Manage workforce identity pool providers

This guide describes how you can perform common operations withWorkforce Identity Federation. To set up Workforce Identity Federation, see thefollowing guides:

Before you begin

  1. You must have a Google Cloud organization set up.

  2. Install the Google Cloud CLI. After installation,initialize the Google Cloud CLI by running the following command:

    gcloudinit

    If you're using an external identity provider (IdP), you must first sign in to the gcloud CLI with your federated identity.

    Note: If you installed the gcloud CLI previously, make sure you have the latest version by runninggcloud components update.

Manage pools

This section shows you how to manage workforce identity pools.

Create a pool

To create a workforce pool, execute the following command:

gcloud

To create the workforce identity pool, run the following command:

gcloudiamworkforce-poolscreateWORKFORCE_POOL_ID\--organization=ORGANIZATION_ID\--display-name="DISPLAY_NAME"\--description="DESCRIPTION"\--session-duration=SESSION_DURATION\--location=global

Replace the following:

  • WORKFORCE_POOL_ID: an ID that you choose to representyour Google Cloud workforce pool. For information on formatting the ID,see theQuery parameterssection in the API documentation.
  • ORGANIZATION_ID: the numeric organization ID ofyour Google Cloud organization for the workforce identity pool.Workforce identity pools are available across all projects andfolders in the organization.
  • DISPLAY_NAME: Optional. A display name for yourworkforce identity pool.
  • DESCRIPTION: Optional. A workforce identity pooldescription.
  • SESSION_DURATION: Optional. The session duration,expressed as a number appended withs—for example,3600s. Sessionduration determines how long the Google Cloud access tokens,console (federated)sign-in sessions, and gcloud CLI sign-in sessions from thisworkforce pool are valid. Session duration defaults to one hour (3600s). Thesession duration value must be between 15 minutes (900s) and 12 hours(43200s).
Tip: Rungcloud iam workforce-pools create --help to find otherparameters you can customize for this command.

Console

To create the workforce identity pool, do the following:

  1. In the Google Cloud console, go to theWorkforce Identity Poolspage:

    Go to Workforce Identity Pools

  2. Select the organization for your workforce identity pool. Workforceidentity pools are available across all projects and folders in anorganization.

  3. ClickCreate pool and do the following:

    1. In theName field, enter the display name of the pool. The pool IDis automatically derived from the name as you type, and it isdisplayed under theName field. You can update the pool ID byclickingEdit next to the pool ID.

    2. Optional: InDescription, enter a description of the pool.

    3. To create the workforce identity pool, clickNext.

The workforce identity pool's session duration defaults to one hour (3600s).The session duration determines how long the Google Cloud access tokens,console (federated),and gcloud CLI sign-in sessions from this workforce poolare valid. After you create the pool, you canupdate the pool to seta custom session duration. The session duration must be from 15minutes (900s) to 12 hours (43200s).

Describe a pool

gcloud

To describe a specific workforce pool using the gcloud CLI, executethe following command:

gcloudiamworkforce-poolsdescribeWORKFORCE_POOL_ID\--location=global

ReplaceWORKFORCE_POOL_ID with the workforce pool IDthat you chose when you created the pool.

Console

To describe a specific workforce pool using the Google Cloud console,do the following:

  1. Go to theWorkforce Identity Pools page:

    Go to Workforce Identity Pools

  2. InWorkforce pools, select the pool

List pools

gcloud

To list the workforce pools in the organization, execute the following command:

gcloudiamworkforce-poolslist\--organization=ORGANIZATION_ID\--location=global

ReplaceORGANIZATION_ID with your organization ID.

