Google Workspace

Camper manages Groups, Shared Drives, and Shared Calendars on Google Workspace.

Directory vs target. Connecting Google here does not import people. People enter via SCIM. Google as a source is covered under Google Workspace setup.

Prerequisites

• Camper owner or admin
• A Google Workspace admin for the domain you want to manage
• Directory already receiving people (recommended before linking resources)

Summary of steps

1. Open Connections → Google Workspace → Set up
2. Continue with Google as a Workspace admin and approve scopes
3. Confirm health on Done, then link resources

Connect with Google (recommended)

1. Open Connections → Google Workspace → Set up.
2. Read Check access, then Continue.
3. On Grant access, click Continue with Google, sign in as a Workspace admin, and approve the scopes Camper requests.
4. Camper seals a refresh token and runs per-scope health checks. You return to Done with the result.

No service-account JSON is pasted in the browser on this path.

What the admin grants

Surface	Required
Directory groups + members	Yes (core membership)
Cloud Identity groups	Optional (locks managed Groups — recommended)
Directory user read	Optional (better identity resolve)
Drive	Optional (Shared Drives)
Calendar	Optional (shared calendars)

If optional scopes fail health checks, Groups still work; Drive and Calendar resource types need those scopes granted. Without Cloud Identity groups, Camper can still manage membership but cannot apply the Locked label.

Locked Google Groups

Camper locks Google Groups it creates or links so membership stays aligned with your org chart and cannot be edited ad hoc in groups.google.com.

Situation	What Camper does
Create managed group	After Directory create, apply the Cloud Identity Locked label
Attach existing group	On the next reconcile, lock the group if it is not already locked
Already locked	No change

Locking uses the Cloud Identity Groups API label cloudidentity.googleapis.com/groups.locked. Only selected Workspace admins can still change locked groups (Super Admin, Groups Admin, or a custom role with Manage locked label). See Google’s guide: Lock groups to keep data in sync.

Edition note: Locked groups require a supported Workspace edition (for example Enterprise Standard/Plus, Education Standard/Plus, Cloud Identity Premium). If locking is unavailable, Camper continues membership sync and leaves the lock health check optional.

Attach / browse limits

Type	What appears in search
Shared Drives	Domain-wide when the connecting admin has Manage shared drives; otherwise only drives that admin is a member of
Shared calendars	Only secondary calendars on the connecting admin’s Google calendar list. Google has no domain-wide “every shared calendar” API. Primary (personal) calendars are excluded

If a calendar is missing

1. Copy its Calendar ID from Google Calendar settings and paste it in the link form, or
2. Add that calendar to the connecting admin’s list, then Refresh in Camper, or
3. Prefer Create new (managed) when Camper should own the calendar from the start

Room and equipment resource calendars are a different Google object and are not listed here.

How calendar membership works

By default Camper grants ACL access only. Google emails the member a “shared a calendar” invitation. This works with OAuth and does not need domain-wide delegation.

Optionally, on a service account connection, turn on Force calendars onto each user's list under Manage. Camper then:

1. Grants the ACL without a Google share notification (sendNotifications=false)
2. Impersonates each member via domain-wide delegation and inserts the calendar into their list

Members see the calendar appear without an invite email or accept step. Leave this off unless you need that behaviour.

Individual people vs Google Group (Drives and Calendars)

When you link a Shared Drive or Shared Calendar, the Access step's first inline choice decides how Camper manages access:

Choice	Behaviour
everyone in <unit> / everyone in <unit> and below (default)	Camper adds and removes each person based on org placement, pins, and access rules — same model as Google Groups.
the Google Group for <unit>	Camper grants the Google Group resource linked to the same org unit as a single ACL principal. Google expands who is in the group. Camper does not add individuals on the drive or calendar.

Link a Google Group to the org unit first when using group mode. The group’s email must be known to Camper (group external id or email in resource config). You can change the mode later under Edit access rules.

In group mode the movers and leavers rules do not apply — Camper never placed those people, so Google's group membership governs them. What remains is what Camper should do about people granted access directly on the drive or calendar, outside the linked group:

• Report (default) — listed as drift on the resource; nothing is changed.
• Remove — Camper strips direct ACLs so the group is the only way in.

The access level you pick applies to the group itself: member grants Drive writer / Calendar writer. Prefer member for routine links.

Org-unit leads (Groups and Shared Drives)

Leads on the linked org unit get elevated access without becoming owners:

Resource	Members	Leads
Google Group	MEMBER	MANAGER
Shared Drive	Contributor (writer)	Content manager (fileOrganizer)

If the drive or calendar uses group-delegated access, the group still gets the member tier, and each lead also gets an individual ACL at the lead tier on Shared Drives. Full product story: Org unit leads.

Advanced: service account + domain-wide delegation

Use this path when OAuth is not available in your environment, or when you need Force calendars onto each user's list (per-user impersonation). For most orgs, Connect with Google is enough.

You will prepare three things in Google, then enter three matching values in Camper.

What Camper asks for

Camper field	What it is	Where it comes from
Service account JSON	The private key for a GCP service account	Downloaded when you create a key in Google Cloud (.json file). Upload is the default in Camper; paste only if you must.
Admin to impersonate	A Workspace user Camper acts as	A super admin (or equivalent) email in your Workspace domain — not the service account email.
Primary domain	The Workspace domain Camper manages	Usually the domain after @ on the admin email. Optional in the form — Camper fills it from the admin when blank.

