GCP Workforce Identity Federation configuration guide (SSO integration)-Identity as a Service(IDaaS)-阿里云帮助中心

This topic describes how Google Cloud Platform (GCP) uses Workforce Identity Federation to implement enterprise single sign-on (SSO). It covers the entire process based on the OIDC protocol, including workforce identity pool configuration, external IdP integration, temporary credential generation, and IAM permission management. This solution addresses the scenario in which enterprise users need to securely access cloud resources without maintaining separate Google accounts.

Procedure

Step 1: Configure a Google application in IDaaS

Create an OIDC application.
1. Log on to the IDaaS console, select the target IDaaS instance, and click Console in the Actions column.
2. Click Applications > Add Application > Standard Protocol to add an OIDC application.
Get the configuration parameters.
1. client_id and client_secret can be obtained from the General tab on the details page of the OIDC application.
2. Issuer URL can be obtained from the Sign-In > SSO tab in the Application Settings section.
Enter the GCP parameters. After you complete the GCP configuration, enter the following parameters.
1. Redirect URIs. To set the console access permissions for users, add the following redirect URI. Enter the address in the Sign-in Redirect URI field:
```
https://auth.cloud.google/signin-callback/locations/global/workforcePools/WORKFORCE_POOL_ID/providers/WORKFORCE_PROVIDER_ID
```
  Note
  Replace the following content:
  - WORKFORCE_POOL_ID: the ID of the workforce identity pool
  - WORKFORCE_PROVIDER_ID: the ID of the provider that you created for the workforce identity pool.
2. IDaaS Sign-In URL. After you add an identity provider in GCP, a sign-in URL is generated. For easier access, you can configure the sign-in URL in the IDaaS application so that users can sign in to the GCP console with one click by using their enterprise identities.
  1. In the IDaaS application, expand Show Advanced Settings. For SSO Implemented By, select IDaaS & Application, and copy the following sign-in URL to IDaaS Sign-In URL.
  2. After you add an identity provider in GCP, you can get the sign-in URL from the sign-in URL field of the workforce identity pool that you created.

Step 2: Create a workforce identity pool

Log on to the Google Cloud console. In the left-side navigation pane, click IAM and Admin > Workforce Identity Federation.
On the Workforce Identity Pool page, click Create Pool. The Add new workforce pool and provider configuration page opens.
Configure the basic information of the identity pool. The page indicates that the Pool ID is used as the identifier in IAM and cannot be changed later. To customize the pool ID, click the Edit link next to the pool ID.
1. Enter the identity pool name. In the Name field, enter the name of the identity pool.
2. (Optional) Enter a description. In the Description field, enter the purpose of the identity pool, such as federated identity authentication for the XX service.
3. After you complete the fields, click Next. The system creates the identity pool, which takes up to about 2 minutes.
In Select an authentication protocol, select the authentication protocol type from the drop-down list:
- OpenID Connect (OIDC)
- SAML
Note
This topic uses the OpenID Connect (OIDC) protocol as an example to describe the configuration. Select the protocol based on your actual business requirements.

Step 3: Configure the identity provider

Create a pool provider. Select OpenID Connect (OIDC) as the authentication protocol. In the Create pool provider section, fill in the fields, confirm that the Enable provider switch is turned on, and then click Continue.

Field	Remarks
Name	The full name of the identity provider, which is used to identify the authentication service provider.
Provider ID	The identity pool ID.
Note	The description of the authorization scenario. This description is displayed when you grant access permissions to a third-party identity.
Issuer	The Issuer URL in the SSO configuration of the OIDC application that you added in IDaaS.
Client ID	The unique identifier (client_id) of the OIDC application, which is used to establish a trust relationship with the identity provider.

Flow type.

Field	Remarks
Flow type	For flow type, select code.
Assertion claims behavior	For assertion claims behavior, select one of the following options: User info and ID token ID token only
Client secret	The client_secret of the OIDC application.

Configure the provider.
1. When you configure attribute mapping, specify the subject field of the IdP (such as assertion.sub) in the OIDC configuration item, or use a CEL expression that returns a string for the mapping.
  In the Detailed logging section, turn on the Enable audit logging of attribute values switch, and then click Submit to complete the provider configuration.
2. After the configuration is complete, click Confirm. Wait for the identity provider to be created. After the configuration is complete, the provider is added. The identities in this provider can access cloud resources. To make adjustments, click Modify provider to edit the provider, or disable the provider at any time.

Step 4: Grant IAM permissions to the identity provider

Go to the details page of the workforce identity pool that you created and get the IAM principal address. In Workforce Identity Federation, on the Workforce pool details page, find the IAM principal field and copy the principal identifier address that starts with principalSet://iam.googleapis.com/. This address is entered as the principal in the subsequent IAM authorization steps.
In the left-side navigation pane, go to the IAM page and click Grant Access.
1. Add a principal. Enter the IAM principal address.
2. Assign roles. Assign the corresponding roles based on your actual requirements. After the configuration is complete, click Save.

Step 5: Verify SSO

Verify on the IDaaS side.
After you complete the SSO sign-in configuration, you can initiate SSO sign-in from the IDaaS user portal.
1. Log on to the IDaaS user portal.
2. Click to access the OIDC application that you created. On the My Applications page, click the GoogleCloud application.
3. The system automatically redirects you to the Google Cloud console.
Verify on the GCP side.
1. In the left-side navigation pane, click IAM and Admin > Workforce Identity Federation.
2. Open the details page of the workforce identity pool that you created, and in the provider section click Sign-in URL.
3. The system automatically redirects you to the IDaaS portal sign-in page. After you sign in, you can access the Google Cloud console.