How to Configure Google Workspace Cloud Identity for Secure LDAP Access

The Challenge of Legacy Authentication

Many enterprises utilize Google Workspace as their primary Identity Provider (IdP) for cloud applications via SAML or OIDC. However, organizations often rely on legacy infrastructure—such as VPN appliances, Wi-Fi RADIUS servers, or traditional Linux SSH servers—that do not support modern web-based authentication protocols. These legacy systems expect to verify credentials by querying a traditional LDAP (Lightweight Directory Access Protocol) directory like Microsoft Active Directory.

Google Cloud Identity Secure LDAP acts as a bridge. It provides a managed, cloud-hosted LDAP endpoint that legacy applications can query. When a user attempts to log into a VPN, the VPN queries Google’s Secure LDAP service, which then validates the credentials against the Google Workspace directory.

Prerequisites

To configure Secure LDAP, you must have:

• A Google Workspace Enterprise (Standard or Plus), Education Standard/Plus, or Cloud Identity Premium subscription.
• Super Administrator access to the Google Admin console.
• The ability to install SSL/TLS certificates on your legacy LDAP client (e.g., the VPN appliance or Linux server).

Step 1: Adding an LDAP Client in Google Workspace

The first step is to register the specific application or server that will be querying Google’s LDAP directory.

1. Log into the Google Admin console (admin.google.com).
2. Navigate to Apps > LDAP.
3. Click Add LDAP Client.
4. Enter a descriptive name for the client, such as “Cisco VPN Appliance” or “Ubuntu SSH Servers”. Click Continue.

Step 2: Configuring Access Permissions

You must strictly define what information the LDAP client is allowed to query. Giving a VPN appliance access to your entire corporate directory structure is a security risk.

1. Under Verify user credentials, select whether the client can authenticate users from the entire domain, or only from specific Organizational Units (e.g., “Engineering”).
2. Under Read user information, determine if the client needs to read user attributes (like phone numbers or manager names). For simple authentication, select No user information or restrict it.
3. Click Add LDAP Client.

Step 3: Generating and Downloading the Certificate

Unlike traditional LDAP which often relies on a simple bind username and password, Google Secure LDAP mandates mutual TLS (mTLS) for authentication. The client must present a cryptographic certificate to prove its identity.

1. After adding the client, a summary page appears. Click Generate new certificate.
2. A `.zip` file will automatically download to your computer containing two files: a `.crt` (the public certificate) and a `.key` (the private key).
3. Crucial: You must also enable the service. On the client page, change the Service Status from OFF to ON.

Step 4: Configuring the Legacy Application

You must now configure your legacy application (VPN, NAS, or Linux server) to connect to Google.

The specific steps depend on your hardware, but you must provide the following standard LDAP parameters:

• Server URL: ldaps://ldap.google.com
• Port: 636 (Note: Google does not support unencrypted port 389).
• Base DN: dc=company,dc=com (Replace with your actual domain components).
• Authentication Method: Certificate-based / Mutual TLS. You must upload the `.crt` and `.key` files you downloaded in Step 3 into the appliance’s certificate store.

Conclusion

Google Cloud Identity Secure LDAP is a powerful tool for organizations migrating away from on-premises Active Directory. By exposing a highly secure, mTLS-encrypted LDAP interface, administrators can seamlessly integrate legacy hardware with modern Google Workspace cloud identities.