NetBird First time set‐up

"Deployment"

"Server" (Cloud portal)

1. Navigate to https://netbird.io.
2. Click the Get Started - Free button.
3. Login with your Google/Microsoft/Github SSO (or click the Sign Up link if you don't have a supported SSO. Note that those are not the only NetBird supported, but some requiring logging in to do initial set-up, like OKTA).
4. Read the Privacy Policy and the Terms of Service.
5. Click Continue.
6. You will be prompted to install the Netbird agent on a device to finish the server installation. See next section.

Client / agent (forced first time)

Note

I have not found a way around this screen, even by modifying the URL. I am probably going to open an issue for it, because what if I wanted to set everything up en masse with setup keys?

1. Install NetBird on one host using the instructions in the Installation docs.
2. Start NetBird on the host and login using the same credentials used on the server.
3. For SSO based logins, click Accept to allow Netbird to access your profile and email address.

Settings

The following are recommended modifications from defaults:

1. Settings > Authentication > Require login after disconnect : ENABLE
2. MFA: ENABLE (If SSO provider does not support MFA)

Identity Provider (IdP) Sync

Google Workspace

Google Cloud steps

Tip

The following might be out of date. The NetBird > Integrations > Google Workspace section should guide you through the process.

Confirm adequate permissions

1. Sign in to Google Cloud Console
2. From the Project Picker (CTRL+O), select your Organization.
3. Navigate to IAM & Admin > IAM > Allow tab > View by principals sub-tab and filter by Role: Organization Administrator OR Role:Organization Policy Administrator
4. Ensure your user or one of Your Groups is in the list.

Create and configure the NetBird project

1. From the Project Picker (CTRL+O), select New Project.
2. Set the Project name as NetBird and ensure the Organization and Location is correct.
3. Click Create.
4. In the Created Notification pop-up, click Select Project OR From the Project Picker, select NetBird.
5. Navigate to APIs & Services > Library. In the left Category list, choose Google Workspace. Click on the Admin SDK API (Alternatively, you could directly search for that API from the Library page).
6. Click Enable.
7. Navigate to APIs & Services > Organization Policies.
8. In the filter box above the table, choose: ID: iam.disableServiceAccountKeyCreation. IF Enforcement state is Active, then do the following: click the triple dots in the Actions column > Edit policy. Select Override parent's policy > Add rule > Enforcement: Off > Done and then click Set policy.

Create the NetBird service account

1. If not already in the NetBird project, from the Project Picker (CTRL+O), select NetBird.
2. Navigate to APIs & Services > Credentials.
3. Click Create Credentials > Service account
4. In the form:
   • Service account name: NetBird
   • Service account ID: netbird (auto-populated)
   • Service account description: Syncs users and groups from Google to NetBird
   • To save time later, copy the Email address field off.
5. Click Done.
6. Click on the newly created Service Account name.
7. Navigate to the Keys tab, and click Add Key > Create new key. Select JSON and click Create.

Warning

You might get a "Service key creation disabled" message here. If you do, see step 8 in the previous section, then return and repeat this step.

8. The key will be downloaded on your device. Click Close in the dialog.

Google Admin steps

Create a Read-only User and Groups role and add the service account

1. Sign in to Google Admin Console
2. Navigate to Account > Admin roles.
3. Click Create new role
   • Name: Users and Groups Admin API ReadOnly
   • Description: Used for syncing users and groups to external services
4. Click Continue.
5. Admin console privileges: Search "admin api"
6. Admin API privileges: Search "Read"
7. Select:
   • Groups > Read
   • Users > Read
8. Click Continue
9. Click Create Role (NOTE: This screen didn't display the privileges correctly but it did create correctly)
10. Within the newly created role, in the Admins section, click ASSIGN ROLE.
11. Click Assign service accounts
12. Paste the NetBird google cloud project service account email address and click ADD
13. Click Assign role.

Find the Customer ID

1. In Google Admin Console, navigate to Account > Account Settings
2. Note the Customer ID for later.

NetBird side

1. NetBird > Integrations > Google Workspace > Get Started
2. Click Continue until you get to the "Get your service account email" page. Paste your service account email address in this field.
3. Click Continue until you get to the "Create service account key" page. Upload the service account key json file here.
4. Click Continue until yo uget to the "Enter Customer ID" screen. Paste the Customer ID from the previous section here.