Optional toggle on the same form: Force calendars onto each user's list (see How calendar membership works). Leave it off unless you need that behaviour.

Nothing else is pasted into Camper. Domain-wide delegation is configured in Google Workspace Admin, not in the Camper form.

Map: Google setup → Camper fields

GCP service account + JSON key  ──►  Service account JSON  (upload the .json)
Workspace super admin user      ──►  Admin to impersonate  (e.g. admin@your-domain.com)
Your Workspace primary domain   ──►  Primary domain        (e.g. your-domain.com)
SA numeric client id + scopes   ──►  (Workspace Admin DWD only — not a Camper field)

1. Create a service account in Google Cloud

You need a GCP project you control (any project is fine; it does not have to host other Camper infrastructure).

1. Open Google Cloud Console and select (or create) a project.
2. APIs & Services → Library — enable at least:
   • Admin SDK API (required for Groups and directory)
   • Cloud Identity API (recommended — lock managed Groups)
   • Google Drive API (if you will manage Shared Drives)
   • Google Calendar API (if you will manage shared calendars)
3. IAM & Admin → Service Accounts → Create service account.
   • Name it something clear (for example camper-workspace).
   • You do not need to grant this SA project IAM roles for Camper; Workspace access comes from domain-wide delegation, not from GCP roles on the project.
4. Open the new service account → Keys → Add key → Create new key → JSON.
   • Save the downloaded file somewhere safe (password manager or secrets vault). Treat it like a password.
   • This file is what Camper calls Service account JSON.
5. On the service account details page, copy the Unique ID (a long number). That is the client id you authorize in Workspace domain-wide delegation — it is not the same as client_email, and you do not paste it into Camper.

The JSON includes fields such as type (service_account), client_email, private_key, and client_id. Camper only needs a valid key object with client_email and private_key; it seals the full object on the server.

2. Authorize domain-wide delegation in Workspace Admin

A Workspace super admin must allow this service account to impersonate users.

1. Open Google Admin as a super admin.
2. Go to Security → Access and data control → API controls → Domain-wide delegation
   (direct link: Domain-wide delegation).
3. Add new (or edit an existing entry for this client id).
4. Client ID — paste the service account Unique ID (numeric) from Cloud Console.
5. OAuth scopes — paste the scopes below as a single comma-separated list (no spaces after commas is fine; Google also accepts spaces after commas).

Scopes Camper needs (same surfaces as OAuth health checks):

https://www.googleapis.com/auth/admin.directory.group,https://www.googleapis.com/auth/admin.directory.group.member,https://www.googleapis.com/auth/cloud-identity.groups,https://www.googleapis.com/auth/admin.directory.user.readonly,https://www.googleapis.com/auth/drive,https://www.googleapis.com/auth/calendar

Scope	Used for
admin.directory.group	List / create / update Google Groups
admin.directory.group.member	Group membership
cloud-identity.groups	Apply the Locked label on managed Groups (recommended)
admin.directory.user.readonly	Resolve people by email (optional but recommended)
drive	Shared Drives
calendar	Shared calendars (and force-add to user lists when enabled)

6. Authorize. Changes can take a few minutes to apply.

If a scope is missing, Camper may still seal the key but the health check for that surface fails until you add the scope and save again.

3. Connect in Camper

1. Open Connections → Google Workspace → Set up (or Manage → Reconnect with Google).

2. On Grant access, open Use a service account instead.

3. Fill the three fields:

   Field	What to enter
   Service account JSON	Choose file and select the .json key from step 1. Only a small JSON object is accepted (max 64 KB). Use Enter JSON manually only if you must paste.
   Admin to impersonate	Workspace admin email Camper should act as (for example admin@your-domain.com). Must be allowed to manage Groups / Drives / Calendars as needed.
   Primary domain	Leave blank to use the domain from the admin email, or set explicitly (for example your-domain.com).

4. Optionally turn on Force calendars onto each user's list.

5. Click Save service account. Camper seals the key with your tenant key, runs per-scope health checks, and opens Done when healthy.

You can switch between OAuth and service account later via Manage → Reconnect with Google.

Security notes

• The key file is read as text in the browser, then sealed on the Camper server. Camper never executes the file.
• Prefer upload over pasting keys into chat or tickets.
• Rotate the key in Google Cloud if it is exposed; then reconnect in Camper with the new JSON.
• Domain-wide delegation is powerful — use a dedicated service account and only the scopes listed above.

Troubleshooting

Symptom	What to check
Health check fails on groups	Admin is a super admin (or has group admin rights); DWD client id matches the SA Unique ID; Admin SDK API enabled; group scopes authorized.
Drive or Calendar check fails	Drive / Calendar API enabled in the GCP project; matching scopes in DWD; admin can manage those products.
“Invalid credentials” / JSON rejected	File is the Google service account key JSON (type is service_account), not an OAuth client secret or user credential.
Force calendar list does nothing	Connection must be service account with DWD; toggle is under Manage after connect.

Related

• Connections overview
• Link resources
• Google Workspace as directory source