Console

To list workforce pools using the Google Cloud console, do the following:

  1. Go to theWorkforce Identity Pools page:

    Go to Workforce Identity Pools

  2. In the table, view the list of pools.

Update a pool

gcloud

To update a specific workforce pool, execute the following command:

gcloudiamworkforce-poolsupdateWORKFORCE_POOL_ID\--description=DESCRIPTION\--location=global

Replace the following:

  • WORKFORCE_POOL_ID: the workforce pool ID
  • DESCRIPTION: the description of the pool

Console

To update a specific workforce pool using the Google Cloud console,do the following:

  1. Go to theWorkforce Identity Pools page:

    Go to Workforce Identity Pools

  2. In the table, select the pool.

  3. Update the pool parameters.

  4. ClickSave Pool.

Delete a pool

gcloud

To delete a workforce identity pool, execute the following command:

gcloudiamworkforce-poolsdeleteWORKFORCE_POOL_ID\--location=global

ReplaceWORKFORCE_POOL_ID with the workforce pool ID.

Console

To delete a specific workforce pool using the Google Cloud console,do the following:

  1. Go to theWorkforce Identity Pools page:

    Go to Workforce Identity Pools

  2. InWorkforce pools, clickDelete on the pool you want to delete.

  3. Follow additional instructions.

Undelete a pool

You can undelete a workforce identity pool that was deleted within the last 30days.

To undelete a pool, execute the following command:

gcloudiamworkforce-poolsundeleteWORKFORCE_POOL_ID\--location=global

ReplaceWORKFORCE_POOL_ID with the workforce pool ID.

Configure a provider within the workforce pool

This section explains how you can usegcloud commands to configure workforceidentity pool providers:

Create an OIDC provider

This section describes how to create a workforce identity pool provider for anOIDC IdP.

gcloud

Code flow

To create an OIDC provider that usesauthorization code flow for web sign-in, run thefollowing command:

gcloud iam workforce-pools providers create-oidcWORKFORCE_PROVIDER_ID \    --workforce-pool=WORKFORCE_POOL_ID \    --display-name="DISPLAY_NAME" \    --description="DESCRIPTION" \    --issuer-uri="ISSUER_URI" \    --client-id="OIDC_CLIENT_ID" \
    --client-secret-value="OIDC_CLIENT_SECRET" \    --web-sso-response-type="code" \    --web-sso-assertion-claims-behavior="merge-user-info-over-id-token-claims" \    --web-sso-additional-scopes="WEB_SSO_ADDITIONAL_SCOPES" \    --attribute-mapping="ATTRIBUTE_MAPPING" \    --attribute-condition="ATTRIBUTE_CONDITION" \    --jwk-json-path="JWK_JSON_PATH" \    --detailed-audit-logging \    --location=global

Replace the following:

  • WORKFORCE_PROVIDER_ID: A unique workforce identity pool provider ID. The prefixgcp- is reserved and can't be used in a workforce identity pool or workforce identity pool provider ID.
  • WORKFORCE_POOL_ID: The workforce identity pool ID to connect your IdP to.
  • DISPLAY_NAME: An optional user-friendly display name for the provider; for example,idp-eu-employees.
  • DESCRIPTION: An optional workforce provider description; for example,IdP for Partner Example Organization employees.
  • ISSUER_URI: The OIDC issuer URI, in a valid URI format, that starts withhttps; for example,https://example.com/oidc. Note: For security reasons,ISSUER_URI must use the HTTPS scheme.
  • OIDC_CLIENT_ID: The OIDC client ID that is registered with your OIDC IdP; the ID must match theaud claim of the JWT that is issued by your IdP.
  • OIDC_CLIENT_SECRET: The OIDC client secret.
  • WEB_SSO_ADDITIONAL_SCOPES: Optional additional scopes to send to the OIDC IdP for console (federated) or gcloud CLI browser-based sign-in.
  • ATTRIBUTE_MAPPING: Anattribute mapping. The following is an example of an attribute mapping:
    google.subject=assertion.sub,google.groups=assertion.groups,attribute.costcenter=assertion.costcenter
    This example maps the IdP attributessubject,groups, andcostcenter in the OIDCassertion togoogle.subject,google.groups,andattribute.costcenter attributes, respectively.
  • ATTRIBUTE_CONDITION: Anattribute condition; for example,assertion.role == 'gcp-users'. This example condition ensures that only users with the rolegcp-users can sign in using this provider.Warning: If your multi-tenant IdP has a single issuer URI, you must useattribute conditions to ensure that access is restricted to the correct tenant. For more information, seeUse attribute conditions when federating with GitHub or other multi-tenant identity providers.
  • JWK_JSON_PATH: An optional path to alocally uploaded OIDC JWKs. If this parameter isn't supplied, Google Cloud instead uses your IdP's/.well-known/openid-configuration path to source the JWKs containing the public keys. For more information about locally uploaded OIDC JWKs, seemanage OIDC JWKs.Note: Local OIDC JWKs can be uploaded throughimplicit flow or code flow, but can only be used inprogrammatic flow, in which you directly call the STS/token endpoint with a credential from the third-party IdP to exchange for a Google Cloud access token for your workforce pool. You can't use local OIDC JWKs when signing in to the console (federated).

