Google Cloud Account Settings

To setup Google Cloud Platform (GCP) for Jamcracker Appliance, you must have your Google Cloud Platform account which is a mandatory requirement and GSuite Domain which is optional. However it is required only while performing Single Sign-On.

If you already have an account, login to Google Cloud Console using your user credentials, and if you don't have an account, we recommend you to create GSuite domain and Google Cloud Platform.

To create a Google Cloud Platform account, you may have to create a Gmail account first and then setup a Google Cloud account using your newly created Gmail account. Please follow the steps as displayed on the UI to create a Gmail account.

For New Users:

Pre-requisites:

You must setup billing account

Add an account for a new user:

Each person who will be using Google services with in JSDN needs an account to sign in to. If you have access to an administrator (or admin) account, you can sign in to the Google Admin console. The Admin console is where administrators manage Google services for people in an organization.

Signing Up

In any web browser, go to cloud.google.com
Click Get Started for free > Creat Account.
- Starting from the sign-in page, enter the email address and password for your admin account (it does not end in @gmail.com).
- An admin account has privileges to manage services for other people in your organization. The Admin console is only available when you're signed in to an admin account. If you don't have access to an admin account, get help from someone else who does.
- If you see a list of Google Accounts on the sign-in page, be sure to choose your admin account (it does not end in @gmail.com).

Enabling an API

When an API requires an API key and the API is associated with a Google Cloud project that you don't have access to, you have the following options to obtain an API key:

Option 1: Ask a member of the Google Cloud project to create an API key for you.
Option 2: Ask a member of the Google Cloud project to grant you access to the project so that you can create an API key in the same project that the API is associated with.
Option 3: Ask a member of the Google Cloud project to grant you access to enable the API in your own Google Cloud project so that you can create an API key.

If you used option 3 and asked someone to grant you access to enable the API, follow the steps below to enable the API in your own Google Cloud project.

To enable an API:

In the Cloud Console, go to APIs & Services for your project.
On the Library page, click Private APIs. If you don't see the API listed, that means you haven't been granted access to enable the API.
Click the API you want to enable. If you need help finding the API, use the search field.
In the page that displays information about the API, click Enable.

Note: You must enable Compute Engine API and Cloud Storage.

Creating a New Project

To create a project, you must have the permission. This permission is included in the Project Creator role, which is granted by default to the entire domain of a new organization and to free trial users.

To create a new project

Go to the Manage resources (Home > Dashborad) page in the Cloud Console.
On the Select organization drop-down list at the top of the page, select the organization in which you want to create a project. If you are a free trial user, skip this step, as this list does not appear.
Click Create Project.
In the New Project window that appears, enter a project name and select a billing account as applicable. A project name can contain only letters, numbers, single quotes, hyphens, spaces, or exclamation points, and must be between 4 and 30 characters.
Enter the parent organization or folder in the Location box. That resource will be the hierarchical parent of the new project.
When you're finished entering new project details, click Create.

Creating Storage Buckets

In order to create a bucket in a project, a user must have the permission for the project.

To create a new storage bucket:

Navigate to Storage > Browser in the Google Cloud Console.
Click Create bucket to open the bucket creation form.
Enter your bucket information and click Continue to complete each step:
- Specify a Unique Name.
- Choose a Location where the bucket data will be stored.
- Choose a default storage class for your data.
- Select an Access control model to determine how you control access to the bucket's objects.
- Optionally, you can add bucket labels, set a retention policy, and choose an encryption method.
Click Done.

Export Cloud Billing Data

Cloud Billing export to your storage bucket enables you to export detailed Google Cloud billing data (such as usage, cost estimates, and pricing data) automatically throughout the day to a dataset that you specify. Then you can access your Cloud Billing data from your storage bucket for detailed analysis. You can also use this export method to export data to a JSON file.

To enable and configure the export of Google Cloud billing data to a BigQuery dataset, you need the following permissions:

Billing Account Administrator role for the target Cloud Billing account.
BigQuery User role for the Cloud project that contains the BigQuery dataset that will be used to store the Cloud Billing data.

To enable Billing Account Administrator role, do the following:

Open Google Cloud Console.
Click Navigation menu (3 horizontal lines from the top right corner) and select IAM & Admin option.
Click Roles from the IAM & Admin sub menu options and type BigQuery Admin in the Enter property name or value field and press Enter.

Click the 3 vertical dots next to the role status and click Enable from the drop-down. The role gets enabled for the user account.

Note: Follow the same steps to enable BigQuery Admin and BigQuery User roles.

Note: You must enable the 3 APIs, such as BigQuery, BigQuery Storage and BigQuery Data Transfer. New projects automatically enable the BigQuery API. If an existing project doesn't have BigQuery enabled, open the left side menu, click APIs & Services, and then find and enable the BigQuery API.

