Smallstep can be deployed to ChromeOS devices using Google Workspace. With our ChromeOS extension, devices can get certificates from Smallstep using ACME Device Attestation. Using Chrome Verified Access APIs, Google will attest the serial number of a ChromeOS device to Smallstep.

To use Smallstep with ChromeOS devices:

• Devices must be enrolled in a Google Workspace domain for enterprise or education management
• Devices must be registered in the Smallstep platform, identified by their serial number
• Users must be managed Google Workspace users. If you use a different user identity provider, all your users must be synced to Google Workspace using directory sync
• Users and devices must both be registered in the same Google Workspace domain and Organizational Unit (OU). (Using an OU is optional.)
• Current device state must comply with enterprise device policy

Prerequisites

You will need:

• A Smallstep team

• A Google Workspace tenant, with ability to manage domain-wide delegation

• A Google Cloud project, with ability to create service accounts and keys

  • The Google Cloud project must have the Chrome Verified Access API enabled

• A ChromeOS device to enroll for management

• A Google Workspace Organizational Unit (OU) for testing (optional)

  If you intend to use an Organization Unit (OU) for testing or segmentation purposes, ensure that both the user and the device are in the same OU. If a user that logs in onto the device is not part of the OU, it’s possible that not all policies get applied.

  ⚠️ There are a few steps of this tutorial where an OU can selected. For configuration to apply to the right users and devices, take extra care wherever you see an OU selection view in Google Workspace Admin.

  When you enroll a ChromeOS device, the device is placed in the OU that the enrolling user is in. The settings you've applied for that user's OU are applied to the device.

• A Google user for testing on the device. You may wish to use a different account than you use for work.

Before you begin

First, follow the instructions in Connect Google Workspace to Smallstep to sync your device inventory from Google Workspace.

Step-by-step instructions

The Smallstep ChromeOS extension requires giving Smallstep additional permissions to access the Chrome Verified Access API.

1. In Google Workspace Admin Console, visit Security → Access and data control → API controls

   1. Under Domain wide delegation, select Manage Domain Wide Delegation

   2. Find the API Client identified by your service account Client ID

   3. Add the following to OAuth Scopes:

      [<https://www.googleapis.com/auth/verifiedaccess>](<https://www.googleapis.com/auth/verifiedaccess>)