Bored Room

Setup › Google service account

Set up a Google service account

A service account is a robot Google user: it has an email address, no inbox, and costs nothing. You share each room with it, and every iPad reads the rooms as that robot. No person's account on the wall, no Workspace license. Done once per organization, by whoever administers your Google account. The MDM guide starts here; the Apple Configurator guide offers it as an option.

Print this page with ⌘P (Mac) or Ctrl+P (Windows). Links print with their addresses.

What this changes in your Google organization. Show this to your security team before you start. A service account needs two settings loosened:

  1. Service account key creation is allowed in one project. Google blocks key downloads by default for Cloud organizations created since May 2024. Step 1 turns that block off for the single project you create here, not your whole organization. The key file is a long-lived credential: store it like a password and rotate it if it leaks.
  2. Secondary calendars can be shared outside your domain, organization-wide. The service account's address isn't in your domain, so Google treats it as an outsider. Step 2 sets "External sharing options for secondary calendars" to allow sharing all information. That applies to every secondary calendar in the org, not just the rooms, though nothing is shared until someone shares it.

Don't need zero-touch? Signing the iPads in with a shared Google account (like rooms@) needs neither change. If your Workspace restricts third-party apps, your admin marks Bored Room as trusted by its client ID and that's it. The by-hand and Apple Configurator guides both work that way. Service accounts earn their keep with an MDM, where the key is pushed to every iPad and nobody touches a screen.

You'll need a Mac or PC and a Google Workspace super admin login. The rooms must already exist in Google (Admin console › Directory › Buildings and resources; the by-hand guide, section A, has the clicks).

1. Create the service account and download its key

  1. Go to console.cloud.google.com and sign in as the admin. Agree to the terms if asked. Skip billing if asked; nothing here costs money.
  2. At the top, click the project picker (it may say "Select a project") › New project. Name it Room displays › Create. Wait a few seconds, then select it in the picker.
  3. Left menu (☰) › APIs & Services › Library. Search Google Calendar API, open it, click Enable.
  4. Left menu › IAM & Admin › Service Accounts › Create service account.
  5. Name: room-displays › Create and continue. On the next two screens click Continue and Done without filling anything in.
  6. You're back at the list. Copy the account's email (like room-displays@room-displays-123456.iam.gserviceaccount.com); you need it in step 3.
  7. On that account's row, click the three dots (⋮) under Actions › Manage keys › Add key › Create new key › JSON › Create. A file named like room-displays-123456-abc123.json downloads. Google won't let you download it again, so keep it.

"Service account key creation is disabled"? Normal. Google blocks key downloads by default for Google Cloud organizations created since May 2024. You turn the block off for this one project:

1. Left menu › IAM & Admin › Organization Policies. Check that Room displays is selected in the picker at the top.
2. Filter for key creation. You'll see two policies, both named Disable service account key creation: one with ID iam.managed.disableServiceAccountKeyCreation (type Managed) and one with ID iam.disableServiceAccountKeyCreation (type Managed (Legacy)). Both have to be off.
3. Open the first › Manage policy › Override parent's policy › Add a rule › Enforcement Off › Done › Set policy.
4. Go back to the list and do the same for the second.
5. Both rows should now show Inactive. Wait about ten minutes for Google to apply it, reload the Keys page, and try step 7 again.

If Manage policy is greyed out, your account needs the Organization Policy Administrator role: IAM & Admin › IAM, switch the picker from the project to your organization, edit your account, and add that role.

That file is a password. Anyone who has it can read the rooms you share. Keep it with your other IT passwords. If it leaks, delete it on the Keys tab and create a new one. It also resets a forgotten PIN on the iPad.

2. Allow sharing rooms with it

To Google, the service account is "outside your company", so one setting has to allow sharing with it.

  1. admin.google.com › Apps › Google Workspace › Calendar › Sharing settings, then scroll to the General settings card.
  2. Open External sharing options for secondary calendars (room calendars follow this one, not the primary-calendar setting above it). Choose Share all information, but outsiders cannot change calendars, or Share all information, and outsiders can change calendars if people should be able to book the room from the iPad.
  3. Save. It usually applies within minutes; Google says up to 24 hours. If step 3 only offers free/busy, it hasn't applied yet.

3. Share each room with the service account

  1. calendar.google.com, signed in as the admin.
  2. Find the room on the left under Other calendars. If it isn't there: + next to Other calendars › Browse resources › your building › tick the room.
  3. Hover over the room › three dots (⋮) › Settings and sharing.
  4. Under Shared with, click Add people and groups. A box titled Share with specific people opens.
  5. Paste the service account's email. Under Permissions pick one:
    • See event details: the board only. The usual choice.
    • Make changes and see all event details: the board plus booking from the door. Needs the "can change calendars" option in step 2.
    Leave the others alone: "See only free/busy" hides every title, and "Make changes and manage sharing" isn't offered for outside accounts. Click Send.
  6. Do the same for each room. Same email every time.

4. Collect each room's calendar ID

Google doesn't add a shared room to a service account's room list on its own, so each room is added once by its ID. After that, every iPad using the same key file sees it.

  1. Still in the room's Settings and sharing, scroll to Integrate calendar.
  2. Copy the Calendar ID, like c_18868…@resource.calendar.google.com.
  3. Keep a list: room name and calendar ID. With an MDM you push the ID; without one you paste it on the first iPad for that room.

Checklist

Back to the Apple Configurator guide or the MDM guide.

On the iPad, without an MDM

  1. Get the key file onto the iPad: AirDrop it from a Mac and accept it; it lands in the Files app.
  2. Open Bored Room › Use a service account › Choose key file › find the .json in Files › tap it.
  3. If the room isn't listed, paste its calendar ID into Add a room by its calendar ID › Add. To get the ID onto the iPad: copy it on a Mac signed into the same Apple Account and paste on the iPad (Universal Clipboard), or AirDrop a text file with the ID and copy it from Files.
  4. Pick the room › Continue › name › PIN › hours › Finish.

If something's off

Stuck? Email boredroom@bacstech.io, or book a free setup session.