Skip to content
Avanet

Set up Sophos Firewall Chromebook SSO with Google Workspace

Sophos Firewall

With Chromebook SSO, the Sophos Chromebook User ID extension reports the signed-in Google Workspace user to the firewall. SFOS can then apply user-based rules and show the session under Current activities > Live users.

The process has five parts: prepare the certificate and DNS name, enable Chromebook SSO in Device Access, create the SSO settings and two firewall rules, deploy the current extension through Google Admin, and verify the result with a test user. This guide follows SFOS 22.0 MR2 and the current Manifest V3 extension.

Prerequisites

You need:

  • managed Chromebooks on a network protected by Sophos Firewall;
  • access to WebAdmin and Google Admin;
  • user addresses from the Google Workspace domain, such as user@example.com;
  • an internal DNS name for the firewall, such as chromebook-sso.example.com;
  • a certificate with a private key and a CA trusted by the Chromebooks;
  • an authentication server configured on the firewall.

For a predictable production rollout, this guide uses a local Active Directory whose users are synchronized with Google Workspace. The current Chrome Web Store listing explicitly names this combination. The SFOS 22 help also lists LDAP and Google Secure LDAP; this variant should therefore be tested with a pilot group before user-based rules depend on it. The directory service setup is covered in Connect Active Directory to Sophos Firewall and Connect an LDAP server to Sophos Firewall.

Sophos announced the new Manifest V3 extension with SFOS 22.0 MR2. However, the current Chrome Web Store listing lists SFOS 20.0 MR3 or later as the minimum version. The extension should therefore not be understood as exclusive to MR2; however, the menu paths and screenshots in this guide refer to SFOS 22.0 MR2.

Configure Sophos Firewall

Prepare the certificate and DNS name

The name chromebook-sso.example.com must resolve in internal DNS to the firewall address that the Chromebooks can reach. Create or import a certificate for this name under Certificates > Certificates.

The certificate needs a private key and an issuing CA that is present on the firewall, and it must not be protected by a passphrase. Enter the FQDN as both the Subject Alternative Name (SAN) and the Common Name (CN). Sophos requires a match with the CN; current Chrome uses the SAN for hostname verification. The same FQDN is later used as serverAddress.

Under Hosts and services > FQDN host, also create a host object for accounts.google.com. This object is later used together with the predefined groups Google API Hosts and Google Chrome Web Store in the bootstrap rule.

Enable Device Access and Chromebook SSO

  1. Open Administration > Device access.
  2. Enable Chromebook SSO only for the internal zones from which the managed devices connect, such as LAN and Wi-Fi.
  3. Open Authentication > Services > Chromebook SSO and enable Enable.
  4. Under Domain, enter the Workspace domain example.com.
  5. Set Port to 65123.
  6. Select the certificate for chromebook-sso.example.com.
  7. Select Download G Suite app config.
  8. Open the JSON file in a text editor and set serverAddress to chromebook-sso.example.com. Then save the file.

Device Access permits access to the firewall’s local SSO service. A standard firewall rule does not replace this step. Conversely, Device Access does not yet permit internet access to Google. This separation is explained in Device Access and Local Service ACL.

Create two firewall rules

Under Rules and policies > Firewall rules, create two rules in the following order.

The first rule, for example Chromebook-Google-Bootstrap, permits app deployment and communication with Google:

  • Action: Accept
  • Source zones: LAN and/or Wi-Fi
  • Source networks: the Chromebook networks
  • Destination zones: WAN
  • Destination networks: the custom object for accounts.google.com as well as Google API Hosts and Google Chrome Web Store

Below it, add the actual user rule, for example Chromebook-Users:

  • Action: Accept
  • the same source zones and Chromebook networks
  • the required destinations in WAN
  • Match known users: enabled
  • Use web authentication for unknown users: enable only if Captive Portal is required as a fallback
  • Log firewall traffic: enabled during the pilot phase

The bootstrap rule must be above the user rule. Otherwise, the extension may be missing or OAuth may fail before the firewall knows the user.

