Connect to your identity provider for client-side encryption

Supported editions for this feature: Enterprise Plus; Education Standard and Education Plus.  Compare your edition

After you set up your external key service for Google Workspace Client-side encryption (CSE) and connect it to Google Workspace, you need to connect Google Workspace to your identity provider (IdP)—either a third party IdP or Google identity. Your external key service uses the IdP to authenticate users before they can encrypt files or access encrypted files.

Before you begin

Make sure you've completed the following steps:

1. Set up your external key service or hardware key encryption.
2. Add your key service or hardware key encryption to your Admin console.
3. Assign a key service or hardware key encryption  to organizational units or groups.

   If you're using multiple key services, make sure they're assigned to the appropriate organizational units or configuration groups. Optionally, you can complete this step after you connect to your IdP.

Plan your IdP connection

Expand section  |  Collapse all

Review supported services and applications

Your IdP connection provides CSE for all supported Google web services:

• Google Drive 
• Gmail 
• Google Calendar
• Google Meet (audio, video, and chat messages)

With your ldP connection, you can also set up CSE for the following applications:

• Drive for desktop
• Drive on Android and iOS
• Calendar on Androidand iOS 
• Gmail on Android and iOS
• Meet on Android and iOS

CSE support for other applications will be available in a later release.

Choose your IdP for CSE

If you don't already use a third-party identity provider (IdP) with Google Workspace, you can set up your IdP for use with your key service in either of two ways:

• Use a third-party IdP (recommended)—Use a third-party IdP if your security model requires more isolation of your encrypted data from Google.

  Already use a third-party IdP for SAML-based Single-Sign-On (SSO)? It's recommended that you use the same IdP for CSE that you use for access to Google Workspace services. Learn more about using SAML-based SSO with Google Workspace.

• Use Google identity—If your security model doesn't require additional isolation of your encrypted data from Google, you can use the default Google identity as your IdP.

Choose how to connect to your IdP for CSE

You can set up your IdP—either a third party IdP or Google identity—using either a .well-known file that you host on your organization's website or the Admin console (which is your IdP fallback). There are several considerations for each method, as described in the table below.

Considerations	.well-known setup	Admin console setup (IdP fallback)
Isolation from Google	IdP settings are stored on your own server.	IdP settings are stored on Google servers.
Admin responsibilities	A webmaster can manage your setup instead of a Google Workspace Super Admin.	Only a Google Workspace Super Admin can manage your IdP setup.
CSE availability	CSE availability (uptime) depends on availability of the server that hosts your .well-known file.	CSE availability corresponds to the general availability of Google Workspace services.
Ease of setup	Requires changing DNS settings for your server, outside of the Admin console.	Configure settings in the Admin console.
Sharing outside your organization	Your collaborator's external key service can easily access your IdP settings. This access can be automated and ensures your collaborator's service has immediate access to any changes to your IdP settings.	Your collaborator's external key service can't access your IdP settings in the Admin console. You must provide your IdP settings directly to your collaborator before you share encrypted files for the first time, as well as any time you change your IdP settings.

If using Google identity: Create a client ID in Google Cloud console

If you'll provide CSE for supported Google services using Google identity instead of a third-party IdP, you need to create a client ID in the Google Cloud console:

1. Go to console.cloud.google.com.
2. Create a new Google Cloud project. Get instructions.

   Set the project up however you want—it's just to hold credentials.

3. In the console, go to Menu APIs & ServicesCredentials.
4. Create an OAuth Client ID for a new Web App you'll use with CSE. Get full instructions.
5. Update JavaScript origins with the following:
   • https://admin.google.com
   • https://client-side-encryption.google.com
6. Update Authorized Redirect URIs with the following.

