Configuring Google Integration

This article is for IT Support.

If your school uses Google Workspace for Education, you can import your Google Users, Groups, and Classrooms into School Manager. After syncing the groups and classrooms, you can use them as classrooms in Classwize.

Before you start 

You will need a minimum of 15 minutes to complete the configuration. The initial sync can take up to three hours, depending on the size of your directory.
To turn on Google integration with School Manager, you will need:

    1. Your school’s Google domain.
    2. Credentials for a Google domain account with Super Administrator privileges to turn on Google API.

      Important

      The Super Admin role is required due to how Google manages Classrooms within a Workspace. Classrooms cannot be synced without a Super Admin level account. Linewize only allows read access to the required data, and cannot be used to modify any data with the Google Workspace.

    3. Your OAuth Client ID and Client Secret if you use OAuth.

You must also turn on the following Google Sync Permissions:

  1. View organization units on your domain.
  2. View groups on your domain.
  3. View users on your domain.
  4. View the email addresses of people in your classes.
  5. View your Google Classroom class rosters.
  6. View your Google Classroom classes.

Linking your Google Domain

Configuring the integration 

To configure Google user authentication:

  1. Log in to School Manager and go to Configuration > Authentication Google.
  2. Configure Google integration using the settings below and select Save.

Required Settings

Setting Description
Enabled This allows Google integration.
Sync User Database This allows School Manager to import your Google Users and Groups.
Domain and Administrator These are Google credentials needed to integrate to Google Service.

 

Optional Settings

Settings Descriptions
Strip Domain 

By default, School Manager imports Google users with username format as username@schooldomain.com.

If you enable strip domain, School Manager will import the user as username.

The email address will always be username@schooldomain.com. The most common use of this feature is to authenticate Windows or macOS computers when LDAP is not available.

Use FZ Auth API

By default, the extension will use Google OAuth for authentication. This requires the student to accept permission requests for the Connect extension to access their Identity information.

If you enable Use FZ Auth API, the extension will connect directly to the Linewize cloud authentication service. No explicit acceptance is required by the student to get authenticated.

This operates on and off the network.

Allow Chrome Extension Authentication When disabled, SphireOS won't authenticate the user's device, meaning it will use the information collected by the Chrome extension to authenticate the user’s device.
Sync Organization Units When enabled, this will sync any organizational units that were previously set up in Google.
Sync Classrooms

Important

You must enable this if your school uses Google Classroom with Classwize.

When enabled, this allows School Manager to import information from Google Classrooms and assign students and teachers to Classwize classrooms.

OAuth Client ID and OAuth Client Secret

It can take a while for a standard Google sync import to complete. However, you can use your API key to significantly increase the speed of classroom sync; it will also allow Classwize teachers to sync classes within Classwize.

To let teachers sync with Google Classroom using Classwize, go to Configuration > Classwize and select Allow teacher to sync Google Classrooms under the Teacher Requirements settings.

Sync By ID

Syncing by ID allows you to sync multiple groups with the same name, however under different IDs.

Note

When enabled, Strip Domain doesn't apply to groups anymore and changing this can invalidate existing filtering rules.

 

Activating the Link

To activate the Google integration:

  1. Log in to School Manager and go to Configuration > Authentication > Google.
  2. Select Link Credentials on the right-hand panel.
  3. You will be redirected to a Google authorization page. It will auto-populate the Username in the Administrator field.
  4. Select Next, then enter the Password.
  5. Select Allow, and you will be redirected back to the School Manager interface

Note

All the permissions requested are read-only. Linewize will not make changes to your Google account.

Validating the Link

To validate the Google integration:

  1. Log in to School Manager and go to Configuration > Authentication > Google.
  2. Test the connection by selecting Run Sync on the right-hand panel.
  3. When sync is complete, you will see a message above your settings informing you how many groups and users have been imported from your Google domain.

The initial sync may take up to three hours to complete, depending on the size of your directory. You can still use School Manager while the sync is in progress.

If the sync is unsuccessful, Sync Status will display “Failed.” You will also have the option to Run Sync again after 15 minutes.

SM-Google-SyncStatus-2023-06-001.png
Image 1: School Manager Google sync panel

Google Classroom and Classwize

Once Google is integrated and the sync is complete, School Manager will import all Users, Groups, and Classrooms from your Google service to School Manager and Classwize. You can let teachers manually sync their Google Classrooms from within Classwize. Teachers and IT administrators can safely sync Google Classroom from Classwize during school hours.
You can provide these instructions to teachers to help them with syncing:

Turning on Google Login for the Captive Portal

To allow users to log into the Captive Portal with their school Google accounts, turn on Google Authentication in the Captive Portal section. To do this, navigate to Authentication > Captive Portal and turn on the Google Authentication Method in your Captive Portal.

