Setting up the Transfer of Ownership features for the Okta Workflows Gmail connector requires configuring a Google Cloud Platform project, adjusting Google Admin Console settings, and configuring the Workflows Console.

• Okta Identity Engine (OIE)
• Okta Classic Engine
• Okta Workflows Gmail Connector Cards
  • Add Delegate
  • Add Send Alias
  • Delete Delegate
  • Delete Send Alias
  • Forward Emails
  • List Delegates
  • Set Auto Reply
  • Update User Gmail Settings

How is the Google Cloud Platform configured?

Create a new Google Cloud Project, enable the Gmail Application Programming Interface (API), and configure a service account with the necessary roles and permissions.

1. In Google Cloud Platform, create a new Google Cloud Project or use an existing project.
2. Click the Quickstart dropdown menu at the top of the navigation bar that displays the currently selected project, select an organization, and click New Project.
3. Enter the project name and click Create.
4. From the Quickstart dropdown menu at the top of the navigation bar, select the new project.
5. From the Project info panel on the Project Dashboard, click ADD PEOPLE TO THIS PROJECT.
6. Add the Google Workspace service account used to authorize the Workflows Gmail connection as a new principal with the Viewer role.
7. Navigate to the Navigation menu, select APIs & Services, and choose Library.
8. Search for and enable the Gmail API.
9. Navigate to the Navigation menu, select IAM & Admin, and choose Service Accounts.
10. Click CREATE SERVICE ACCOUNT.
11. Enter a name and description, and click DONE.
12. Click the service account in the list of service accounts to edit it.
13. Navigate to the PERMISSIONS tab and click GRANT ACCESS.
14. Add the Google Workspace account used to authorize the Gmail connection as a New Principal.
15. Add the "Service Account User" and "Service Account Token Creator" roles to the principal, and click SAVE.
16. Navigate to the DETAILS tab and copy the Unique ID.
    • NOTE: This is the same as the OAuth 2.0 Client ID seen from the list of service accounts.

Configure the Google Admin Console

Add a new API client in the Google Admin Console and authorize it with the necessary Gmail settings scopes.

1. Navigate to Security, select Access data and control, and choose API controls.
2. Click MANAGE DOMAIN WIDE DELEGATION.
3. Click Add new to add a new API client.
4. Enter the Client ID copied from the service account created in the previous section.
5. Add the following scopes:
   • https://www.googleapis.com/auth/gmail.settings.basic
   • https://www.googleapis.com/auth/gmail.settings.sharing
6. Click AUTHORIZE to save the API client.

How is the Workflows Console configured?

Create a new flow in the Workflows Console, add a Transfer of Ownership card, and configure it using the newly created Google Cloud Platform Project and Service Account.

1. Create a new flow and add one of the Transfer of Ownership cards referenced in the Applies To section.
2. Select the Google Cloud Platform Project and Service Account from the dropdown menus in the card options.
3. Configure the card and verify that it executes successfully.

Related References

• Authorize an Account for Transfer of Ownership Features
• Invoke Function in Google Cloud Functions Causes a "403 Forbidden" Error