  • Workforce Identity Federationdetailed audit logging logs information received from your IdP to Logging. Detailed audit logging can help you troubleshoot your workforce identity pool provider configuration. To learn how to troubleshoot attribute mapping errors with detailed audit logging, seeGeneral attribute mapping errors. To learn about Logging pricing, seeGoogle Cloud Observability pricing.

    To disable detailed audit logging for a workforce identity pool provider, omit the--detailed-audit-logging flag when you rungcloud iam workforce-pools providers create. To disable detailed audit logging, you can alsoupdate the provider.

In the command response,POOL_RESOURCE_NAME is the name of the pool;for example,locations/global/workforcePools/enterprise-example-organization-employees.

Implicit flow

To create an OIDC workforce identity pool provider that uses theimplicit flowfor web sign-in, run the following command:

gcloud iam workforce-pools providers create-oidcWORKFORCE_PROVIDER_ID \    --workforce-pool=WORKFORCE_POOL_ID \    --display-name="DISPLAY_NAME" \    --description="DESCRIPTION" \    --issuer-uri="ISSUER_URI" \    --client-id="OIDC_CLIENT_ID" \    --web-sso-response-type="id-token" \    --web-sso-assertion-claims-behavior="only-id-token-claims" \    --web-sso-additional-scopes="WEB_SSO_ADDITIONAL_SCOPES" \    --attribute-mapping="ATTRIBUTE_MAPPING" \    --attribute-condition="ATTRIBUTE_CONDITION" \    --jwk-json-path="JWK_JSON_PATH" \    --detailed-audit-logging \    --location=global

Replace the following:

