{"id":13305725,"url":"https://github.com/freepik-company/bgos","last_synced_at":"2026-05-02T10:37:39.685Z","repository":{"id":237947241,"uuid":"795550394","full_name":"freepik-company/bgos","owner":"freepik-company","description":"A process to synchronize selected G.Workspace groups into Hashicorp Boundary groups with authoritative approach","archived":false,"fork":false,"pushed_at":"2024-05-06T08:53:53.000Z","size":44,"stargazers_count":3,"open_issues_count":0,"forks_count":0,"subscribers_count":1,"default_branch":"master","last_synced_at":"2025-03-13T01:36:40.627Z","etag":null,"topics":["bgos","gitops","golang","google-workspace","gsuite","hashicorp-boundary","oidc"],"latest_commit_sha":null,"homepage":"https://freepik.com","language":"Go","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/freepik-company.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2024-05-03T14:20:36.000Z","updated_at":"2024-06-19T09:23:39.000Z","dependencies_parsed_at":"2024-05-03T17:39:31.640Z","dependency_job_id":"fa6fcee8-f457-456e-9801-330f0ceb9699","html_url":"https://github.com/freepik-company/bgos","commit_stats":null,"previous_names":["achetronic/bgos"],"tags_count":3,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/freepik-company%2Fbgos","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/freepik-company%2Fbgos/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/freepik-company%2Fbgos/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/freepik-company%2Fbgos/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/freepik-company","download_url":"https://codeload.github.com/freepik-company/bgos/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":244952770,"owners_count":20537472,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["bgos","gitops","golang","google-workspace","gsuite","hashicorp-boundary","oidc"],"created_at":"2024-07-29T17:54:00.243Z","updated_at":"2026-05-02T10:37:34.663Z","avatar_url":"https://github.com/freepik-company.png","language":"Go","funding_links":[],"categories":[],"sub_categories":[],"readme":"# BGOS (Boundary Gsuite OIDC Syncer)\n\n![GitHub go.mod Go version (subdirectory of monorepo)](https://img.shields.io/github/go-mod/go-version/freepik-company/bgos)\n![GitHub](https://img.shields.io/github/license/freepik-company/bgos)\n\n![YouTube Channel Subscribers](https://img.shields.io/youtube/channel/subscribers/UCeSb3yfsPNNVr13YsYNvCAw?label=achetronic\u0026link=http%3A%2F%2Fyoutube.com%2Fachetronic)\n![GitHub followers](https://img.shields.io/github/followers/achetronic?label=achetronic\u0026link=http%3A%2F%2Fgithub.com%2Fachetronic)\n![X (formerly Twitter) Follow](https://img.shields.io/twitter/follow/achetronic?style=flat\u0026logo=twitter\u0026link=https%3A%2F%2Ftwitter.com%2Fachetronic)\n\nA super specific process to synchronize selected G.Workspace groups into Boundary groups\nfollowing an authoritative approach\n\n## Motivation\n\nBoundary service has the capability of using GCP Oauth2 as OIDC provider, but GCP does not set the groups into\nJWTs claims. This could be solved performing a second call to G. Workspace Admin API to retrieve them, but Boundary\nhas not this capability implemented nowadays*.\n\nThis synchronizer does this job in the background. It creates and synchronizes some groups and their memberships for you,\nfollowing an authoritative approach.\n\n## Flags\n\nEvery configuration parameter can be defined by flags that can be passed to the CLI.\nThey are described in the following table:\n\n| Name                           | Description                                                           |      Default      | Example                                           |\n|:-------------------------------|:----------------------------------------------------------------------|:-----------------:|---------------------------------------------------|\n| `--log-level`                  | Define the verbosity of the logs                                      |      `info`       | `--log-level info`                                |\n| `--disable-trace`              | Disable traces from logs                                              |      `false`      | `--disable-trace true`                            |\n| `--google-sa-credentials-path` | Google ServiceAccount credentials JSON file path                      |   `google.json`   | `--google-sa-credentials-path=\"~/something.json\"` |   \n| `--sync-time`                  | Waiting time between group synchronizations (in duration type)        |       `10m`       | `--sync-time 5m`                                  |\n| `--google-group`               | (Repeatable or comma-separated list) G.Workspace groups               |        `-`        | `--google-group group1@company.com`               |\n| `--boundary-oidc-id`           | Boundary oidc auth method ID to compare its users against G.Workspace | `amoidc_changeme` | `--boundary-oidc-id \"amoidc_example\"`             |\n| `--boundary-scope-id`          | Boundary scope ID where the users and groups are synchronized         |     `global`      | `--boundary-scope-id \"global\"`                    |\n\n## Environment Variables\n\nSecurity-critical parameters are managed by environment variables.\nThey are described in the following table:\n\n| Name                           | Description                                                       | Default | Example                                  |\n|:-------------------------------|:------------------------------------------------------------------|:-------:|------------------------------------------|\n| `BOUNDARY_ADDR`                | Address where your Boundary instance is hosted                    |   `-`   | `https://hashicorp-boundary.company.com` |\n| `BOUNDARY_AUTHMETHODPASS_ID`   | ID of boundary auth method where the privileged user is stored    |   `-`   | `ampw_example`                           |\n| `BOUNDARY_AUTHMETHODPASS_USER` | Username of boundary privileged user that perform synchronization |   `-`   | `user_example_changeit`                  |\n| `BOUNDARY_AUTHMETHODPASS_PASS` | Password of boundary privileged user that perform synchronization |   `-`   | `super_secure_password`                  |\n\n## Examples\n\nHere you have a complete example to use this command.\n\n\u003e Output is thrown always in JSON as it is more suitable for automations\n\n```console\n\nexport BOUNDARY_ADDR=\"https://your-boundary.you-company.com/\"\nexport BOUNDARY_AUTHMETHODPASS_ID=\"ampw_example\"\nexport BOUNDARY_AUTHMETHODPASS_USER=\"automation-google-workspace-groups-syncer\" \nexport BOUNDARY_AUTHMETHODPASS_PASS='super_secure_password'\n\nbgos run \\\n     --log-level=info \\\n     --google-sa-credentials-path=le_credentials.json \\\n     --google-group sre@your-company.com \\\n     --google-group developers@your-company.com\n```\n\n## How to use\n\nThis project provides binary files and Docker images to make it easy to use wherever wanted\n\n### Binaries\n\nBinary files for the most popular platforms will be added to the [releases](https://github.com/freepik-company/bgos/releases)\n\n### Docker\n\nDocker images can be found in GitHub's [packages](https://github.com/freepik-company/bgos/pkgs/container/bgos)\nrelated to this repository\n\n\u003e Do you need it in a different container registry? We think this is not needed, but if we're wrong, please, let's discuss\n\u003e it in the best place for that: an issue\n\n## How to contribute\n\nWe are open to external collaborations for this project: improvements, bugfixes, whatever.\n\nFor doing it, open an issue to discuss the need of the changes, then:\n\n- Fork the repository\n- Make your changes to the code\n- Open a PR and wait for review\n\nThe code will be reviewed and tested (always)\n\n\u003e We are developers and hate bad code. For that reason we ask you the highest quality\n\u003e on each line of code to improve this project on each iteration.\n\n## License\n\nCopyright 2022.\n\nLicensed under the Apache License, Version 2.0 (the \"License\");\nyou may not use this file except in compliance with the License.\nYou may obtain a copy of the License at\n\n    http://www.apache.org/licenses/LICENSE-2.0\n\nUnless required by applicable law or agreed to in writing, software\ndistributed under the License is distributed on an \"AS IS\" BASIS,\nWITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\nSee the License for the specific language governing permissions and\nlimitations under the License.\n\n## Special mention\n\nThis project was done using IDEs from JetBrains. They helped us to develop faster, so we recommend them a lot! 🤓\n\n\u003cimg src=\"https://resources.jetbrains.com/storage/products/company/brand/logos/jb_beam.png\" alt=\"JetBrains Logo (Main) logo.\" width=\"150\"\u003e\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Ffreepik-company%2Fbgos","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Ffreepik-company%2Fbgos","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Ffreepik-company%2Fbgos/lists"}