Google Workspace integration - logs-sdk admin

Elastic Security SIEM
1

I get this error despite following Elastic's documentation to the letter.
this is the error (No authentication credentials were configured or detectec (ADC) accesing 'auth.oauth2')

image (9)
image (9)710×568 67.8 KB

Also, I don't understand what this point refers to in the documentation.

Requirements

In order to ingest data from the Google Reports API you must:

  • Have an administrator account.
  • [Set up a ServiceAccount]) using the administrator account.
  • [Set up access to the Admin SDK API] for the ServiceAccount.
  • [Enable Domain-Wide Delegation] for your ServiceAccount.

This integration will make use of the following oauth2 scope:

Once you have downloaded your service account credentials as a JSON file, you are ready to set up your integration.

Click the Advanced option of Google Workspace Audit Reports. The default value of "API Host" is googleapiscom. The API Host will be used for collecting access_transparency, admin, device, context_aware_access, drive, gcp, groups, group_enterprise, login, rules, saml, tokenanduser accounts` logs.

Has anyone had the same thing happen to them?

2

Hi @Eldr - this blog post goes into great detail on how to set up everything on the Workspace and integration side. I'd recommend going through it step by step, to ensure no steps were missed.

Also pinging @marc.guasch for guidance, as he may have seen the common causes for this error in the past.

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.