  • WORKFORCE_PROVIDER_ID: A unique workforce identity pool provider ID. The prefixgcp- is reserved and can't be used in a workforce identity pool or workforce identity pool provider ID.
  • WORKFORCE_POOL_ID: The workforce identity pool ID to connect your IdP to.
  • DISPLAY_NAME: An optional user-friendly display name for the provider; for example,idp-eu-employees.
  • DESCRIPTION: An optional workforce provider description; for example,IdP for Partner Example Organization employees.
  • ISSUER_URI: The OIDC issuer URI, in a valid URI format, that starts withhttps; for example,https://example.com/oidc. Note: For security reasons,ISSUER_URI must use the HTTPS scheme.
  • OIDC_CLIENT_ID: The OIDC client ID that is registered with your OIDC IdP; the ID must match theaud claim of the JWT that is issued by your IdP.
  • WEB_SSO_ADDITIONAL_SCOPES: Optional additional scopes to send to the OIDC IdP for console (federated) or gcloud CLI browser-based sign-in.
  • ATTRIBUTE_MAPPING: Anattribute mapping. The following is an example of an attribute mapping:
    google.subject=assertion.sub,google.groups=assertion.groups,attribute.costcenter=assertion.costcenter
    This example maps the IdP attributessubject,groups, andcostcenter in the OIDCassertion togoogle.subject,google.groups,andattribute.costcenter attributes, respectively.
  • ATTRIBUTE_CONDITION: Anattribute condition; for example,assertion.role == 'gcp-users'. This example condition ensures that only users with the rolegcp-users can sign in using this provider.Warning: If your multi-tenant IdP has a single issuer URI, you must useattribute conditions to ensure that access is restricted to the correct tenant. For more information, seeUse attribute conditions when federating with GitHub or other multi-tenant identity providers.
  • JWK_JSON_PATH: An optional path to alocally uploaded OIDC JWKs. If this parameter isn't supplied, Google Cloud instead uses your IdP's/.well-known/openid-configuration path to source the JWKs containing the public keys. For more information about locally uploaded OIDC JWKs, seemanage OIDC JWKs.Note: Local OIDC JWKs can be uploaded throughimplicit flow or code flow, but can only be used inprogrammatic flow, in which you directly call the STS/token endpoint with a credential from the third-party IdP to exchange for a Google Cloud access token for your workforce pool. You can't use local OIDC JWKs when signing in to the console (federated).

  • Workforce Identity Federationdetailed audit logging logs information received from your IdP to Logging. Detailed audit logging can help you troubleshoot your workforce identity pool provider configuration. To learn how to troubleshoot attribute mapping errors with detailed audit logging, seeGeneral attribute mapping errors. To learn about Logging pricing, seeGoogle Cloud Observability pricing.

    To disable detailed audit logging for a workforce identity pool provider, omit the--detailed-audit-logging flag when you rungcloud iam workforce-pools providers create. To disable detailed audit logging, you can alsoupdate the provider.

In the command response,POOL_RESOURCE_NAME is the name of the pool;for example,locations/global/workforcePools/enterprise-example-organization-employees.

Console

Code flow

  1. In the Google Cloud console, go to theWorkforce Identity Pools page:

    Go to Workforce Identity Pools

  2. In theWorkforce Identity Pools table, select the pool for whichyou want to create the provider.

  3. In theProviders section,clickAdd Provider.

  4. In theSelect a Provider vendor list, select your IdP.

    If your IdP isn't listed, then selectGeneric Identity Provider.

  5. InSelect an authentication protocol, selectOpenID Connect (OIDC).

  6. In theCreate a provider section, do the following:

    1. InName, enter the name for the provider.
    2. InDescription, enter the description for the provider.
    3. InIssuer (URL), enter the issuer URI. The OIDC issuer URI must be in a valid URI format and start withhttps; for example,https://example.com/oidc.
    4. InClient ID, enter the OIDC client ID that is registeredwith your OIDC IdP; the ID must match theaud claim of the JWT that isissued by your IdP.

    5. To create a provider that is enabled, make sureEnable provider ison.

    6. ClickContinue.

  7. In theShare your provider information with IdP section, copy the URL.In your IdP, configure this URL as the redirect URI, which informs your IdPwhere to send the assertion token after logging in.

  8. ClickContinue.

  9. In theConfigure OIDC Web Sign-in section, do the following:

    1. In theFlow type list, selectCode.

    2. In theAssertion claims behavior list, select either of the following:

      • User info and ID token
      • Only ID token

    3. In theClient secret field, enter the client secret from your IdP.

    4. Optional: If you selectedOkta as your IdP, add any extra OIDC scopes in theAdditional scopes beyond openid, profile, and email field.

  10. ClickContinue.

  11. InConfigure provider, you can configure an attribute mappingand an attribute condition. To create anattribute mapping,do the following. You can provide either the IdP field name or aCEL-formattedexpression that returns a string.

