Google Chrome Enterprise Device Trust Connector

The Google Chrome Enterprise Device Trust connector lets you include operating system device signals collected by Google Chrome Enterprise Device Trust in your PingOne DaVinci flow.

The connector authenticates against the Chrome Verified Access API and returns device signals, such as the serial number, OS version, MAC addresses, and security settings, that you can use in access decisions in your flow.

Setup

Resources

You can find more information and setup help in the following:

Google Chrome documentation:
- Manage Chrome Enterprise device trust connectors
- Chrome Verified Access developer guide
PingOne DaVinci documentation:

Requirements

To use the connector, you’ll need:

A Google Cloud project with the Chrome Verified Access API added, and permission to create an API key and a service account for the project.
Access to the Chrome Browser Management Console and permission to set policies for enrolled browsers.

Configuring the Google Chrome Enterprise Device Trust connector

Add the connector in PingOne DaVinci as shown in Adding a connector, then configure it as follows.

Connector configuration

Setting	Description
Redirect URL	The PingOne DaVinci redirect URL for this connector. This value is provided automatically as a read-only field and should be copied into your Google Cloud project configuration as needed.
API Key	Your Google Cloud project API key. For information about creating one, see the Chrome Verified Access developer guide.
Credentials Client Email	The email address of the Google Cloud service account from the service account key.
Private Key	The private key of the Google Cloud service account from the service account key.
Application Return To URL	The callback URL to return to your application when you’re using the embedded flow player widget with an identity provider or social login connector.

Setting

Description

Redirect URL

The PingOne DaVinci redirect URL for this connector. This value is provided automatically as a read-only field and should be copied into your Google Cloud project configuration as needed.

API Key

Your Google Cloud project API key. For information about creating one, see the Chrome Verified Access developer guide.

Credentials Client Email

The email address of the Google Cloud service account from the service account key.

Private Key

The private key of the Google Cloud service account from the service account key.

Application Return To URL

The callback URL to return to your application when you’re using the embedded flow player widget with an identity provider or social login connector.

Using the connector in a flow

Retrieving device signals for access decisions

You can use the connector to retrieve Chrome device trust signals in a flow, such as when you want to permit access only from managed devices with disk encryption enabled.

At a high level:

The flow redirects the user’s browser to Google, which provides the Verified Access challenge to the managed Chrome browser.
The Verify Access capability authenticates against the Verified Access API and returns the device signals in the connector output if device trust is enabled in the Chrome browser policy.
The output includes device trust data, such as whether device trust is enabled, the device permanent ID, the key trust level, and device signals, such as the serial number, OS and OS version, MAC addresses, host name, and security settings, such as whether the disk is encrypted and secure boot is enabled.
If device trust isn’t enabled, the capability returns output indicating that the device isn’t verified, which you can branch on in your flow.

Test the flow by clicking Save, Deploy, and Try Flow.

Capabilities

Verify Access

Authenticate against Verified Access API

Show details

Input Schema
Output Schema

default object
- properties object

output object
- rawResponse object
- statusCode number
- headers object
- deviceTrustEnabled boolean
- devicePermanentId string
- virtualDeviceId string
- customerId string
- keyTrustLevel string
- deviceSignal object
  - browserVersion string
  - builtInDnsClientEnabled boolean
  - chromeCleanupEnabled boolean
  - chromeRemoteDesktopAppBlocked boolean
  - crowdStrike object
    
    agentId string
    
    customerId string
  - deviceAffiliationIds array
  - deviceEnrollmentDomain string
  - deviceHostName string
  - deviceManufacturer string
  - diskEncrypted number
  - displayName string
  - macAddresses array
  - os string
  - osFirewall number
  - osVersion string
  - passwordPotectionWarningTrigger number
  - profileAffiliationIds array
  - realtimeUrlCheckMode number
  - safeBrowsingProtectionLevel number
  - screenLockSecured number
  - secureBootEnabled number
  - serialNumber string
  - siteIsolationEnabled boolean
  - systemDnsServers array
  - thirdPartyBlockingEnabled boolean

Connectors