Audience: Customer IT, Google Workspace administrator, information security officer
- Before you begin
- 1. Create a project and enable the APIs
- 2. Create a service account
- 3. Delegate domain-wide authority
- 4. Create buildings and rooms
- 5. Set up the delegate user
- 6. Allow calendar sharing
- 7. Share every room calendar with the delegate user
- 8. Create a key
- 9. Share the credentials with Spacewell
Reservation Sync needs a service account that may act on the room (resource) calendars in your Google Workspace, and a delegate user who has permission to change events on those calendars. This guide walks you through the set-up.
Before you begin
- You need administrator access to Google Workspace (Google Cloud console and Google Admin console).
- Plan ahead: domain-wide delegation and external-sharing changes can take up to 24 hours to take effect.
1. Create a project and enable the APIs
Open the Google Cloud console (https://console.cloud.google.com/) and select IAM & Admin > Create a Project. Enter a name and location and click Create.
Go to APIs & Services > Enabled APIs & Services > + Enable APIs and Services.
Search for "calendar", select Google Calendar API and click Enable.
Search for "admin", select Admin SDK API and click Enable.
2. Create a service account
Go to Credentials > + Create Credentials > Service account.
Name the service account Asset and click Create and Continue. This name is shown in the "Created by" field of Google reservations.
Grant access for the created service account. Select the role Owner and Continue.
Click Done to finish creating service account.
3. Delegate domain-wide authority
Open the Google Admin console (https://admin.google.com/) and go to Security > Access and data control > API Controls > Manage Domain-Wide Delegation > Add new.
Enter the service account’s Client ID (shown on the Service accounts page). (You can find your service account's client ID in the Service accounts page.)
In OAuth scopes, enter the two scopes below (comma-separated) and click Authorise.
wide760wide760Only add these extra scopes if you also need to manage users or domains:
wide760wide760The service account can now make API calls on behalf of a user in your domain ("impersonation"). That user can be an admin or a non-admin with a valid e-mail address in the domain.
Info
Use a non-admin account as the impersonated user, to avoid unwanted access to other parts of Google API management.
Access is usually granted within minutes, but can take up to 24 hours.
4. Create buildings and rooms
In the Admin console go to Directory > Buildings and resources > Manage resources.
Select Buildings and click Add building. Enter name and floors and click Add Building.
Select Resources and click Add new resource. Enter category, building, floor, resource name and capacity, and click Add Resource (via the yellow + circle). Repeat for all rooms.
Enter the Category, Building, Floor, Resource name and Capacity.
Click Add Resource to confirm the added resource.
Add all applicable resources via the above steps.
5. Set up the delegate user
Google Workspace only allows changes to resource calendars through a valid delegate user: a user account with a valid e-mail address in your organization. All creates, changes and deletions on resource calendars are done on behalf of this user.
New delegate user: in the Admin console, go to Directory > Users > Add new user. Enter first name, surname, primary e-mail and organizational unit, set a password and click Add New User. Copy the primary e-mail.
Existing delegate user: go to Directory > Users, open the user and copy the e-mail address.
Open the desired delegate user and copy the email address from this screen. This email address is needed for configuration in a later chapter.
6. Allow calendar sharing
Admins can control how much calendar information is shared with users external to the organization.
In the Admin console go to Apps > Google Workspace > Calendar > General Settings.
Under External Sharing options for Secondary Calendars, select Share all information, and outsiders can change calendars, and click Save.
Info
Changes to external sharing can take up to 24 hours.
7. Share every room calendar with the delegate user
Sign in to Google Calendar (https://calendar.google.com/) as admin. Go to Other calendars > + > Browse resources and select all rooms (per building) that must beavailable for reservations. They appear under My calendars. Here you can allow the service account to manage events for every resource.
For each room: hover over it, click the three dots > Settings and sharing.
Under Share with specific people or groups, click + Add people and groups, select the delegate user, choose Make changes to events and click Send.
Please repeat the steps above for all the available/needed resources by sharing the calendar to all Delegate users (impersonate) manually.
Note
If the delegate user is missing or has the wrong permission on a room, synchronization for that room can fail partly or completely. Check every room.
8. Create a key
In the Google Cloud console (https://console.cloud.google.com/), go to IAM & Admin > Service accounts and open the service account from step 2.
Go to Keys > Add key > Create new key, select JSON and click Create.
The JSON file is downloaded to the local machine and the key is displayed in the service account key overview. Store it securely.
Info
Please save the downloaded JSON file that contains the key at a safe/secure location.
Note
This file is the only copy of the private key. If you lose it, you need to create a new key (and repeat steps 7–8).
9. Share the credentials with Spacewell
Share the key securely, for example with a single-use, expiring link (e.g. Onetime Secret), and send the link, the passphrase and the other details to the Spacewell consultant with your organization name in the subject. You can use any other secure channel that fits your policy.
What | Where you found it |
|---|---|
client_email | JSON key file (step 8) |
private_key | JSON key file (step 8) |
Impersonated user e-mail | The delegate user (step 5) |
E-mail domains | Your e-mail domain(s) |
Secret expiry date | JSON key file (step 8) |