   Web services:

   • https://client-side-encryption.google.com/callback
   • https://client-side-encryption.google.com/oidc/cse/callback
   • https://client-side-encryption.google.com/oidc/drive/callback
   • https://client-side-encryption.google.com/oidc/gmail/callback
   • https://client-side-encryption.google.com/oidc/meet/callback
   • https://client-side-encryption.google.com/oidc/calendar/callback
   • https://client-side-encryption.google.com/oidc/docs/callback
   • https://client-side-encryption.google.com/oidc/sheets/callback
   • https://client-side-encryption.google.com/oidc/slides/callback

   Drive for Desktop:

   http://localhost

   Android and iOS mobile apps:

   No additional configuration is needed for Android and iOS mobile apps.
7. An OAuth client ID is created. Save this ID so you can use it for your .well-known/cse-configuration file or the Admin console. For instructions, refer to Configure your .well-known file below.

Connect to your IdP for CSE

To connect Google Workspace to your identity provider (IdP), you can use a .well-known file or the Admin console. After you establish the connection, you need to allowlist your IdP in the Admin console.

Expand section  |  Collapse all

(Option 1) To connect to your IdP using a .well-known file

To set up your third-party or Google IdP, you need to place a .well-known file on your organization’s public website. This file establishes which IdP you use and allows your external collaborators to discover your IdP settings.

1. Place your .well-known file on your server

Your IdP configuration must be placed at this URI on your domain:

https://cse.subdomain.domain.tld/.well-known/cse-configuration

where subdomain.domain.tld should match the domain in your email address. For example, if the domain in your email address is solarmora.com, you would place your .well-known file at:

https://cse.solarmora.com/.well-known/cse-configuration

Note: The prefix https://cse. is required because the .well-known URI is not registered with the IETF (RFC 8615).

2. Configure your .well-known file

The contents of your .well-known file, at well-known/cse-configuration, must be JSON encoded (RFC 8259) and contain these fields:

Field	Description
name	The name of the IdP—you can use any name you like. This name will appear in IdP error messages for users in Google services, such as Drive and Docs Editors.
client_id	The OpenID Connect (OIDC) client ID that the CSE client web application uses to acquire a JSON Web Token (JWT). If you're using a third-party IdP: You generate this ID using your IdP's admin console. If you're using Google identity: You generate this ID using the Google Cloud console. For details, go to Create a client ID for Google identity below.
discovery_uri	The OIDC discovery URL, as defined in this OpenID specification. If you're using a third-party IdP: Your IdP provides you with this URL, which usually ends with /.well-known/openid-configuration If you're using Google identity: Use https://accounts.google.com/.well-known/openid-configuration
grant_type	The OAuth flow used for OIDC with CSE client web applications. If you're using a third-party IdP: You can use either the implicit or authorization_code grant type for CSE web applications.  If you're using Google identity: You can use only the implicit grant type for web applications.
applications	The additional client applications you want to use CSE with. See Supported services and applications above. You need to add a client ID for each app to your .well-known file.  Note: These client IDs must support the authorization_code grant type for PKCE (RFC 7636). If you're using a third-party IdP: Use your IdP's admin console to generate a separate client ID for each app. If you're using Google identity: Use the following client IDs, as shown in the examples below. Drive for Desktop—Use the client ID 947318989803-k88lapdik9bledfml8rr69ic6d3rdv57.apps.googleusercontent.com Drive on Android—Use the client ID 313892590415-6lbccuf47cou4q45vanraqp3fv5jt9do.apps.googleusercontent.com Drive on iOS—Use the client ID 313892590415-d3h1l7kl4htab916r6jevqdtu8bfmh9m.apps.googleusercontent.com Calendar on Android—Use the client ID 313892590415-q84luo8fon5pn5vl8a6rppo1qvcd3qvn.apps.googleusercontent.com Calendar on iOS—Use the client ID 313892590415-283b3nilr8561tedgu1n4dcm9hd6g3hr.apps.googleusercontent.com Gmail on Android—Use the client ID 313892590415-samhd32i4piankgs42o9sit5e9dug452.apps.googleusercontent.com Gmail on iOS—Use the client ID 313892590415-ijvjpbnsh0gauuunjgsdn64ngg37k6rc.apps.googleusercontent.com Meet on Android—Use the client ID 313892590415-i06v47su4k03ns7ot38akv7s9ari5oa5.apps.googleusercontent.com Meet on iOS—Use the client ID 313892590415-32ha2bvs0tr1b12s089i33o58hjvqt55.apps.googleusercontent.com

