Google Workspace sign-in and directory

Lets people sign in to Bodhaka Lumen with their Google Workspace account, and can import people and groups from your Google Workspace directory so accounts and groups stay in step with your organisation.

What you need

Google Workspace.
A Google Cloud project with an OAuth client, and for directory import the Admin SDK API enabled.
A Google Workspace administrator to consent once for directory import.

Permissions requested and why

Permission or scope	What it allows	Why it is needed
`openid`	Sign in	Proving who the person is.
`email`	See the email address	Matching the person to their account.
`profile`	See the name	Showing the person’s name once they are in.
`https://www.googleapis.com/auth/admin.directory.user.readonly`	View users in your domain	Directory import only: reading people to create and update their accounts.
`https://www.googleapis.com/auth/admin.directory.group.readonly`	View groups in your domain	Directory import only: reading groups and who belongs to them.

Bodhaka Lumen asks for nothing beyond this list. Credentials you enter are encrypted with your workspace’s own key and are never shown again after saving.

How to connect

In Google Cloud Console, create an OAuth client of type Web application.
Add the redirect address shown in Bodhaka Lumen’s guided setup to the client’s authorised redirect URIs.
In Bodhaka Lumen, open Integrations, choose Google Workspace for sign-in, and enter the client ID and client secret.
For directory import, choose Google Workspace under the directory option, sign in as a Google Workspace administrator and consent to the two read-only directory scopes. Preview the people and groups found before importing.
Switch the integration on. The Google sign-in button then appears on your workspace’s sign-in page.

How to disconnect and delete data

In Bodhaka Lumen, open Integrations, then My integrations, and remove the sign-in or directory integration. The stored client secret and refresh token are deleted from your workspace. Directory sync stops.
An administrator can revoke the app in the Google Admin console under Security, API controls, App access control. A person can remove access at myaccount.google.com/permissions.
People and groups already imported remain as accounts in Bodhaka Lumen until your administrator deletes them.

To have any data that came through this integration deleted from Bodhaka Lumen, your workspace administrator can delete it, or write to support@bodhakalumen.com. See the Privacy Policy.

Want early access?

Tell us about your school or organisation and we will be in touch.

Write to us