Manually Syncing the Google Service

Warning

You should only run a manual sync outside of school hours. Running a manual sync can take up to three hours and affect the performance of Classwize.

You can manually sync Google Classroom with School Manager if you have made some changes to your users, groups, or classrooms in Google and want to update School Manager before your next automatic sync runs.

  1. Select Configuration > Authentication > Google.
  2. Select Run Sync.

Google Integration Troubleshooting 

When will syncs run?

Google Classroom automatically syncs with School Manager twice a week (Tuesday and Saturday), between 12:01 AM and 11:59 PM in your devices' timezone. However, you can manually run a sync if you need to propagate changes before the automatic sync period. You can also let teachers manually sync their Google Classrooms from within Classwize.

I made changes to my classrooms, but I can’t see it in School Manager/Classwize

School Manager and Google Classroom may not have synced. Run a manual sync to make your changes appear sooner than the next automatic.

Error: 403 Access Not Configured

This error can happen when Linewize services don’t have the correct Google permissions. You may need to change three settings: App Access control, API Access, or Age-based access settings.

App Access Control

Check that App access control has been configured in Google Admin Console.

  1. Sign in to School Manager and go to Configuration > Authentication > Google.
  2. Select Link Credentials, and you will be directed to a Google Sign-In.
  3. Sign in with the service account email used for Google sync.
  4. If you see Access blocked, Your institution’s admin needs to review Login and select Request Access.
  5. Go to the Google Admin Console > Home.
  6. Select Review apps under App access control.
  7. Find Login under Apps pending review, then select Configure access.
  8. Select the school’s Org Unit from the list on the right, then select Configure access.
  9. Select school domain (all users) option for Scope, then Next.
  10. Select Trusted option for Access to Google Data, then Next.
  11. Select Configure Access, then Confirm.

Return to School Manager and revoke and relink your Google domain.

  1. Go to Configuration > Authentication > Google.
  2. Select Revoke.
  3. Select Link Credentials to your Google domain.
  4. Select Run Sync to test linking to your Google domain.

API Access

To check API access permission:

  1. Go to the Google Admin Console > Security > API reference.
  2. Select the Enable API access checkbox.
  3. Select Save.

Age-based access settings

Check the Google Organizational Unit (OU) where the service account email is configured in School Manager.

  1. Sign in to School Manager and go to Configuration > Authentication > Google.
  2. Identify the service account email used for Google sync.

Verify the service account’s OU in Google Admin Console.

  1. Go to the Google Admin Console > Account settings > Age-based access settings.
  2. Select All users in the group or org unit are 18 or older option.
  3. Select Save.

Return to School Manager and revoke and relink your Google domain.

  1. Go to Configuration > Authentication > Google.
  2. Select Revoke.
  3. Select Link Credentials to your Google domain.
  4. Select Run Sync to test linking to your Google domain.

Error: 403 Classroom Disabled

This error can happen when the Classroom API access is disabled. To enable the API:

  1. Go to the Google Admin Console > Apps > Additional Google Services > Settings for Classroom.
  2. Ensure that the Service Status is set to ON.

If the API is enabled and you still receive this error message, contact Linewize Support.

Error: 403 Not Authorized to access this resource/API

This error is caused by the user used for School Manager sync within Google Admin not having the Super Admin permission/role. Check your Google Account permissions inside Google Admin:

  1. Sign in to Google Admin.
  2. Select Directory > Users on the left pane.
  3. Find the account used for the Google Sync in School Manager.
  4. Select the account name to open their account page.
  5. Select Admin roles and privileges.
  6. Select the Super Admin role; this displays a slider next to each role.
  7. Next to the Super Admin role, select the slider so it's marked Assigned.
  8. Select Save.

Return to School Manager and revoke and relink your Google domain.

  1. Go to Configuration > Authentication > Google.
  2. Select Revoke.
  3. Select Link Credentials to your Google domain.
  4. Select Run Sync to test linking to your Google domain.

Error: 429 Rate Limit

This error is caused by sending too many requests to the API within a specified time period. Please contact Linewize Support to help you with the OAuth configuration.

Error: 503 Service Unavailable

This error is caused by the Google service being unavailable during the sync. While this will typically resolve itself during the next automatic sync, you can try manually syncing later. If this error continues, please contact Linewize Support.

I’m getting an "invalid_grant: Bad Request" error

This error can be caused by using invalid Google domain account credentials. Please check the credentials you've provided and try again.

Was this article helpful?
0 out of 0 found this helpful
Share

Comments

0 comments

Please sign in to leave a comment.