What value do I choose for the GoogleCredentials parameter?

[christianbakerm]

I have the credentials.json file but If i paste the entire contents of the file it doesnt work. Do I just use the private key section?

[christiangda]

Hi @christianbakerm ,

If you are using AWS Lambda deployed via AWS Serverless public repository - slashdevops/idp-scim-sync you need to use the content of your credentials.json and paste this in the AWS CloudFormation template field GWSServiceAccountFile

but if instead of that, you are using the binary from Releases or the docker image from AWS ECR public repository - slashdevops/idp-scim-sync or another public repository that you need to pass to the flag --gws-service-account-file is the path to your credentials.json file. For this case see Demo

anyway, if you publish your error and details here I can try to help you.

[christianbakerm]

Here is the Log Output from testing the Lambda:
START RequestId: f21e503b-0b3b-4c07-8394-719e08f761fa Version: $LATEST {"level":"info","msg":"starting sync groups","time":"2022-02-22T16:08:04Z"} Error: cannot create google service: google: error getting JWT config from Service Account: invalid character '-' in numeric literal Usage: idpscim [flags] Flags: -k, --aws-s3-bucket-key string AWS S3 Bucket key to store the state (default "state.json") -b, --aws-s3-bucket-name string AWS S3 Bucket name to store the state -t, --aws-scim-access-token string AWS SSO SCIM API Access Token -e, --aws-scim-endpoint string AWS SSO SCIM API Endpoint -c, --config-file string configuration file (default ".idpscim.yaml") -d, --debug fast way to set the log-level to debug -n, --disable-state state status [true|false] -q, --gws-groups-filter strings GWS Groups query parameter, example: --gws-groups-filter 'name:Admin* email:admin*' --gws-groups-filter 'name:Power* email:power*' -s, --gws-service-account-file string path to Google Workspace service account file (default "credentials.json") -u, --gws-user-email string GWS user email with allowed access to the Google Workspace Service Account -r, --gws-users-filter strings GWS Users query parameter, example: --gws-users-filter 'name:Admin* email:admin*' --gws-users-filter 'name:Power* email:power*' -h, --help help for idpscim -f, --log-format string set the log format (default "text") -l, --log-level string set the log level [panic|fatal|error|warn|info|debug|trace] (default "info") -m, --sync-method string Sync method to use [groups] (default "groups") cannot create google service: google: error getting JWT config from Service Account: invalid character '-' in numeric literal: withStack null END RequestId: f21e503b-0b3b-4c07-8394-719e08f761fa REPORT RequestId: f21e503b-0b3b-4c07-8394-719e08f761fa Duration: 355.54 ms Billed Duration: 356 ms Memory Size: 256 MB Max Memory Used: 52 MB Init Duration: 174.81 ms XRAY TraceId: 1-62150a64-0888ace1648e17e828cf8e3b SegmentId: 3a86db6e3eb5ce54 Sampled: true

And here is the value of the GoogleCredential SecureString Parameter (Changed of course)

-----BEGIN PRIVATE KEY-----\lkhs7tku6tkdgkdug6yBKgwggSkAgEAAoIBAQDNQHNHDgcPriVo\nJHcGDzPMRZTzn7olKym1ysR5ij2MYAfkO/IFl/ig***************RANDOM*****CHARACTERS***********************************EJWKGFJWFJHFWHFWJWFJHWFJWFJHWFJHKYfrPHWBlm+AJz9pS3p+IX9JhwKT\nIQ10ZVvUq/pGLcasB+8nACBfY4QzsyQWljVBNGVoe0hlqvq1VZv4ws3xIHc0cnuT\nvL37+gQ6k7iQT4zuLi9X3amNJ2MPgTApKMngdlABAoGBALXrB5nsGRscpkNB0xpU\nLPaJ9gtbyzArPPmKbs73CUn7lWhb8XIHcbkLr0Np7ar4/g5vZvJYSsBPeriYyLcp\nUbmMGZO1YcalOPHKECYib5yEHGfCoaLUPxVAVyZlvfCwgNu1C3X7JgVNxIMywj5A\ns8OSreBJOPpZKe/H1WoBl4AX\n-----END PRIVATE KEY-----

[christiangda]

@christianbakerm you need to use the full json content of the credential file you download when creating the service account, I mean, I supposed you have something like that:

{
  "type": "service_account",
  "project_id": "project-id",
  "private_key_id": "key-id",
  "private_key": "-----BEGIN PRIVATE KEY-----\nprivate-key\n-----END PRIVATE KEY-----\n",
  "client_email": "service-account-email",
  "client_id": "client-id",
  "auth_uri": "https://accounts.google.com/o/oauth2/auth",
  "token_uri": "https://accounts.google.com/o/oauth2/token",
  "auth_provider_x509_cert_url": "https://www.googleapis.com/oauth2/v1/certs",
  "client_x509_cert_url": "https://www.googleapis.com/robot/v1/metadata/x509/service-account-email"
}

so, copy and paste the json in the field GWSServiceAccountFile