    1. Required: InOIDC 1, enter the subject from the IdP— for example,assertion.sub.

    2. Optional: To add additional attribute mappings, do the following:

      1. ClickAdd mapping.
      2. InGooglen, wheren is a number, enter one oftheGoogle Cloud-supported keys.
      3. In the correspondingOIDCn field, enter the name of theIdP-specific field to map, in CEL format.

    3. If you selectedMicrosoft Entra ID as your IdP, you can increase the number of groups.

      1. SelectUse Extra Attributes.
      2. In theExtra Attributes Issuer URI field, enter the issuer URL.
      3. In theExtra Attributes Client ID field, enter the client ID.
      4. In theExtra Attributes Client Secret field, enter the client secret.
      5. In theExtra Attributes Type list, select an attribute type for extra attributes.
      6. In theExtra Attributes Filter field, enter a filter expression that is used when querying the Microsoft Graph API for groups.

    4. To create an attribute condition, do the following:

      Warning: If your multi-tenant IdP has a single issuer URI, you must useattribute conditions to ensure that access is restricted to the correct tenant. For more information, seeUse attribute conditions when federating with GitHub or other multi-tenant identity providers.

      1. ClickAdd condition.
      2. In theAttribute Conditions field, enter a condition inCEL format;for example,assertion.role == 'gcp-users'. This example condition ensures that only users with the rolegcp-users can sign in using this provider.

    5. To turn on detailed audit logging, inDetailed logging, click theEnable attribute value audit logging toggle.

      Workforce Identity Federationdetailed audit logging logs information received from your IdP to Logging. Detailed audit logging can help you troubleshoot your workforce identity pool provider configuration. To learn how to troubleshoot attribute mapping errors with detailed audit logging, seeGeneral attribute mapping errors. To learn about Logging pricing, seeGoogle Cloud Observability pricing.

      To disable detailed audit logging for a workforce identity pool provider, omit the--detailed-audit-logging flag when you rungcloud iam workforce-pools providers create. To disable detailed audit logging, you can alsoupdate the provider.

  12. To create the provider, clickSubmit.

Implicit flow

  1. In the Google Cloud console, go to theWorkforce Identity Pools page:

    Go to Workforce Identity Pools

  2. In theWorkforce Identity Pools table, select the pool for whichyou want to create the provider.

  3. In theProviders section,click Add Provider.

  4. In theSelect a Provider vendor list, select your IdP.

    If your IdP isn't listed, then selectGeneric Identity Provider.

  5. InSelect an authentication protocol, selectOpenID Connect (OIDC).

  6. In theCreate a provider section, do the following:

    1. InName, enter the name for the provider.
    2. InDescription, enter the description for the provider.
    3. InIssuer (URL), enter the issuer URI. The OIDC issuer URI must be in a valid URI format and start withhttps; for example,https://example.com/oidc.
    4. InClient ID, enter the OIDC client ID that is registeredwith your OIDC IdP; the ID must match theaud claim of the JWT that isissued by your IdP.
    5. To create a provider that is enabled, make sureEnable provider is on.
    6. ClickContinue.

  7. In theShare your provider information with IdP section, copy the URL.In your IdP, configure this url as the redirect URI, which informs your IdPwhere to send the assertion token after logging in.

  8. ClickContinue.

  9. In theConfigure OIDC Web Sign-in section, do the following:

    1. In theFlow type list, selectID Token.

    2. In theAssertion claims behavior list,ID token is selected.

    3. Optional: If you selectedOkta as your IdP, add any extra OIDC scopes in theAdditional scopes beyond openid, profile, and email field.

  10. ClickContinue.

  11. InConfigure provider, you can configure an attribute mappingand an attribute condition. To create anattribute mapping,do the following. You can provide either the IdP field name or aCEL-formattedexpression that returns a string.

    1. Required: InOIDC 1, enter the subject from the IdP; for example,assertion.sub.

    2. Optional: To add additional attribute mappings, do the following:

      1. ClickAdd mapping.
      2. InGooglen, wheren is a number, enter one oftheGoogle Cloud-supported keys.
      3. In the correspondingOIDCn field, enter the name of theIdP-specific field to map, in CEL format.

