Smallstep can integrate with Google Workspace to keep your ChromeOS device inventory in sync and manage credentials for ChromeOS devices.

You will need:

• A Smallstep team
• A Google Workspace tenant, with ability to manage domain-wide delegation
• A Google Cloud project, with ability to create service accounts and keys

In Google Cloud Console, select a project you will use for Smallstep. This can be any project, as long as you can grant domain-wide delegation to the client in a future step.

Your Google Cloud project must have the Admin SDK and Chrome Verified Access APIs enabled. By default, they're disabled.

1. Go to Admin SDK API for your project, and choose Enable API
2. Go to Chrome Verified Access API for your project, and choose Enable API

1. In Google Cloud, visit IAM & Admin → Service Accounts
2. Choose Create service account
3. Set a Service account name, e.g. Smallstep Google Workplace Sync
4. Optionally, provide a Description for the account
5. Choose Done
6. Open the details for the Service Account you just created
7. Copy the Unique ID (numeric) and the Email shown on the details tab; you’ll need them later

The Smallstep platform authenticates to your Google Workspace through Workspace Identity Federation for Google Kubernetes Engine.

1. In Google Cloud, visit IAM & Admin → Workload Identity Federation
2. Choose Create pool
3. Set a name, e.g. "Smallstep Google Workspace Sync Pool"
4. Optionally, provide a Description for the pool
5. Click Continue
6. Select OpenID Connect (OIDC) as the provider
7. Set a name, e.g. "Smallstep Google Workspace Sync"
8. Set the issuer URL to https://container.googleapis.com/v1/projects/prod-us-central1-e5bd/locations/us-central1/clusters/primary
9. Set Allowed audiences to sts.googleapis.com
10. Click Continue
11. For the google.subject attribute, set assertion.sub
12. Click Add mapping, and set attribute.k8s_sa to assertion.kubernetes.io.serviceaccount.name
13. Click Save

1. Click Grant access
2. Select Grant access using service account impersonation
3. Select the Service account you created earlier from the dropdown
4. Select k8s_sa as the attribute
5. Set system:serviceaccount:prod:inventory as the value for the attribute
6. Click Save
7. When the modal appears, you can Dismiss it

1. In Google Admin, visit Security → Access and data control → API controls
2. Under Domain wide delegation, select Manage Domain Wide Delegation
3. In the API Clients table, select Add new

   1. Enter the Unique ID of the service account from Step 1

   2. For the OAuth Scopes, enter the following scopes:

      https://www.googleapis.com/auth/admin.directory.device.chromeos
      https://www.googleapis.com/auth/verifiedaccess
      

   3. Choose Authorize

1. In Google Admin, visit Account → Admin roles
2. Click Create new role
3. Give it a descriptive name, e.g. Google Workspace Sync
4. Enable the Manage ChromeOS Devices privilege (incl. all subitems)
5. Click Continue
6. Click Create role
7. Click the newly created role
8. Click Admins assigned
9. Click Assign service accounts
10. Enter the principal of the service account created earlier
11. Click Assign role

In Smallstep, visit Settings → Device Management.

Configure a new Google Workspace Integration with the following values:

• The Customer ID of your Google Workspace tenant. The Customer ID is a short alphanumeric string. It can be obtained from the Google Workspace Admin Account Settings page
• The numeric Project ID of the GCP project your service account was created in
• The workload identity pool
• The workload identity provider
• The service account principal

After saving the Google Workspace connection, you will see settings for your integration.

1. Download the following Authority Certificates:

   • Smallstep Devices Root CA
   • Smallstep Devices Intermediate CA
   • Smallstep Agents Root CA
   • Smallstep Agents Intermediate CA

2. In Google Workspace, visit Devices → Networks → Certificates.

3. Choose an Organizational Unit, if desired

4. Choose Add certificate

   In the modal, configure the following:

   • Provide a descriptive name, e.g. Smallstep Devices Root
   • Upload the PEM file for the Smallstep Devices Root CA
   • Check ✅ Enabled for Chromebook
   • Choose Add

5. Repeat Step 4 for each of the certificates you downloaded

1. In Google Workspace, visit Devices → Chrome → Settings.
2. Select Device settings
3. Click Verified mode
4. Ensure the correct Organizational Unit is selected for scoping the configuration
5. Under Configuration, select Require verified mode boot for verified access
6. Set the email address of the GCP service account in the Services with full access field
7. Click Save

1. In Google Workspace, visit Devices → Chrome → Apps & extension.
2. Click Users & browsers
3. Ensure the proper Organizational Unit is selected for scoping the configuration
4. Click the + icon on the bottom right
5. Click Add Chrome app or extension by ID
6. Set the Extension ID to icjpnolkgdnfgpccpkdlipalcmalkndl
7. In the dropdown, choose From a custom URL, and set it to https://packages.smallstep.com/chromeos/latest/update.xml
8. Click Save
9. Click the newly created extension to edit it
10. Select Force install + pin as the Installation policy
11. Under Certificate management, enable allow access to keys and Allow enterprise challenge
12. Under Policy for extensions, add the following JSON, replacing <team-slug> with your Smallstep team slug:

{
  "team": {
    "Value": "<team-slug>"
  }
}

13. Click Save in the top right corner
14. Scroll down in the side panel details, and confirm the Installation URL field shows the URL you set in step 7.
15. Set the Update URL to Installation URL (see above)
16. Click Save

Within a few minutes, you should see all of your ChromeOS devices in Smallstep's Devices tab. A full sync is performed every 8 hours, and a partial sync every hour.

With the extension deployed, continue to Configure ChromeOS Device Identity Certificates — by default the extension only requests a short-lived attestation certificate, which can't be used for Wi-Fi, VPN, or mTLS.