If you're using a third-party IdP, your .well-known file should look like this:

{

  "name" : "name of your IdP",

  "client_id" : "ID from IdP",

  "discovery_uri" : "https://your_idp.com/.well-known/openid-configuration",

  "applications":{

    "drivefs":{

      "client_id": "ID from IdP"

    },

    "drive-android": {

      "client_id": "ID from IdP"
    },

    "drive-ios": {

      "client_id": "ID from IdP"

    },

    "calendar-android": {

      "client_id": "ID from IdP"

    },

    "calendar-ios": {

      "client_id": "ID from IdP"

    },

    "gmail-android": {

      "client_id": "ID from IdP"

    },

    "gmail-ios": {

      "client_id": "ID from IdP"

    },

    "meet-android": {

      "client_id": "ID from IdP"

    },

    "meet-ios": {

      "client_id": "ID from IdP"

    }

  }

}

If you're using Google identity, your .well-known file should look like this:

{

  "name" : "Google Identity",

  "client_id" : "ID from Google Cloud (created above)",

  "discovery_uri" : "https://accounts.google.com/.well-known/openid-configuration",

  "applications":{

    "drivefs":{

      "client_id": "947318989803-k88lapdik9bledfml8rr69ic6d3rdv57.apps.googleusercontent.com"

    },

    "drive-android":{
      "client_id": "313892590415-6lbccuf47cou4q45vanraqp3fv5jt9do.apps.googleusercontent.com"
    },
    "drive-ios":{
      "client_id": "313892590415-d3h1l7kl4htab916r6jevqdtu8bfmh9m.apps.googleusercontent.com"

    },
    "calendar-android":{
      "client_id": "313892590415-q84luo8fon5pn5vl8a6rppo1qvcd3qvn.apps.googleusercontent.com"

    },
    "calendar-ios":{
      "client_id": "313892590415-283b3nilr8561tedgu1n4dcm9hd6g3hr.apps.googleusercontent.com"

    },
    "gmail-android":{
      "client_id": "313892590415-samhd32i4piankgs42o9sit5e9dug452.apps.googleusercontent.com"

    },
    "gmail-ios":{
      "client_id": "313892590415-ijvjpbnsh0gauuunjgsdn64ngg37k6rc.apps.googleusercontent.com"

    },
    "meet-android":{
      "client_id": "313892590415-i06v47su4k03ns7ot38akv7s9ari5oa5.apps.googleusercontent.com"

    },
    "meet-ios":{
      "client_id": "313892590415-32ha2bvs0tr1b12s089i33o58hjvqt55.apps.googleusercontent.com"

    }

  }

}

3. Set your configurations for CORS

Your .well-known/openid-configuration and .well-known/cse-configuration need to allow origin URLs for Cross-Origin Resource Sharing (CORS) calls. In your IdP's admin console, set up your configurations as follows:

.well-known/openid-configuration (discovery URI)

• Methods: GET
• Allowed origins:
  • https://admin.google.com
  • https://client-side-encryption.google.com

.well-known/cse-configuration

• Methods: GET
• Allowed origins:
  • https://admin.google.com
  • https://client-side-encryption.google.com

4. Add redirect URIs to your IdP admin console

Use your IdP admin console to add these authorized redirect URIs in the CSE client application you previously created.

