Configuring Chromebook single sign-on

First configure XG Firewall.

1. Create an Active Directory server.
   The Chromebook users in the AD must have email addresses that use the domain registered with G Suite. For example, if your registered domain is example.com, AD Chromebook users must have an email address like user@example.com.
2. Change device access to allow Chromebook SSO.
   Go to Administration > Device access and select Chromebook SSO for the zone where the Chromebook users are allowed to connect from, for example, LAN and Wi-Fi.
3. Create or import a valid certificate.
   Note The CN must match the zone and network where the Chromebook users are, for example, gateway.example.com.

   The certificate must not be protected by a passphrase.

   The certificate is used for SSL-encrypted communication with the Chromebooks.
4. Go to Authentication > Services > Chromebook SSO, enable the Chromebook SSO feature and specify the following settings:

   Option	Description
   Domain	The domain as registered with G Suite, that is, the domain suffix of the email addresses used in G Suite, for example, example.com. This can be different from your Active Directory domain.
   Port	65123
   Certificate	The certificate created/imported above
   Logging level	Select the amount of logging

5. Click Download G Suite app config.
   This will download a JSON file that you need to paste into G Suite later.
6. Open the file with a text editor, enter a value for serverAddress (LAN or DNS IP address of XG Firewall), and save.
   Server address must match the certificate’s CN, for example, 10.1.1.1.
7. Create firewall rules.
   1. Create a User/Network rule to allow Google API and Chrome Web Store communication for all devices. This is necessary to push the app to the Chromebooks:
      • Source zones, for example: LAN, Wi-Fi
      • Destination zones, for example: WAN
      • Destination networks: Select the predefined FQDN host groups Google API Hosts and Google Chrome Web Store.
   2. Create a User/Network rule to match known users and to show the captive portal to unknown users to allow internet access to Chromebooks:
      • Source zones, for example: LAN, Wi-Fi
      • Destination zones, for example: WAN
      • Identity: Select the following options: Match known users, Show captive portal to unknown users

      Sort both rules so that rule a) is applied before rule b).

      If you don’t select Show captive portal to unknown users in rule b), we recommend that you create another network rule c) to avoid possible waiting time when contacting the Chrome Web Store.

   3. Create a User/Network rule with the following settings:
      • Rule type: Reject
      • Source zones, for example: LAN, Wi-Fi
      • Destination zones: WAN

      Place the rule at the bottom of the list so that the rule is applied last.

Configure G Suite for communication with XG Firewall.

1. Sign in to G Suite and go to Device management > Chrome > Apps & extensions.
2. Search for the Sophos Chromebook user ID app and select it.
3. Select from the drop-down list next to the app. The following options are available.

   Option	Description
   Force install + pin	Automatically installs and pins the app to the taskbar on all Chromebooks configured for your domain.
   Force install	Automatically installs the app on all Chromebooks configured for your domain.
   Allow installation	Allows users to install apps on their own.
   Block	Block the app.

4. Click the row outside the drop-down list to open the right hand panel. In the text field, paste the downloaded JSON configuration file.
   That’s the one you’ve downloaded from Authentication > Services > Chromebook SSO.
5. Save.
   The configuration changes will be automatically deployed to all managed devices. Google documentation says “Settings typically take effect in minutes. But they take up to an hour to apply for everyone.”

If you use a self-signed certificate for XG Firewall, you must deposit the corresponding CA certificate in G Suite for proxy and app communication to work.

1. Sign in to G Suite and go to Device management > Networks > Certificates.
2. Click Add certificate and upload the CA certificate you downloaded from XG Firewall.
3. Select the option Use this as an HTTPS certificate authority.