    3. If you selectedMicrosoft Entra ID as your IdP, you can increase the number of groups.

      1. SelectUse Extra Attributes.
      2. In theExtra Attributes Issuer URI field, enter the issuer URL.
      3. In theExtra Attributes Client ID field, enter the client ID.
      4. In theExtra Attributes Client Secret field, enter the client secret.
      5. In theExtra Attributes Type list, select an attribute type for extra attributes.
      6. In theExtra Attributes Filter field, enter a filter expression that is used when querying the Microsoft Graph API for groups.

    4. To create an attribute condition, do the following:

      Warning: If your multi-tenant IdP has a single issuer URI, you must useattribute conditions to ensure that access is restricted to the correct tenant. For more information, seeUse attribute conditions when federating with GitHub or other multi-tenant identity providers.

      1. ClickAdd condition.
      2. In theAttribute Conditions field, enter a condition inCEL format;for example,assertion.role == 'gcp-users'. This example condition ensures that only users with the rolegcp-users can sign in using this provider.

    5. To turn on detailed audit logging, inDetailed logging, click theEnable attribute value audit logging toggle.

      Workforce Identity Federationdetailed audit logging logs information received from your IdP to Logging. Detailed audit logging can help you troubleshoot your workforce identity pool provider configuration. To learn how to troubleshoot attribute mapping errors with detailed audit logging, seeGeneral attribute mapping errors. To learn about Logging pricing, seeGoogle Cloud Observability pricing.

      To disable detailed audit logging for a workforce identity pool provider, omit the--detailed-audit-logging flag when you rungcloud iam workforce-pools providers create. To disable detailed audit logging, you can alsoupdate the provider.

  12. To create the provider, clickSubmit.

Create a SAML provider

This section describes how to create a workforce identity pool provider for aSAML IdP.

gcloud

To create the provider, run the following command:

gcloudiamworkforce-poolsproviderscreate-samlWORKFORCE_PROVIDER_ID\--workforce-pool="WORKFORCE_POOL_ID"\--attribute-mapping="ATTRIBUTE_MAPPING"\--attribute-condition="ATTRIBUTE_CONDITION"\--idp-metadata-path="XML_METADATA_PATH"\--detailed-audit-logging\--location="global"

Replace the following:

  • WORKFORCE_PROVIDER_ID: the workforce provider ID
  • WORKFORCE_POOL_ID: the workforce pool ID

  • ATTRIBUTE_MAPPING: anattribute mapping;for example, to map a subject, the attribute mapping is as follows:

    google.subject=assertion.subject,google.groups=assertion.attributes['https://example.com/aliases'],attribute.department=assertion.attributes.department[0]

  • ATTRIBUTE_CONDITION: an optionalattribute condition;for example,assertion.subject.endsWith("@example.com")

  • XML_METADATA_PATH: the path to the XML-formattedmetadata file from your IdP

The prefixgcp- is reserved and can't be used in a workforce identity pool or workforce identity pool provider ID.

This command assigns the subject and department in the SAML assertion togoogle.subject andattribute.department attributes, respectively.Additionally, the attribute condition ensures that only users with asubject ending in@example.com can sign in using this workforceprovider.

Workforce Identity Federationdetailed audit logging logs information received from your IdP to Logging. Detailed audit logging can help you troubleshoot your workforce identity pool provider configuration. To learn how to troubleshoot attribute mapping errors with detailed audit logging, seeGeneral attribute mapping errors. To learn about Logging pricing, seeGoogle Cloud Observability pricing.

To disable detailed audit logging for a workforce identity pool provider, omit the--detailed-audit-logging flag when you rungcloud iam workforce-pools providers create. To disable detailed audit logging, you can alsoupdate the provider.