Web services:

• https://client-side-encryption.google.com/callback
• https://client-side-encryption.google.com/oidc/cse/callback
• https://client-side-encryption.google.com/oidc/drive/callback
• https://client-side-encryption.google.com/oidc/gmail/callback
• https://client-side-encryption.google.com/oidc/meet/callback
• https://client-side-encryption.google.com/oidc/calendar/callback
• https://client-side-encryption.google.com/oidc/docs/callback
• https://client-side-encryption.google.com/oidc/sheets/callback
• https://client-side-encryption.google.com/oidc/slides/callback

Drive for Desktop:

http://localhost

Android and iOS mobile apps:

• https://client-side-encryption.google.com/oidc/gmail/native/callback
• https://client-side-encryption.google.com/oidc/meet/native/callback
• https://client-side-encryption.google.com/oidc/calendar/native/callback
• https://client-side-encryption.google.com/oidc/drive/native/callback
• https://client-side-encryption.google.com/oidc/gmail/meet/native/callback

(Option 2) To connect to your IdP using the Admin console (IdP fallback)

You must be signed in as a super administrator for this task.

Instead of using a .well-known file, you can connect Google Workspace to your IdP using the Admin console.

1. Sign in to your Google Admin console.

   Sign in using an account with super administrator privileges (does not end in @gmail.com).

2. In the Admin console, go to Menu  SecurityAccess and data controlClient-side encryption.

   Note: Under Identity provider configuration, a message appears indicating that Google Workspace can't reach your .well-known file. Since you're connecting to your IdP using the Admin console, you can ignore this message.

3. Under Identity provider configuration, click Configure IdP fallback.
4. Enter the details for your IdP.

   These details are the same as for a .well-known file. For details about entering this information, refer to Configure your .well-known file above.

5. Configure your discovery URI to allow origin URLs for Cross-Origin Resource Sharing (CORS) calls, as follows:

   • Method: GET
   • Allowed origins:
     • https://admin.google.com
     • https://client-side-encryption.google.com
6. Click Test connection.

   If Google Workspace can connect to your IdP, the "Connection success" message appears.

7. (Optional) To use CSE with specific applications:
   1. Under Authentication for Google desktop and mobile applications (optional), select the applications you want to use CSE with.
   2. For Client ID, provide the client ID for the application, depending on which IdP you're using:

      If you're using a third-party IdP—Provide a separate client ID specifically for the application, which you can generate using your IdP's admin console.

      If you're using Google identity—Provide the following client IDs for the applications you want to use:

      • Drive for desktop—947318989803-k88lapdik9bledfml8rr69ic6d3rdv57.apps.googleusercontent.com
      • Drive on Android—313892590415-6lbccuf47cou4q45vanraqp3fv5jt9do.apps.googleusercontent.com
      • Drive on iOS—313892590415-d3h1l7kl4htab916r6jevqdtu8bfmh9m.apps.googleusercontent.com
      • Calendar on Android—313892590415-q84luo8fon5pn5vl8a6rppo1qvcd3qvn.apps.googleusercontent.com
      • Calendar on iOS—313892590415-283b3nilr8561tedgu1n4dcm9hd6g3hr.apps.googleusercontent.com
      • Gmail on Android—Use the client ID 313892590415-samhd32i4piankgs42o9sit5e9dug452.apps.googleusercontent.com
      • Gmail on iOS—Use the client ID 313892590415-ijvjpbnsh0gauuunjgsdn64ngg37k6rc.apps.googleusercontent.com
      • Meet on Android—313892590415-i06v47su4k03ns7ot38akv7s9ari5oa5.apps.googleusercontent.com
      • Meet on iOS—313892590415-32ha2bvs0tr1b12s089i33o58hjvqt55.apps.googleusercontent.com
8. Click Add provider to close the card.

Add your identity provider to your allowlist in the Admin console (for third-party IdP only)

You need to add your third-party IdP to your trusted list of third-party apps so users don't need to sign in to your IdP repeatedly. Follow the instructions in Control which third-party & internal apps access Google Workspace data, under "Manage access to apps: Trusted, Limited, or Blocked."

Next steps...

After you set up your IdP, you can Turn on CSE for users.