Google/Gmail OIDC Auth

[bojanraic]

Hello,

I've been looking at https://developer.hashicorp.com/vault/tutorials/auth-methods/google-workspace-oauth
and trying to see if a similar Google auth setup is possible with Vault CR.
I'd want to enable users to sign in with their internal workspace Google ID and then control further access via Vault groups and policies.

Has anyone done something similar? Any YAML snippets you could share?
Thanks!

[csatib02]

Hi @bojanraic,

• Using Google Workspace OAuth with Vault for authentication is possible but not natively supported through the CRD configuration alone.
• You can find the currently supported auth-methods here: https://bank-vaults.dev/docs/concepts/external-configuration/authentication/
• You can try adapting a custom configuration in the Vault CR.

I'm thinking of something like this:

• Enable the JWT/OIDC Auth Method: Use Vault's JWT/OIDC auth method to integrate with Google Workspace.
• Configure Google Identity Provider: In your Google Workspace, create an OAuth app and set up the credentials.
• Set up JWT/OIDC in Vault: Use the jwt auth type in Vault CR to reference the Google Identity Provider's OIDC configuration, set policies, and bind users or groups.

apiVersion: "vault.banzaicloud.com/v1alpha1"
kind: "Vault"
metadata:
  name: "vault"
  namespace: "vault-namespace"
spec:
  auth:
    - type: jwt
      path: google-workspace
      description: "Login via Google Workspace"
      config:
        oidc_discovery_url: "https://accounts.google.com"
        bound_issuer: "https://accounts.google.com"
        default_role: "google-user-role"
        # Configure your client ID and secret from Google Workspace OAuth setup
        oidc_client_id: "<GOOGLE_CLIENT_ID>"
        oidc_client_secret: "<GOOGLE_CLIENT_SECRET>"
      roles:
        - name: "google-user-role"
          bound_audiences:
            - "<GOOGLE_CLIENT_ID>"
          user_claim: "email"
          groups_claim: "groups"
          policies: ["allow_secrets"]
          ttl: "1h"
          max_ttl: "24h"

A JWT example that might help you: https://github.com/bank-vaults/vault-operator/blob/main/deploy/examples/vault-config-jwt.yaml