known file should look like this:
"name" : "name of your IDP",
"client_id" : "ID from IDP",
"discovery_uri" : "https://your_idp.com/.well-known/openid-configuration"
If you're using Google identity, your .well-known file should look like this:
"name" : "Google Identity",
"client_id" : "ID from GCP",
"discovery_uri" : "https://accounts.google.com/.well-known/openid-configuration"
Your .well-known/openid-configuration and .well-known/cse-configuration need to allow origin URLs for Cross-Origin Resource Sharing (CORS) calls. Set up your configurations as follows:
.well-known/openid-configuration (discovery URI)
- Methods: GET
- Allowed origins:
- Methods: GET
- Allowed origins:
- Go to SecurityClient-side encryption.
Note: Under Identity provider configuration, a message appears indicating that Google Workspace can't reach your .well-known file. Since you're connecting to your IdP using the Admin console, you can ignore this message.
- Under Identity provider configuration, click Configure IdP fallback.
- Enter the details for your IdP.
These details are the same as for a .well-known file. For details about entering this information, refer to "Configure your .well-known file" above.
Configure your discovery URI to allow origin URLs for Cross-Origin Resource Sharing (CORS) calls, as follows:
- Methods: GET
- Allowed origins:
- Click Test connection.
If Google Workspace can connect to your IdP, the "Connection success" message appears.
- Click Add provider to close the card.
If you want to use Google identity instead of a third-party IdP, you'll need to create a client ID in the Google Cloud Platform (GCP) console:
- Go to console.cloud.google.com.
- Create a new GCP project. Get instructions.
Set the project up however you want—it's just to hold credentials.
- In the GCP console, create go to Menu APIs & ServicesCredentials.
- Create an OAuth Client ID for a new Web App you'll use with CSE. Get full instructions.
- Update Authorized Redirect URIs with
An OAuth client ID is created. Save this ID so you can use it for your .well-known/cse-configuration file. For instructions, refer to "Configure your .well-known file" above.
Allowlist your identity provider in the Admin console (for third-party IdP only)
After you set up your IdP, you can create CSE policies to enable CSE for users.