Configure Google Workspace

Deploy the extension

  1. In Google Admin, open Devices > Chrome > Apps & extensions > Users & browsers.
  2. First select a pilot OU or a small test group.
  3. Select Add > Add from Chrome Web Store.
  4. Add Sophos Chromebook User ID and verify the extension ID kpgmhapilmiknabfjblafefhahodhjca.
  5. Under Installation policy, select at least Force install.
  6. Under Policy for extensions, upload the previously adjusted JSON file.
  7. Save and wait for the policy to reach the test device.

For an existing installation, this is not an in-place update: according to Sophos, the old extension must be removed and the new Manifest V3 extension installed. The migration should first be performed in a pilot OU so that user rules do not fall back to a fallback policy while identity is temporarily unavailable. More information is available in the SFOS 22.0 MR2 overview.

Mark the OAuth app as trusted

To prevent OAuth from being blocked:

  1. Open Security > Access and data control > API controls.
  2. Under App access control, go to Manage app access.
  3. Open Accessed apps > View list and search for Sophos User ID.
  4. Select Change access, set the appropriate scope, and select Trusted.

Distribute the local CA to ChromeOS

This step is required if the SSO certificate was issued by an internal or locally signed CA that ChromeOS does not yet trust.

  1. On the firewall, under Certificates > Certificate authorities, download the issuing CA and extract the PEM file from the archive.
  2. In Google Admin, open Devices > Networks > Certificates.
  3. Upload the PEM file using Upload certificate.
  4. Under Certificate authority, enable its use for Chromebook and save.

Verify sign-in and rule matching

  1. On the test device, open chrome://policy, select Reload policies, and verify that the extension policy was received from the cloud.
  2. Sign in to the Chromebook again with a managed user such as user@example.com.
  3. On the firewall, open Current activities > Live users. The user, client IP, and Client Type Chromebook SSO must appear.
  4. Open a connection that is permitted by Chromebook-Users.
  5. In Log viewer, verify that this exact user rule was matched. Working internet access alone does not prove this because a more general rule might also allow the traffic.

Only roll out the policy to additional OUs once both the live user and rule hit are correct.

Troubleshoot specific errors

  • Extension is missing: Check the extension ID, target OU, Installation policy, and status under chrome://policy.
  • OAuth fails: Verify that Sophos User ID is classified as Trusted for the correct OU and that the bootstrap rule can reach the Google destinations.
  • TLS or connection error: Compare DNS resolution, serverAddress, SAN, CN, certificate chain, and CA rollout. All names must point to chromebook-sso.example.com.
  • User is missing under Live users: Check the Workspace domain, user address, authentication server, and Device Access.
  • User is visible, but the wrong rule matches: Check the rule position, source network, user assignment, and logging. A systematic approach is explained in Why a Sophos Firewall rule does not match.
  • The extension continues to show Connected after a disconnect: On SFOS 21.5 GA and later, the display can remain stale even though the session on the firewall has ended. Sign out of and back into the extension, or briefly disconnect the Chromebook’s network connection. Live users is authoritative for verification.

For service logs, sign in to the Sophos Firewall CLI through SSH and select 5. Device Management > 3. Advanced Shell. The following commands only read data and do not change the configuration:

tail -f /log/chromebook-sso-backend.log
tail -f /log/csd.log

Then repeat the sign-in with the test user and look for new entries at the same time. Press Ctrl+C to stop the live output. An overview of additional authentication logs is available in Sophos Firewall service logs.

FAQ

Does Chromebook SSO work outside the protected network?

No. The Chromebook must be able to reach the configured firewall address on the protected network. Outside this network, the extension cannot associate a local session with this firewall.

Can the built-in Let's Encrypt certificate be used for Chromebook SSO?

No. Sophos excludes certificates from the built-in Let’s Encrypt feature for the Chromebook SSO service. Use a suitable imported or locally signed certificate; the general certificate limitations are explained in Let’s Encrypt on Sophos Firewall.