Console

To configure the SAML provider using the Google Cloud console, do thefollowing:

  1. In the Google Cloud console, go to theWorkforce Identity Pools page:

    Go to Workforce Identity Pools

  2. In theWorkforce Identity Pools table, select the pool for which youwant to create the provider.

  3. In theProviders section, clickAdd Provider.

  4. In theSelect a Provider vendor list, select your IdP.

    If your IdP isn't listed, then selectGeneric IdentityProvider.

  5. InSelect an authentication protocol, selectSAML.

  6. In theCreate a provider section, do the following:

    1. InName, enter a name for the provider.

    2. Optional: InDescription, enter a description for the provider.

    3. InIDP metadata file (XML), select the metadataXML file that you generated earlier in this guide.

    4. To create a provider that is enabled, make sureEnable provider is on.

    5. ClickContinue.

  7. In theShare your provider information section, copy the URLs.In your IdP, configure the first URL as the entity ID, which identifies your application to IdP.Configure the other URL as the redirect URI, which informs your IdP where to send theassertion token after logging in.

  8. ClickContinue.

  9. In theConfigure provider section, do the following:

    1. InAttribute mapping, enter a CEL expression forgoogle.subject.

    2. Optional: To enter other mappings, clickAdd mapping andenter other mappings—for example:

      google.subject=assertion.subject,google.groups=assertion.attributes['https://example.com/aliases'],attribute.costcenter=assertion.attributes.costcenter[0]
      This example maps the IdP attributesassertion.subject,assertion.attributes['https://example.com/aliases'], andassertion.attributes.costcenter[0] to the Google Cloudattributesgoogle.subject,google.groups,andgoogle.costcenter, respectively.

    3. If you selectedMicrosoft Entra ID as your IdP, you can increase the number of groups by doing the following:

      1. SelectUse Extra Attributes.
      2. In theExtra Attributes Issuer URI field, enter the issuer URL.
      3. In theExtra Attributes Client ID field, enter the client ID.
      4. In theExtra Attributes Client Secret field, enter the client secret.
      5. In theExtra Attributes Type list, select an attribute type for extra attributes.
      6. In theExtra Attributes Filter field, enter a filter expression that is used when querying the Microsoft Graph API for groups.

    4. Optional: To add an attribute condition, clickAdd conditionand enter a CEL expression representing an attribute condition. For example, to limit theipaddr attribute to a certain IP rangeyou can set the conditionassertion.attributes.ipaddr.startsWith('98.11.12.'). This example condition ensures that only users with an IP address that starts with98.11.12. can sign in using this workforce provider.

      Warning: If your multi-tenant IdP has a single issuer URI, you must useattribute conditions to ensure that access is restricted to the correct tenant. For more information, seeUse attribute conditions when federating with GitHub or other multi-tenant identity providers.

    5. ClickContinue.

    6. To turn on detailed audit logging, inDetailed logging, click theEnable attribute value audit logging toggle.

      Workforce Identity Federationdetailed audit logging logs information received from your IdP to Logging. Detailed audit logging can help you troubleshoot your workforce identity pool provider configuration. To learn how to troubleshoot attribute mapping errors with detailed audit logging, seeGeneral attribute mapping errors. To learn about Logging pricing, seeGoogle Cloud Observability pricing.

      To disable detailed audit logging for a workforce identity pool provider, omit the--detailed-audit-logging flag when you rungcloud iam workforce-pools providers create. To disable detailed audit logging, you can alsoupdate the provider.

