Entra ID SSO × NotebookLM 完全構成ガイド：Web UI利用とAPI従量課金の2パターン

1
2
3
4

# 1. Google Admin Consoleでドメイン検証（TXTレコードをDNSに追加）
# 確認コマンド例（社内DNS担当者向け）
nslookup -type=TXT your-company.com
# 期待値: "google-site-verification=xxxx..."

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14

<!-- gcds-config.xml の主要設定例 -->
<config>
  <!-- EntraIDをGraph API経由で参照する場合 -->
  <ldapConfig>
    <hostname>login.microsoftonline.com</hostname>
    <authType>OAUTH2</authType>
    <clientId>your-app-client-id</clientId>
  </ldapConfig>
  <!-- 同期対象OUの指定 -->
  <userConfig>
    <searchBase>DC=your-company,DC=com</searchBase>
    <query>(memberOf=CN=Google-Workspace-Users,...)</query>
  </userConfig>
</config>

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15

# GCPプロジェクトの設定
gcloud config set project YOUR_PROJECT_ID

# 必要なAPIを有効化
gcloud services enable \
  iam.googleapis.com \
  iamcredentials.googleapis.com \
  aiplatform.googleapis.com \
  sts.googleapis.com

# Workforce Identity Pool作成
gcloud iam workforce-pools create "entra-pool" \
  --location="global" \
  --display-name="Entra ID Pool" \
  --description="Microsoft Entra ID workforce pool"

1
2
3
4
5
6
7
8
9

# Workforce Identity ProviderにEntra IDを追加
gcloud iam workforce-pools providers create-oidc "entra-provider" \
  --workforce-pool="entra-pool" \
  --location="global" \
  --display-name="Microsoft Entra ID" \
  --issuer-uri="https://login.microsoftonline.com/YOUR_TENANT_ID/v2.0" \
  --client-id="YOUR_ENTRA_APP_CLIENT_ID" \
  --attribute-mapping="google.subject=assertion.sub,google.email=assertion.email,google.groups=assertion.groups" \
  --attribute-condition="assertion.tid == 'YOUR_TENANT_ID'"

 1
 2
 3
 4
 5
 6
 7
 8
 9
10

# Entra IDグループに対してVertex AIのロールを付与
# ※ グループIDはEntraのオブジェクトID
gcloud projects add-iam-policy-binding YOUR_PROJECT_ID \
  --member="principalSet://iam.googleapis.com/locations/global/workforcePools/entra-pool/group/ENTRA_GROUP_OBJECT_ID" \
  --role="roles/aiplatform.user"

# ログ閲覧権限（監査用）
gcloud projects add-iam-policy-binding YOUR_PROJECT_ID \
  --member="principalSet://iam.googleapis.com/locations/global/workforcePools/entra-pool/group/ENTRA_GROUP_OBJECT_ID" \
  --role="roles/logging.viewer"

  1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101

import google.auth
import google.auth.transport.requests
from google.oauth2 import credentials
import requests

# ===== 方法1: Application Default Credentials (ADC) を使用 =====
# Workforce Identity連携後はADCが自動的にEntraトークンを使用
# 環境変数: GOOGLE_APPLICATION_CREDENTIALS または gcloud auth login

def call_notebooklm_api_with_adc():
    """ADCを使ったNotebookLM API呼び出し"""
    creds, project = google.auth.default(
        scopes=["https://www.googleapis.com/auth/cloud-platform"]
    )
    auth_req = google.auth.transport.requests.Request()
    creds.refresh(auth_req)

    headers = {
        "Authorization": f"Bearer {creds.token}",
        "Content-Type": "application/json",
    }

    # NotebookLM API エンドポイント（Vertex AI経由）
    endpoint = f"https://notebooklm.googleapis.com/v1beta/corpora"

    response = requests.post(endpoint, headers=headers, json={
        "display_name": "社内ナレッジベース",
        "description": "製品マニュアルと技術文書",
    })
    return response.json()


# ===== 方法2: Entraトークンを直接STSでGCPトークンに交換 =====
import msal  # Microsoft Authentication Library

def get_gcp_token_from_entra():
    """EntraトークンをGCPトークンに交換する"""

    # 1. Entraでトークン取得
    app = msal.ConfidentialClientApplication(
        client_id="YOUR_ENTRA_CLIENT_ID",
        client_credential="YOUR_CLIENT_SECRET",
        authority=f"https://login.microsoftonline.com/YOUR_TENANT_ID"
    )
    entra_token_result = app.acquire_token_for_client(
        scopes=["https://graph.microsoft.com/.default"]
    )
    entra_token = entra_token_result["access_token"]

    # 2. GCP STS でトークン交換
    sts_url = "https://sts.googleapis.com/v1/token"
    sts_payload = {
        "grant_type": "urn:ietf:params:oauth:grant-type:token-exchange",
        "audience": f"//iam.googleapis.com/locations/global/workforcePools/entra-pool/providers/entra-provider",
        "subject_token_type": "urn:ietf:params:oauth:token-type:id_token",
        "subject_token": entra_token,
        "requested_token_type": "urn:ietf:params:oauth:token-type:access_token",
        "scope": "https://www.googleapis.com/auth/cloud-platform",
    }
    sts_response = requests.post(sts_url, json=sts_payload)
    gcp_token = sts_response.json()["access_token"]

    return gcp_token


# ===== NotebookLM APIの主要操作 =====
class NotebookLMClient:
    BASE_URL = "https://notebooklm.googleapis.com/v1beta"

    def __init__(self, token: str):
        self.headers = {
            "Authorization": f"Bearer {token}",
            "Content-Type": "application/json",
        }

    def create_corpus(self, name: str, description: str) -> dict:
        """ノートブック（コーパス）作成"""
        return requests.post(
            f"{self.BASE_URL}/corpora",
            headers=self.headers,
            json={"display_name": name, "description": description}
        ).json()

    def add_document(self, corpus_id: str, content: str, source_url: str = None) -> dict:
        """ドキュメント追加（ソースとして）"""
        payload = {"display_name": "document", "text_content": {"text": content}}
        if source_url:
            payload["source_url"] = source_url
        return requests.post(
            f"{self.BASE_URL}/corpora/{corpus_id}/documents",
            headers=self.headers,
            json=payload
        ).json()

    def query(self, corpus_id: str, question: str) -> dict:
        """RAGクエリ（質問への回答生成）"""
        return requests.post(
            f"{self.BASE_URL}/corpora/{corpus_id}:generateContent",
            headers=self.headers,
            json={"query": question}
        ).json()

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20

# gcloud CLIでWorkforce Identity認証を設定
gcloud config set auth/credential_file_override /path/to/workforce-credentials.json

# workforce-credentials.json の内容
cat > workforce-credentials.json << 'EOF'
{
  "type": "external_account_authorized_user",
  "audience": "//iam.googleapis.com/locations/global/workforcePools/entra-pool/providers/entra-provider",
  "subject_token_type": "urn:ietf:params:oauth:token-type:id_token",
  "token_url": "https://sts.googleapis.com/v1/token",
  "credential_source": {
    "url": "http://localhost:8888/token",
    "headers": {"Metadata-Flavor": "Google"},
    "format": {"type": "text"}
  }
}
EOF

# ブラウザでEntraログイン後にAPIアクセス可能
gcloud auth login --workforce-pool-user