How to sync users with Google Workspace

You can integrate Google Workspace (formerly known as Google G Suite) with Avigilon Alta (formally known as Openpath) to import and sync users automatically.

Note: To enable this feature, you must have the following administrative privileges in your Google Workspace account:

Directory User Read-Only: https://www.googleapis.com/auth/admin.directory.user.readonly
Directory Group Read-Only: https://www.googleapis.com/auth/admin.directory.group.readonly

When an Identity Provider (IDP) creates unique IDs for users, deleting and recreating a user in the IDP results in a new unique ID for that user. If you add the recreated user back into Avigilon Alta, the system will recognize them as a new user due to the new ID, even though the email address is the same. This can cause confusion, as it becomes unclear which version of the user is correct.

Steps to Set Up the Integration with Google Workspace

Log In:
- Go to https://control.openpath.com/login and log in.
- For the European Alta Access, go to https://control.eu.openpath.com/login.
Get the App:
- Navigate to App Marketplace > Get Apps, select Google Workspace, and click Get App.
Access My Apps:
- Go to App Marketplace > My Apps and click on Google Workspace.
Sign In to Google:
- Google will prompt you to sign in. Use your Google account credentials and allow Avigilon Alta to access your users and groups.
Enable Settings:
- After signing in, you’ll be redirected back to Avigilon Alta, where you can enable the following settings:
  A. Auto-sync every 1 hour/15 minutes: Sync Avigilon Alta with Google every hour or every 15 minutes, depending on your user management package (see Administration > Account for details).
  B. Auto-create Mobile Credential: Automatically create a mobile credential for every user.
  C. Auto-create Cloud Key Credential: Automatically create a cloud key credential for every user.
  D. Enable Single Sign-On (SSO) for Portal Access: Allow users to log into Alta Access with their Google credentials.
  E. Only Import Users from Mapped Groups: Only import users from Google groups mapped to Avigilon Alta groups. Users not assigned to an Avigilon Alta group will not be imported.
  F. Auto-remove Users from Groups: Automatically remove users from Avigilon Alta groups if they no longer exist in the corresponding Google groups.
  G. Mobile Phone Sync: Google Workspace has two values for mobile phones. In the response data, a user can have multiple numbers and potentially multiple mobile phones. The types are "mobile" or "work_mobile". If a user has both, the "mobile" phone number will be used unless the "work_mobile" number is marked as the primary phone (primary: true). Ensure phone numbers are in E.164 format, and it is recommended to use an actual mobile phone number, not a landline.

Note: E.164 numbers are formatted [+][country code][subscriber number including area code] with a maximum of fifteen digits.

Map Groups:
- To map specific groups from Google to Avigilon Alta (required if you enabled Only import users from groups with an Openpath group mapping), click +Create Group Mapping.
  - A. Select the group from Google.
  - B. Select the group from Avigilon Alta.
  - C. Click +Create Group Mapping.
Repeat Group Mapping:
- Repeat step 6 until all necessary group mappings have been created.

After saving, you now have the option to Sync Manually. You can perform this action at any time by clicking the Synchronize button on the Google Workspace settings page.

Additional resources

Learn more about Openpath integrations

Learn more about the Google Workspace integration