  10. To create the provider, clickSubmit.

Describe a provider

gcloud

To describe a provider, run the following command:

gcloudiamworkforce-poolsprovidersdescribePROVIDER_ID\--workforce-pool=WORKFORCE_POOL_ID\--location=global

Replace the following:

  • PROVIDER_ID: the provider ID
  • WORKFORCE_POOL_ID: the workforce pool ID

Console

To view a provider, do the following:

  1. Go to theWorkforce Identity Pools page:

Go to Workforce Identity Pools

  1. In the table, select the pool for which you want to view the provider.

  2. In theProviders table, select the provider.

List providers

gcloud

To list providers, execute the following command:

gcloudiamworkforce-poolsproviderslist\--workforce-pool=WORKFORCE_POOL_ID\--location=global

ReplaceWORKFORCE_POOL_ID with the workforce pool ID.

Console

To view a provider, do the following:

  1. Go to theWorkforce Identity Pools page:

Go to Workforce Identity Pools

  1. In the table, select the pool for which you want to list the providers.

  2. In theProviders table you can see a list of providers.

Update a provider

gcloud

To update an OIDC provider after creation, execute the following command:

gcloudiamworkforce-poolsprovidersupdate-oidcPROVIDER_ID\--workforce-pool=WORKFORCE_POOL_ID\--description="DESCRIPTION"\--detailed-audit-logging\--location=global

Replace the following:

  • PROVIDER_ID: the provider ID
  • WORKFORCE_POOL_ID: the workforce pool ID
  • DESCRIPTION: the description
  • To enabledetailed audit logging, add the--detailed-audit-logging flag togcloud iam workforce-pools providers update. To disable detailed audit logging, add the--no-detailed-audit-logging flag to the update command.

Console

To view a provider, do the following:

  1. Go to theWorkforce Identity Pools page:

Go to Workforce Identity Pools

  1. In the table, select the pool for which you want to view the provider.

  2. In theProviders table, clickEdit.

  3. Update the provider.

  4. To save the updated provider, clickSave.

Delete a provider

To delete a provider, execute the following command:

gcloudiamworkforce-poolsprovidersdeletePROVIDER_ID\--workforce-pool=WORKFORCE_POOL_ID\--location=global

Replace the following:

  • PROVIDER_ID: the provider ID
  • WORKFORCE_POOL_ID: the workforce pool ID

Undelete a provider

To undelete a provider deleted within the last 30 days, execute the followingcommand:

gcloudiamworkforce-poolsprovidersundeletePROVIDER_ID\--workforce-pool=WORKFORCE_POOL_ID\--location=global

Replace the following:

  • PROVIDER_ID: the provider ID
  • WORKFORCE_POOL_ID: the workforce pool ID

Manage OIDC JWKs

This section shows you how to manage OIDC JWKs in workforce poolproviders.

Create a provider and upload OIDC JWKs

To create OIDC JWKs, seeJWT, JWS, JWE, JWK, and JWA Implementations.

To upload an OIDC JWK file when you create a workforce pool provider,run thegcloud iam workforce-pools providers create-oidc command with--jwk-json-path="JWK_JSON_PATH".ReplaceJWK_JSON_PATH with the path to the JWKs JSONfile.

This operation uploads the keys from the file.

Update OIDC JWKs

To update OIDC JWKs, run thegcloud iam workforce-pools providers update-oidc command with--jwk-json-path="JWK_JSON_PATH".ReplaceJWK_JSON_PATH with the path to theJWKs JSON file.

This operation replaces any existing uploaded keys with the ones in thefile.

Delete all uploaded OIDC JWKs

To delete all of the uploaded OIDC JWKs and instead use the issuer URIto fetch the keys, run thegcloud iam workforce-pools providers update-oidccommand with--jwk-json-path="JWK_JSON_PATH".ReplaceJWK_JSON_PATH with the path to an empty file.Use the--issuer-uri flag to set the issuer URI.

This operation deletes all of your existing uploaded keys.

What's next

Except as otherwise noted, the content of this page is licensed under theCreative Commons Attribution 4.0 License, and code samples are licensed under theApache 2.0 License. For details, see theGoogle Developers Site Policies. Java is a registered trademark of Oracle and/or its affiliates.

Last updated 2025-12-15 UTC.