Reference: CSE for Drive for Desktop Integration

Overview

This article shows you how to set up Google Workspace client-side encryption (CSE) for Drive for desktop with Virtru Private Keystore (VPK). When you're done, users can open CSE-encrypted Word, PowerPoint, PDF and other files from the Google Drive folder on their computer.

Prerequisites

• VPK for CSE is deployed and working for Google Drive on the web.
• Your Google Workspace edition supports CSE (for example, Enterprise Plus or Frontline Plus).
• CSE is turned on for the organizational units (OUs) or groups your users belong to.
• Users have Drive for desktop installed and signed in.
• You have admin access to the Google Cloud console, the Google Admin console, and your VPK host or Kubernetes cluster.
• You have the Web application client ID you created during VPK for CSE setup.

Part 1: Create a Desktop OAuth client

1. Go to console.cloud.google.com and select the project you used for your VPK for CSE setup.
2. Go to Google Auth Platform > Clients.
3. Click Create Credentials > OAuth client ID.
4. Enter these values:
   • Application type: Desktop app
   • Name: Virtru-CSE-Desktop-app
5. Click Create.
6. Copy the Client ID and Client secret and keep them somewhere safe. This article calls the client ID <DESKTOP_CLIENT_ID>.

Part 2: Register the client in the Google Admin console

1. Sign in to admin.google.com.
2. Go to Data > Compliance > Client-side encryption.
3. Open your identity provider (IdP) configuration.
4. Under Authentication for Google desktop and mobile applications, select Drive for desktop.
5. Enter <DESKTOP_CLIENT_ID>, and the client secret if asked.
6. Click Save.

Recommended: Add your IdP to the trusted third-party apps list in the Admin console. This keeps users from being asked to sign in again and again.

Part 3: Update the VPK configuration

Step 1: Build the JWT_AUD JSON

On your VPK host, create a file named jwt_aud.json. Replace the two placeholders in privileged-wrap with your own client IDs:

• <WEB_CLIENT_ID>: The Web application client ID from your VPK for CSE setup
• <DESKTOP_CLIENT_ID>: The Desktop app client ID from Part 1

[
  {
    "authn": [
      "671756027915-e6odj0joq1v28fcf8gk7cm716ov5d0gm.apps.googleusercontent.com",
      "947318989803-k88lapdik9bledfml8rr69ic6d3rdv57.apps.googleusercontent.com",
      "313892590415-d3h1l7kl4htab916r6jevqdtu8bfmh9m.apps.googleusercontent.com",
      "313892590415-6lbccuf47cou4q45vanraqp3fv5jt9do.apps.googleusercontent.com",
      "313892590415-q84luo8fon5pn5vl8a6rppo1qvcd3qvn.apps.googleusercontent.com",
      "313892590415-283b3nilr8561tedgu1n4dcm9hd6g3hr.apps.googleusercontent.com",
      "313892590415-samhd32i4piankgs42o9sit5e9dug452.apps.googleusercontent.com",
      "313892590415-i06v47su4k03ns7ot38akv7s9ari5oa5.apps.googleusercontent.com",
      "313892590415-ijvjpbnsh0gauuunjgsdn64ngg37k6rc.apps.googleusercontent.com",
      "313892590415-32ha2bvs0tr1b12s089i33o58hjvqt55.apps.googleusercontent.com"
    ],
    "authz": "cse-authorization",
    "privileged-wrap": [
      "<WEB_CLIENT_ID>",
      "<DESKTOP_CLIENT_ID>"
    ]
  }
]

The authn list contains Google's client IDs for its desktop and mobile apps. 947318989803-k88lapdik9bledfml8rr69ic6d3rdv57 is the Drive for desktop client ID. Don't change these values.

Reference: Google: Client IDs for desktop and mobile apps

Step 2: Base64 encode the JSON

Run:

jq -c . jwt_aud.json | tr -d '\n' | base64 | tr -d '\n'; echo

This command:

• Checks that the JSON is valid. If it isn't, jq shows an error.
• Compresses the JSON to one line.
• Returns the Base64 string on a single line. This works on both Linux and macOS.

Copy the output.

Step 3: Update JWT_AUD

Important: Make a copy of your values.yaml or cse.env file before making any changes.

Docker: Edit /var/virtru/cse/cse.env:

JWT_AUD=<your_base64_string>

Kubernetes: Edit values.yaml:

<key.path>:
  JWT_AUD: "<your_base64_string>"

Step 4: Apply the changes

Docker:

docker ps                          # find the CSE container name
docker rm -f <container_name>
cd /var/virtru/cse
sh run.sh

Kubernetes:

helm upgrade -n virtru -f ./values.yaml virtru ./
kubectl rollout status deployment/<deployment_name> -n virtru

If the pods don't restart (check with kubectl get pods -n virtru), force a restart:

kubectl rollout restart deployment/<deployment_name> -n virtru

Step 5: Verify the configuration

Check that the running service has the new value.

Docker:

docker exec <container_name> printenv JWT_AUD | base64 -d | jq .

Kubernetes:

kubectl exec -n virtru deploy/<deployment_name> -- printenv JWT_AUD | base64 -d | jq .

The output should match your jwt_aud.json file.

Part 4: Test Drive for desktop

Open an encrypted file

1. Open the Google Drive folder on your computer.
2. Open an encrypted file (Word, PowerPoint, PDF, etc.).
3. If asked, sign in with your IdP.

Create encrypted content

You can create encrypted files in either of these ways:

• Encrypt an existing file: In drive.google.com, right-click the file, select Make a copy, then click Make an encrypted copy.
• Upload in bulk: Upload encrypted files or folders in drive.google.com.

You can open encrypted files from Drive for desktop or on the web. On the web, use Google Chrome or Microsoft Edge.

Troubleshooting

Summary

• Desktop OAuth client created and client ID saved
• Drive for desktop client set up in the Google Admin console
• jwt_aud.json has all authn client IDs plus your Web and Desktop client IDs in privileged-wrap
• JSON encoded as one Base64 line
• JWT_AUD updated in cse.env or values.yaml
• Container or pods recreated
• JWT_AUD checked in the running service
• Encrypted file opens from Drive for desktop and on the web