Approve Or Deny GSuite Access For Devices

The Google Directory integration with GSuite allows you to manage which devices have access to GSuite. This allows you to control access based on a variety of factors.

Below, you’ll find a Google Cloud Function that is meant to respond to a webhook. This function takes an action to set a device into ‘approve’ or ‘deny’ as a state within Google Directory. Before using the function you’ll want to set CustomerID, ResourceID, and EMAIL_ACCOUNT for your GSuite account before using.

To setup a GSuite Account for Google Functions and grab the ResourceID (or JWT), see: https://krypted.com//cloud/setup-google-cloud-functions/
To obtain the customer ID: https://krypted.com//uncategorized/get-your-customerid-from-g-suite/

Once you have all that, you can upload mobiledevice.py in your Google Cloud Console.

#

# Google Cloud Function meant to respond to a webhook

# Takes an action to set a device into approve or deny state

# Set CustomerID, ResourceID, and EMAIL_ACCOUNT for your GSuite account before using

#



from google.oauth2 import service_account

import googleapiclient.discovery



SCOPES = ['https://www.googleapis.com/auth/admin.directory.device.mobile']

SERVICE_ACCOUNT_FILE = 'auth.json'

EMAIL_ACCOUNT = ''





def get_credential():

    credentials = service_account.Credentials.from_service_account_file(SERVICE_ACCOUNT_FILE, scopes=SCOPES)

    delegated_credentials = credentials.with_subject(EMAIL_ACCOUNT)

    # admin = googleapiclient.discovery.build('admin', 'directory_v1', credentials=credentials)

    admin = googleapiclient.discovery.build('admin', 'directory_v1', credentials=delegated_credentials)

    return admin





def get_mobiledevice_list(admin, customerId):

    results = admin.mobiledevices().list(customerId=customerId).execute()

    mobiledevices = results.get('mobiledevices', [])

    print('mobile devices name and resourceId')

    for mobiledevice in mobiledevices:

        print(u'{0} ({1})'.format(mobiledevice['name'], mobiledevice['resourceId']))

    return results





def action_mobiledevice(admin, customerId, resourceId, actionName):  # actionName: "approve", "block",etc
    body = dict(action=actionName)

    results = admin.mobiledevices().action(customerId=customerId, resourceId=resourceId, body=body).execute()

    return results





def main():

    admin = get_credential()

    customerId = ''

    resourceId = ''

    action = "approve"

    #action = "block"



    mobiledevice_list = get_mobiledevice_list(admin, customerId)

    print(mobiledevice_list)



    action_mobiledevice(admin, customerId, resourceId, action)

    print ("Approved successfully")





if __name__ == '__main__':

    main()

This is likely to evolve, given that you’ll likely want to migrate your settings into a database as part of your build process, but the general logic is here for now. Happy Googleatinging!