=== Google Workspace LDAP Integration

. Go to https://admin.google.com/ and sign in as a Google Workspace domain administrator.

. Go to Apps > LDAP > Add Client.

. Provide an LDAP client name and an optional Description. Any descriptive values are acceptable. For example, the name could be ‘PacketFence’ and the description could be ‘PacketFence LDAP Client’. Click the Continue button.

. Set Access Permission according to your needs. You must choose either ‘Entire domain (PacketFence)’ or ‘Selected organizational units’ for both ‘Verify user credentials’ and ‘Read user information’. Select ‘Add LDAP Client’

. Download the generated certificate. This is required for PacketFence to communicate with the Google Secure LDAP service. Save the downloaded certificates for later use. After downloading, click the Continue to Client Details button.

. Expand the Service Status section and turn the LDAP client ‘ON for everyone’. After selecting ‘Save’, click on the ‘Service Status’ bar again to collapse and return to the rest of the settings.

. Expand the Authentication section and choose ‘Generate New Credentials’. Copy/note these credentials for later use. After selecting ‘Close’, click on the ‘Authentication’ bar again to collapse and return to the rest of the settings.

==== Configuring PacketFence

. Under 'Configuration->Policies and Access Control->Authentication Sources', create a new 'Google Workspace LDAP' internal source
  .. The following are the configuration values obtained during the LDAP client configuration earlier:
    ... Bind DN: The access credentials username
    ... Password: The access credentials password
    ... Client Certificate: The .crt file text from the downloaded certificate bundle
    ... Client Key: The .key file text from the downloaded certificate bundle
  .. You will also need to these properties for the Authentication Source:
    ... Host: `ldap.google.com` / Port: `636` / Type: `SSL`
    ... SSL Verify Mode: `None`
    ... Base DN: (this is the ldap path for your domain.. usually something like this: `dc=example,dc=com` if your email is @example.com)
        You might have to add `ou=Users,` as a prefix in some cases, so it would be `ou=Users,dc=example,dc=com` 
    ... Scope: `Subtree`
    ... Username Attribute: `uid` (unless you've heavily customized your Google Workspace directory)
    ... Email Attribute: `mail` 
    ... Associated Realms: You'll need to match a previously created realm which matches your `example.com` domain. This will let the system strip the domain part when searching for the user and also let the system know which source to use for which specific realms (the @example.com part of the username) are used for each source.
  .. For Authentication and Administration rules, you can match against google group membership (if you have configured google to allow group membership access - this is done when creating the LDAP client on the Google workspace configuration page on Google's side, not on PacketFence). In that case, you will want to use the condition `memberOf`, a match of `equals` and the value of `cn=mygroupname,ou=Groups,dc=example,dc=com` if your group is called "mygroupname`. Keep in mind that nested group membership does not work via ldap for google workspace.
  
  
