Someone just asked you for “temporary access to that Ceph bucket.” Ten minutes later, you’re still copying keys into a shared doc titled something like Don’t delete this again (final). If that scene feels too familiar, it’s time to wire Ceph to Google Workspace properly and let identity policy do the heavy lifting.
Ceph is the open-source object store that ops teams trust for scale and durability. Google Workspace is the single sign-on and collaboration backbone most companies already live in. Together they can secure object access with identity instead of static credentials, if you connect them right. The payoff is faster onboarding, better audit trails, and no more wondering who kept an old key.
The logic is simple. Google Workspace handles users, roles, and group membership. Ceph handles data, buckets, and client capabilities. Integration happens where identity meets storage. You map Workspace groups to Ceph users through an identity provider that speaks SAML or OIDC, like Okta or Google Identity. Once mapped, an engineer’s Workspace login defines exactly what they can pull, push, or list inside Ceph. No local user creation needed, no key sprawl, and every event is traceable through logs tied to real accounts.
How do I connect Ceph and Google Workspace?
You do it through identity federation. Configure Ceph to trust an OIDC provider linked to your Workspace domain. Assign roles based on group attributes in Workspace. From there, Workspace acts as your source of truth, and Ceph enforces access in real time. The hardest part is deciding who should own which buckets.
A quick best practice: use short-lived tokens. Treat Ceph access like a privileged session, not a standing permission. Rotate your signing keys often and test your logout flow. If someone leaves the company, Workspace deactivation alone should instantly end their storage access. That’s real zero trust, not a slide-deck buzzword.