Getting Started

Overview

This guide walks you through configuring the Britive Access Broker to manage just-in-time Google Workspace group membership — adding users to Google Groups at checkout and removing them at checkin, with no standing group membership.

What you’ll accomplish:

Configure a GCP service account with Domain Wide Delegation for Google Workspace
Deploy and configure the Britive Access Broker with the service account credentials
Configure checkout and checkin routines from the access-broker-examples repository
Register Google Workspace as a Resource Manager resource in Britive
Create a Resource Manager access profile
Check out group membership and verify end-to-end

Prerequisites

Before you begin, make sure you have:

A Britive tenant with administrator access
A running Britive Access Broker
Google Workspace Super Admin access to configure Domain Wide Delegation
A GCP project to host the service account

Never hardcode credentials. Use environment variables, your secret manager, or the Britive Secrets Store.

How It Works

The Access Broker uses a GCP service account with Domain Wide Delegation to call the Google Admin SDK Directory API. At checkout, Britive adds the user to the target Google Group. At checkin (or on expiry), the membership is removed — no standing access remains.

User → Britive Console → Access Broker → Google Admin SDK API → Google Group (add/remove member)

Onboarding the Application

Configure the broker for Google Workspace group management. This is a one-time setup performed by an administrator.

Reference scripts are available in the britive/access-broker-examples repository under GoogleWorkspace/permissions/. For the GCP service account setup, refer to the britive/onboarding repository under terraform/google-cloud/.

Using the Britive Console

Create a GCP service account

In a GCP project, create a service account named britive-workspace and download a JSON key.

Enable Domain Wide Delegation

In the GCP console, enable Domain Wide Delegation on the service account. Copy the client ID.

Authorize the API scopes in Google Workspace

In the Google Workspace Admin console, navigate to Security → API controls → Domain-wide delegation → Add new. Enter the client ID and authorize the required Admin SDK scopes.

Deploy the Access Broker

Follow the Britive Access Broker deployment guide to install and register a broker.

Configure the broker scripts

git clone https://github.com/britive/access-broker-examples.git
# Copy GoogleWorkspace/permissions/ scripts to your broker's scripts directory

Register Google Workspace in Resource Manager

Navigate to Resource Manager → Resources → Add Resource. Enter your workspace domain and the path to the service account key.

Using Shell

Key environment variables used by the broker scripts:

WORKSPACE_DOMAIN=example.com
WORKSPACE_ADMIN_EMAIL=admin@example.com   # Used for impersonation
GCP_SERVICE_ACCOUNT_KEY=/path/to/key.json
GOOGLE_GROUP_EMAIL=target-group@example.com
BRITIVE_USER_EMAIL=user@example.com

Refer to the britive/access-broker-examples GoogleWorkspace/ directory for the full script set.

Using Terraform

Use the GCP Terraform templates from the britive/onboarding repository to create the service account with Domain Wide Delegation:

git clone https://github.com/britive/onboarding.git
cd onboarding/terraform/google-cloud
# Configure variables for Google Workspace integration
bash deploy.sh

Create Your First Access Profile

Using the Britive Console

Open Resource Manager

Navigate to Resource Manager → Profiles → Add Profile.

Configure the profile

Field	Value
Name	A descriptive name (e.g., `Workspace-Engineering-Group`)
Expiration	Set a max session duration (e.g., `4h`)

Associate resources

Under Associations, select the Google Workspace resource and the target Google Group.

Add a permission

Under Permissions, select the group membership checkout/checkin permission.

Add a policy

Under Policies, assign members and configure conditions.

Save and activate

Click Save.

Using Terraform

resource "britive_resource_manager_profile" "workspace_eng" {
  name                = "Workspace-Engineering-Group"
  expiration_duration = 14400000

  associations {
    label_key = "environment"
    values    = ["Production"]
  }
}

resource "britive_resource_manager_profile_permission" "workspace_group" {
  profile_id = britive_resource_manager_profile.workspace_eng.id
  name       = "GoogleWorkspace-GroupMembership"
  version    = "latest"

  variables {
    name              = "GOOGLE_GROUP_EMAIL"
    value             = "engineering@example.com"
    is_system_defined = false
  }
}

Verify

Check out the profile

Navigate to My Access → find your profile → click Check Out.

Confirm group membership

In the Google Workspace Admin console, navigate to Directory → Groups → select the group → Members. Confirm your user appears.

Check in

Return to My Access → click Check In. Verify the user is no longer listed in the group.

Troubleshoot

Symptom	Likely Cause	Fix
Checkout fails with `403`	DWD scopes not authorized or admin email not impersonated	Re-check API scope authorization in Google Workspace Admin console
User not added to group	Service account key path incorrect	Verify `GCP_SERVICE_ACCOUNT_KEY` path and file permissions
Membership not removed	Checkin routine error	Check broker logs; verify `GOOGLE_GROUP_EMAIL` matches the full group email

Next Steps

Britive documentation

Last updated on July 8, 2026

Manage Group Memberships