To enable APIs, do the following:

Open Google Cloud Console.
Click Navigation menu (3 horizontal lines from the top right corner) and select APIs and Services. On the APIs and Services page, click +ENABLE APIS AND SERVICES.

On the API Library page, search for BigQuery API.

Select BigQuerry API from the existing list of APIs and click Enable.

The system will take few seconds to enable the API.

Note: You must follow the same steps to enable BigQuery Storage API and BigQuery Data Transfer API.

Setting Up Domain in GSuite

In this section, we will take you through a step by step process to create a domain using your GSuite account and also explains you on how to enable Single Sign On in Jamcracker Appliance.

Login to your GSuite Admin Console.
If you are an existing GSuite account holder, click the Sign in link and enter your domain and select the Access to (Admin Console, Email or Drive) and Click Go.
OR
If you don't have an account, click Get Started and click Next.
Enter your Business Name and select number of employees in your organization. Click Next.
Select your country. Click Next.
Enter your email address. Click Next.
If you already have a domain, click Yes, I Have One I Can Use. Enter the domain name and click Next.
OR
If you don't have a domain, click No, I Need One.
Enter a domain name of your choice. If you want to check whether the domain name is available or not, click Search. If the domain name is available, click Next.
Provide your business address. Click Next.
Select the domain that best suites your business needs.
Select the domain and review the price and click Next.
Provide your business information. Click Next.
Enter your First Name and Last Name. Click Next.
Enter username and password. This username will be used for sign into your GSuite Account and create your business email address. Click Next.
Click Agree and Create Account to accept the Terms and Conditions.
Click Go To Setup.
The Billing information related to the domain that you have purchased will be displayed. Agree to the Terms and Conditions and click Continue.
Agree to Domain Registration Terms and Conditions and click Continue.
Now that the domain name is created, its time to authenticate your GSuite Account with Google Cloud Console.
Click Google Cloud Console, to verify your email address.
Login to Google Cloud Console, using your GSuite Account username and password and accept the Terms and Conditions.
Now, navigate back to your GSuite Account (https://admin.google.com) and login using your GSuite credentials, click Security. The Security page is displayed.
Click Setup Single Sign-On (SSO) to authenticate your appliance account.
Enable Setup SSO with third party identity provider by checking on to Setup SSO with third party identity provider check-box.
Enter your Sign-in page URL. The URL should be in "https://<<STORE_URL>>/jsdn/login/serviceSAMLLogin.action?module=gsuite" format, whereas <<STORE_URL>> should be your store url.
Enter your Sign-out page URL. The URL should be in "https://<<STORE_URL>>/jsdn/logout?module=gsuite" format, whereas <<STORE_URL>> should be your store url.
For the first time you need to generate a verification certificate. Click here to know how to generate a verification certificate. Once you generate the certificate Download .cer file from "<<JAVA_HOME>>/bin/keytool" and upload by clicking Replace Certificate link in GSuite Portal.
Click Save. A Confirmation message is displayed. Click I understand and agree.

Now your GSuite Account is ready, you can start using it.

GSuite Management via Jamcracker Platform:

Jamcracker Platform allows performing various management activities in order to manage G Suite and other services via a single platform such as

User management:

1. New users can be added to avail G Suite account via Jamcracker platform.

2. Existing users available on G Suite application should be manually mapped for user management in the platform.

3. Unassign User: Admin shall have the ability to unassign existing users from using the G Suite services using the Jamcracker Cloud Management platform. Users can also be deleted from using G Suite and eventually the user will not be able to access services directly from G Suite console.

Single Sign On: Once the profile / order has been successfully provisioned to the customer organization within the platform, the administrator will be able to assign G Suite licenses to existing users by creating the user account. For new users, assign service activity will take care of license assignment to the user as well. All users created and assigned with G Suite service will have the ability to SSO to G Suite application.

Billing: Billing of G suite services is not supported for enterprise accounts as Google invoices and collects payments from the enterprise account directly through the G suite account. Billing will be supported for accounts under the partner program (Roadmap).

Payment: The G Suite account shall be automatically charged based on the Credit Card configured by the enterprise organization within the G Suite portal.

Account Mapping

Login to Google Cloud Console to collect information such as Paying Account Id, Project Id, Service Account Id, Bucket Name, Private Key file path, Usage File Prefix, and Username. These information will be useful for your while configuring your Cloud Credentials in Jamcracker Appliance. Follow the below steps to know how to collect the required information and add them to Add Cloud Credentials page.

