This article provides guidance when using Google as a Directory with Connect for Chromebooks.
Connect for Chromebooks is a Chrome extension that you can deploy to all Chromebooks on your network. Once the user is logged into the Chromebook, Connect for Chromebooks handles any subsequent authentication requests.
The Chromebook authentication feature allows internal users to authenticate themselves using their Google credentials, whilst enforcing organizational web filtering policies wherever they are located.
You can setup the Connect for Chromebooks extension to trust the user-supplied G Suite domain credentials. This involves:
- Creating and authorizing a Google Service Account
- Configuring a Google directory connection from the Smoothwall to your G Suite domain
- Configuring the Smoothwall to Connect for Chromebooks communication
- Distributing the HTTPS certificate from the Smoothwall to all Chromebooks
- Deploying the Connect for Chromebooks extension to all Chromebooks
- Creating filtering and access policies on your Smoothwall
An alternative method, which prevents user credential spoofing, is available. See the knowledge base article, How to Setup Google Verification with Connect for Chromebooks.
In the Google API console, create a Google Service Account, download the private key as a JSON format file, and authorize the Google Service account.
- On the Services menu, under the Authentication submenu, click Directories and configure a Google directory connection. See the help topic, Adding a Google directory.
- This where you upload the Service Account private key.
- Ensure you synchronize the Smoothwall with your G Suite domain. See the help topic, Synchronizing Google users, groups and organizational units.
- Select the Connect for Chromebooks option.
- Download the HTTPS certificate and upload it to your Google Admin Console. See the help topic, Validate and Distribute the HTTPS Certificate.
- Determine your domain behavior by entering your approved domains. See the help topic, Determine domain behavior.
- You must ensure that you configure the Smoothwall to trust your users' G Suite domain credentials. See the help topic, Trusting users' Google G Suite domain credentials.
- Ensuring user identity is not validated.
If your Chromebooks use a common startup page, you may find your users see a block page instead of the startup page. This is because Google prioritizes user authentication over the launching of third party apps, and therefore the Connect for Chromebooks extension does not know the user is authenticated and blocks access. In this scenario, the Connect for Chromebooks icon is gray but only for a matter of seconds before everything is started normally.
- Open a Chrome browser. You should see the Connect for Chromebooks icon in the browser's icon tray in the top right.
- If the icon is a green shield, the extension is connected and functioning.
- Go to a website that is allowed for that particular user. This should be successful.
- Now, try going to a website that is blocked for that users. You should see the block page now.
- If the shield is red, Connect for Chromebooks is in an error state. See the knowledge base article, Troubleshooting Connect for Chromebooks.
Tip: To stop users from bypassing the web filter when using their Chromebooks, you should enroll all devices. We also recommend blocking apps and extensions that are not licensed by your organization. See the knowledge base article, How do I deploy the Connect for Chromebooks Extension to all devices?