Google Drive V1

• authentication for access to site-wide documents
  Use a G-Suite account with admin-level access rights to configure access to all shared documents owned by the users in your organization.
• authentication for access to per-user documents
  This type of authentication gives you access to your own documents in Google Drive. Admin-level access rights are not required, but Fusion must be running in an authorized domain.

​

Authentication for access to site-wide documents

1. Log in to Google as a user with admin-level access rights.
2. Go to https://console.developers.google.com/.
3. Create a Google project for Fusion:
   1. In the upper left, open the Project menu and select Create Project:
   2. Enter a new project name, such as “fusion”.
   3. Click Create.
   4. In the new project, click Enable API.
   5. Under “Google Apps APIs”, click Drive API.
   6. Click Enable. Google may prompt you to create credentials. Do not create credentials here; we will do that a few steps later.
   7. Click Library, then Admin SDK.
   8. Click Enable.
4. Create a service account key:
   1. Navigate to Credentials > Create Credentials > Service account key:
   2. From the Service account list, select Compute Engine default service account.
   3. Under “Key type”, select P12.
   4. Click Create. A new private key downloads automatically to your local drive. Google prompts you to store it securely and save the displayed password. The key and password will not be provided to you again.
5. Create a service account:
   1. Click Manage service accounts:
   2. Click Create Service Account.
   3. Enter a service account name, such as “fusion-service-account”.
   4. From the Role list, select Project > Service account actor:
   5. Select Enable G Suite Domain-wide Delegation.
   6. Enter an arbitrary name under Product name for the consent screen.
   7. Click Create. Google displays the list of service accounts.
   8. Next to the “fusion-service-account”, click View Client ID. You may need to scroll to the right in order to see this link.
   9. Copy the client ID and service account name. Save them in a separate location.
   10. Click the menu in the upper left and select IAM & Admin.
   11. Next to the “fusion-service-account” project, select its permissions as shown below:
6. Go to https://admin.google.com and log in with your G-Suite account.
7. Navigate to Admin Console > Security. Remember, you must be logged in as a user with admin-level access rights.
8. Navigate to Show more > Advanced settings > Manage API client access.
9. Create a new API client:
   1. In the Client Name field, enter the client ID from your service account (above).
   2. In the One or More API Scopes field, enter the following:
      Copy

      https://www.googleapis.com/auth/admin.directory.group,https://www.googleapis.com/auth/admin.directory.group.readonly,https://www.googleapis.com/auth/admin.directory.user,https://www.googleapis.com/auth/admin.directory.user.alias.readonly,https://www.googleapis.com/auth/drive,https://www.googleapis.com/auth/drive.readonly
      

   3. Click Authorize.
   The new API client authorization appears in the list:

​

Authentication for access to per-user documents

1. Log in to Google as a user with admin-level access rights.
2. Go to https://console.developers.google.com/.
3. Create a Google project for Fusion:
   1. In the upper left, open the Project menu and select Create Project:
   2. Enter a new project name, such as “fusion”.
   3. Click Create.
4. Create the client ID and client secret:
   1. In the new project, click Enable APIs and Services.
   2. Under “Google Apps APIs”, click Drive API.
   3. Click Enable. Google may prompt you to create credentials, if this is the first time you have enabled this API.
   4. Click Credentials, then Create Credentials > Oauth client ID.
   5. Select Web application.
   6. Enter a name for this Web application, such as “Fusion search”.
   7. In the Authorized Javascript origins field, enter “https://developers.google.com”.
   8. In the Authorized redirect URIs field, enter “https://developers.google.com/oauthplayground” and press Return on your keyboard.
   9. In the Authorized redirect URIs field, enter “http://FUSION_HOST:8764/admin/oauth-redirect”, specifying the hostname of your Fusion instance.
   10. Click Create. Google displays the new client ID and client secret.
   11. Copy the client ID and client secret. Save them in a separate location.
   12. Click OK.
   13. Go to https://developers.google.com/oauthplayground/.
   14. In the upper right, click the gear icon. The OAuth 2.0 configuration window opens.
   15. Select Use your own OAuth credentials.
   16. Enter your client ID and client secret.
   17. Click Close.
5. Navigate to Credentials > Oauth Consent Screen.
6. Under Authorized domains, enter the Google-verified domain under which Fusion is running.
7. Click Save.
8. Add the credentials to the datasource configuration in the Fusion UI:
   1. In the Google Drive datasource configuration panel, enter a string for the Datasource ID.
   2. Enter the Google client ID and client secret.
   3. Click Get Refresh Token. A new browser window opens, and Google prompts you for permission to access the documents:
   4. Click Allow. Fusion automatically populates the Google Drive Oauth Refresh Token field.
   5. In the Startlinks field, enter a starting URL to which this user has access. See below for details about the format for this value.
   6. Click Save.