account is still authorized.</p><h4class="anchor anchorWithStickyNavbar_LWe7"id="restrict-auth-to-specific-google-groups-on-your-domain-optional">Restrict auth to specific Google groups on your domain. (optional)<ahref="#restrict-auth-to-specific-google-groups-on-your-domain-optional"class="hash-link"aria-label="Direct link to Restrict auth to specific Google groups on your domain. (optional)"title="Direct link to Restrict auth to specific Google groups on your domain. (optional)"></a></h4><ol><li><p>Create a <ahref="https://developers.google.com/identity/protocols/OAuth2ServiceAccount"target="_blank"rel="noopener noreferrer">service account</a> and configure it
to use <ahref="#using-application-default-credentials-adc--workload-identity--workload-identity-federation-recommended">Application Default Credentials / Workload Identity / Workload Identity Federation (recommended)</a> or,
alternatively download the JSON.</p></li><li><p>Make note of the Client ID for a future step.</p></li><li><p>Under "APIs & Auth", choose APIs.</p></li><li><p>Click on Admin SDK and then Enable API.</p></li><li><p>Follow the steps on <ahref="https://developers.google.com/admin-sdk/directory/v1/guides/delegation#delegate_domain-wide_authority_to_your_service_account"target="_blank"rel="noopener noreferrer">https://developers.google.com/admin-sdk/directory/v1/guides/delegation#delegate_domain-wide_authority_to_your_service_account</a>
and give the client id from step 2 the following oauth scopes:</p><divclass="codeBlockContainer_Ckt0 theme-code-block"style="--prism-color:#bfc7d5;--prism-background-color:#292d3e"><divclass="codeBlockContent_biex"><pretabindex="0"class="prism-code language-text codeBlock_bY9V thin-scrollbar"><codeclass="codeBlockLines_e6Vv"><spanclass="token-line"style="color:#bfc7d5"><spanclass="token plain">https://www.googleapis.com/auth/admin.directory.group.readonly</span><br></span><spanclass="token-line"style="color:#bfc7d5"><spanclass="token plain">https://www.googleapis.com/auth/admin.directory.user.readonly</span><br></span></code></pre><divclass="buttonGroup__atx"><buttontype="button"aria-label="Copy code to clipboard"title="Copy"class="clean-btn"><spanclass="copyButtonIcons_eSgA"aria-hidden="true"><svgviewBox="0 0 24 24"class="copyButtonIcon_y97N"><pathfill="currentColor"d="M19,21H8V7H19M19,5H8A2,2 0 0,0 6,7V21A2,2 0 0,0 8,23H19A2,2 0 0,0 21,21V7A2,2 0 0,0 19,5M16,1H4A2,2 0 0,0 2,3V17H4V3H16V1Z"></path></svg><svgviewBox="0 0 24 24"class="copyButtonSuccessIcon_LjdS"><pathfill="currentColor"d="M21,7L9,19L3.5,13.5L4.91,12.09L9,16.17L19.59,5.59L21,7Z"></path></svg></span></button></div></div></div></li><li><p>Follow the steps on <ahref="https://support.google.com/a/answer/60757"target="_blank"rel="noopener noreferrer">https://support.google.com/a/answer/60757</a> to enable Admin API access.</p></li><li><p>Create or choose an existing administrative email address on the Gmail domain to assign to the <code>google-admin-email</code>
flag. This email will be impersonated by this client to make calls to the Admin SDK. See the note on the link from
step 5 for the reason why.</p></li><li><p>Create or choose an existing email group and set that email to the <code>google-group</code> flag. You can pass multiple instances
of this flag with different groups and the user will be checked against all the provided groups.</p></li></ol><p>(Only if using a JSON file (see step 1))
9. Lock down the permissions on the json file downloaded from step 1 so only oauth2-proxy is able to read the file and
set the path to the file in the <code>google-service-account-json</code> flag.
10. Restart oauth2-proxy.</p><p>Note: The user is checked against the group members list on initial authentication and every time the token is
refreshed ( about once an hour ).</p><h5class="anchor anchorWithStickyNavbar_LWe7"id="using-application-default-credentials-adc--workload-identity--workload-identity-federation-recommended">Using Application Default Credentials (ADC) / Workload Identity / Workload Identity Federation (recommended)<ahref="#using-application-default-credentials-adc--workload-identity--workload-identity-federation-recommended"class="hash-link"aria-label="Direct link to Using Application Default Credentials (ADC) / Workload Identity / Workload Identity Federation (recommended)"title="Direct link to Using Application Default Credentials (ADC) / Workload Identity / Workload Identity Federation (recommended)"></a></h5><p>oauth2-proxy can make use of <ahref="https://cloud.google.com/docs/authentication/application-default-credentials"target="_blank"rel="noopener noreferrer">Application Default Credentials</a>.
When deployed within GCP, this means that it can automatically use the service account attached to the resource. When deployed to GKE, ADC
can be leveraged through a feature called Workload Identity. Follow Google's <ahref="https://cloud.google.com/kubernetes-engine/docs/how-to/workload-identity"target="_blank"rel="noopener noreferrer">guide</a>