Launch Google Cloud Console and login to the Google Cloud console using your credentials.
Note: If you already have an existing project. We recommend you to copy the Project ID, which will be useful while mapping your cloud credentials.
(a). Click Select a Project to create a new project.
(b). Click New Project.
(c). Provide a name for the project and use the default location.
(d). Click Create. The project is created successfully.
Note: A default project ID is allocated to your new project. In case you want to change the project Id, click on Edit and Add New Project ID.
(a). Select the Project and navigate to Menu > APIs & Services > Dashboard page and click Enable APIs and Services.
(b). Ensure you enable the below two services. If these two services are not enabled, then search for "Compute Engine API" and "Google Cloud Storage" and click Enable respectively.
- Compute Engine API
- Google Cloud Storage
(c). Click Enable APIS AND SERVICES. You will be re-directed to API Library page, search for "Compute Engine API" and "Google Cloud Storage" services and click Enable respectively.
Now, you have to Create a Service Account. To create a Service Account, select the project and navigate to Menu > IAM & admin > Service accounts page.
(a) Click Create Service Account. You must provide a unique Service account name and select the role as Project > Owner and click Create. However, before you click Create. Please ensure you enable Furnish a new private key check-box and select the Key Type as P12. Make note of “Service Account ID” for future use.
(b). Now, that you have created a P12 Key type, you have to create a JSON Key Type. Navigate to Menu > IAM & admin > Service accounts page. Identify the Service account and click Create Key from the Options column.
(c). Select JSON as your Key Type. Click Create.
Existing Bucket Mapping
(a). If you are adding a new project and want to map it to your existing bucket, then you must provide permissions for storage. To provide permissions, navigate to Menu > Storage page and select the Project from the drop-down list.
(b). Select the Bucket and click Edit Bucket Permissions.
(c). On the Edit Bucket Permissions page. In the Add Member field, provide the Service Account Id (to get the Service Account ID, navigate to Menu > IAM & admin > Service accounts page, identify the service account and you will find the Service Account ID against it) of new project and select Storage Admin from the Role drop-down list and click Add.
New Bucket Mapping
If you don't have an existing bucket, follow the steps below to create a new one.
(a). In menu option, Click Storage > Create Bucket.
(b). Provide a unique bucket name, select the default storage class and select the location.
(c). Click Create.
(a). In the menu option select Billing > Billing Export > File Export > Enable BillingExport and select the bucket you had created in the previous step.
(b). Add proper prefix to the selected bucket and select file format as CSV.
(c). Make note of bucket name, report prefix.
(d). Click Save.
On the Menu, navigate to Billing > Billing Account ID page and make note of billing account Id.
To capture your Domain Name and SAML Name ID, login to GSuite Admin Console using your domain name or username and password.
Navigate to Menu > Domains page, and make note of your domain name, which will be useful while mapping your account with Jamcracker Appliance.
Navigate to Menu > Users page, and click on your account. You will find your username (which is your email ID in other words your SAML Name ID), make note of your email Id, which will be useful while mapping your account with Jamcracker Appliance.
Now that you have all the required information, login to Jamcracker Appliance to map your account.
Navigate to Manage > Cloud Service Credentials page. On the Cloud Credentials page, click Add Cloud Service Credentials.

The following table explains the configuration settings fields for Google Cloud Platform.


Fields	Value
Cloud Provider	Select the "GoogleCloud" cloud provider from the drop-down list.
Account ID	Type your account ID as your billing account ID. Refer to Step 9.
Project ID	Type the Project ID that was allocated to you while creating a new project in Google Cloud. Refer to Step 2.
Service Account ID	Type the Service Account ID that is associated with your Google Cloud account. Refer to Step 5 (a).
Bucket Name	Type the bucket name, which you have create in Step 7 (a) for new and Step 6 (a) for existing bucket.
Upload Private Key Path	Upload P12 Extension file, which you have create and downloaded as part of Step 5 (a).
Usage File Prefix	Type the usage file prefix. This will enable you for billing. Refer to Step 8 (b).
JSON Private Key File Content	Copy JSON content of the file, which you have created and downloaded as part of Step 5 (b).
SAML Domain Name	Enter the Domain name. Refer to Step 11. This field is optional for you. However, if you want to perform SSO, then you must provide your SAML Domain name.
SAML Name ID	Enter the SAML Name ID. Refer to Step 10. This field is optional for you. However, if you want to perform SSO, then you must provide your SAML Name ID.
Username	Enter your username. The username is the login ID of your Google Cloud console. Refer to Step 12.

Once you are done with adding the cloud service credentials, refer Step 7 of Adding Cloud Service Credentials.

Note: You might experience some of the features doesn't perform as expected, such as; live dashboard doesn't load, resources doesn't display, billing might be wrong. This is due to some of the following errors:

You might have provided wrong credentials.
Latency in data processing.
If JobServer is down.
Unexpected special characters in the processing file.

Google Cloud Account Settings

Setting Up Domain in GSuite

Account Mapping

What next?