Google Workspace sign-in

Cybex connects to Google Workspace in two ways. Both let people sign in to managed computers with their managed Google account; they differ in what happens at the login screen. Read Set up directory sign-in first if you have not chosen between them yet.

• Google Workspace shows a web address and a one-time code on the login screen. People finish signing in on a phone or another computer. Requires the GDM login screen, and every Blueprint on the Policy must have Allow James to build from source switched on.
• Google Workspace (password) lets people type their Google password directly at the login screen. Any login screen works, and it needs no source builds. It uses Google’s Secure LDAP service, which is not included in every Workspace edition.

Google Workspace with a sign-in code

Create the Google client

1. Open the Google Auth Platform and create or select a project owned by your Google Workspace organization.
2. If this is a new Auth Platform app, select Get started. Enter a recognizable app name and monitored support and contact addresses.
3. Set Audience to Internal, so only accounts in your Workspace organization can authorize the app. Keep access limited to the basic openid, email, and profile identity scopes Cybex requests.
4. Open Clients, select Create client, and choose TVs and Limited Input devices as the application type.
5. Name the client, create it, and immediately copy the Client ID and Client secret. Google shows a new client secret in full only when it is created; store it using your normal secret-management process.

See Google’s current Auth Platform setup, limited-input device flow, and client secret guidance.

Connect it to Cybex

1. In Cybex Manage, open Settings > Sign-in sources.
2. Under Directory connections, find Google Workspace and select Connect.
3. Enter the organization’s primary Workspace domain, then paste the Client ID and Client secret. The secret is encrypted before it is stored.
4. Leave group rules under Admin rights on the computers empty unless your identity tokens contain a matching claim. Standard Google identity tokens do not include Workspace group membership, so a group rule usually matches nobody.
5. Select Test & connect, open the displayed Google address and enter the one-time code on another device, then sign in with an account from the Workspace domain.
6. Cybex reports which account signed in and the username it lands on at the computer. Select Done.

If Google blocks the test, confirm that the client type is TVs and Limited Input devices, that the app audience is correct, and that Workspace API controls permit the OAuth client. New Google client settings can take time to propagate.

Google Workspace with a password

This method uses Google’s Secure LDAP service. The computer checks the password with Google directly, so no code and no browser are involved and every login screen works.

Before you start

• A Workspace edition that includes Secure LDAP. It is not part of Business Starter or Business Standard. Check your edition against Google’s LDAP client documentation.
• A user number and a group number for each person who signs in. A computer identifies people by number, not by name, and Google hands one out only when it has been set on the account. Cybex can set them for you — see Let Cybex assign user numbers below — or you can set them yourself in Google Admin. The connection test reports which numbers come back.

You do not need to set a home folder or a shell in Google. Cybex gives every person a home folder under /home and the managed shell, and ignores whatever the directory says about either.

Create the LDAP client in Google Admin

1. In the Google Admin console, open Apps > LDAP and select Add client.
2. Name the client — for example Cybex workstations — and continue.
3. Under Access permissions, allow Verify user credentials, Read user information, and Read group information for the whole domain or for the organizational units whose people sign in to managed computers.
4. Continue, then Download certificate. The downloaded ZIP contains a .crt and a .key file; store them with your normal secret-management process.
5. Open the client’s details and set its service status to On.

Google’s own instructions are in Connect LDAP clients to the Secure LDAP service. New LDAP clients can take time to become usable.

Connect it to Cybex

1. In Cybex Manage, open Settings > Sign-in sources.
2. Under Directory connections, find Google Workspace (password) and select Connect.
3. Enter the Workspace domain. Cybex fills in Google’s directory address and the matching search base from it.
4. Under Google certificate and key, select both the .crt and the .key file from the ZIP Google produced.
5. In Test with this account, enter the username of a directory account to look up — the part of the address before the @.
6. Select Test connection. Cybex saves the connection when the account is found.

Advanced LDAP settings hold the directory address, search base, directory layout, and a bind account. Google’s normal values are filled in automatically; change them only for an existing custom LDAPS deployment of your own.

Read the test result

The test does more than confirm the password: it shows what the computer will receive for that person.

• Username is the name the account gets on the computer.
• User number and Group number are highlighted when the directory does not return them. Without them a computer cannot create the account and sign-in will fail. Turn on automatic user numbers and test again.
• Home folder and Shell are shown for information only. Cybex replaces both with its own values on every managed computer, so it does not matter what Google returns.
• A warning appears when the directory cannot be searched by user number. At best, file listings and id show raw numbers instead of names for people who have not signed in on that computer yet; at worst, those people cannot sign in at all. Treat it as something to fix before you rely on the connection — letting Cybex assign the numbers fixes it.

If the test fails, Cybex names the likely cause — a wrong search base, a rejected certificate, or an account that does not exist. Connect without testing saves the connection unverified.

Let Cybex assign user numbers

A computer identifies people by number. Every person who signs in needs a user number and a group number, the same ones on every computer, forever — that is what makes a person’s files stay theirs when they move to a second machine. Those numbers have to come from Google, because Google is what the computer asks. Cybex cannot invent one at the moment somebody signs in: the computer looks people up constantly without anyone signing in at all, and a number invented on one machine would not match the next.

What Cybex can do is put the numbers into Google for you, so you never have to number accounts by hand.

Prepare Google once

1. Open Service accounts in Google Cloud, in a project owned by your Workspace organization, and create a service account — for example cybex-directory.
2. Under its Keys, add a key of type JSON and download it. Store it with your normal secret-management process.
3. In the same project, enable the Admin SDK API.
4. In Cybex, open the Google Workspace (password) connection, find Let Cybex assign user numbers, select the downloaded .json key, and enter the address of a Workspace administrator. Cybex acts as that person when it updates accounts.
5. Cybex now shows the service account’s Client id and the one Scope it needs. In the Google Admin console under Domain-wide delegation, add that client id with that scope.
6. Select Turn on, then Assign now.

Google’s own instructions are in Control API access with domain-wide delegation.

What Cybex does, and does not do

• It gives a number to every account in the domain that does not already have one, starting at 1,000,000.
• Accounts that already have numbers are never changed. If your organization already numbers people — because another Linux system uses the same directory, or because you set them by hand — Cybex records what is there and leaves it alone.
• A number is never given to a second person, even years after the first person’s account is deleted. Files owned by that number may still exist somewhere.
• New people are picked up automatically. Cybex re-checks the Workspace about once an hour, so somebody who joins today can sign in to a managed computer without anyone opening Cybex.
• Preview shows what a run would change without writing anything to Google.

Turn off makes Cybex forget the service account and stop numbering new people. Numbers already given out stay in Google and on every computer, so nobody loses access to their files.

Everyone signs in as a standard user

Cybex cannot yet grant administrator rights from Google groups on this sign-in method, and the connection dialog does not offer a rule that the computer would ignore. Grant administrative access through a shared local account group under Settings > Sign-in sources instead.