gcloud iam workforce-pools providers create-saml - create a new SAML workforce pool provider

gcloud iam workforce-pools providers create-saml(PROVIDER :--location=LOCATION--workforce-pool=WORKFORCE_POOL)--attribute-mapping=[KEY=VALUE,…]--idp-metadata-path=PATH_TO_FILE[--async][--attribute-condition=ATTRIBUTE_CONDITION][--description=DESCRIPTION][--detailed-audit-logging][--disabled][--display-name=DISPLAY_NAME][--scim-usage=SCIM_USAGE][--extended-attributes-client-id=EXTENDED_ATTRIBUTES_CLIENT_ID--extended-attributes-client-secret-value=EXTENDED_ATTRIBUTES_CLIENT_SECRET_VALUE--extended-attributes-issuer-uri=EXTENDED_ATTRIBUTES_ISSUER_URI--extended-attributes-type=EXTENDED_ATTRIBUTES_TYPE :--extended-attributes-filter=EXTENDED_ATTRIBUTES_FILTER][--extra-attributes-client-id=EXTRA_ATTRIBUTES_CLIENT_ID--extra-attributes-client-secret-value=EXTRA_ATTRIBUTES_CLIENT_SECRET_VALUE--extra-attributes-issuer-uri=EXTRA_ATTRIBUTES_ISSUER_URI--extra-attributes-type=EXTRA_ATTRIBUTES_TYPE :--extra-attributes-filter=EXTRA_ATTRIBUTES_FILTER][GCLOUD_WIDE_FLAG …]

Workforce pool provider resource - The workforce pool provider to create. Thearguments in this group can be used to specify the attributes of this resource.

This must be specified.

PROVIDER

ID of the workforce pool provider or fully qualified identifier for theworkforce pool provider.

To set theprovider attribute:

• provide the argumentprovider on the command line.

This positional argument must be specified if any of the other arguments in thisgroup are specified.

--location=LOCATION

The location for the workforce pool.

To set thelocation attribute:

• provide the argumentprovider on the command line with a fullyspecified name;
• provide the argument--location on the command line.

--workforce-pool=WORKFORCE_POOL

The ID to use for the workforce pool, which becomes the final component of theresource name. This value must be a globally unique string of 6 to 63 lowercaseletters, digits, or hyphens. It must start with a letter, and cannot have atrailing hyphen. The prefixgcp- is reserved for use by Google, andmay not be specified.To set theworkforce-pool attribute:

• provide the argumentprovider on the command line with a fullyspecified name;
• provide the argument--workforce-pool on the command line.

--attribute-mapping=[KEY=VALUE,…]

Maps claims from the authentication credentials issued by the Identity Providerinto Google Cloud IAM attributes, e.g. subject, segment.

Each key must be a string specifying the Google Cloud IAM attribute to beproduced.

The following predefined keys are currently supported:

• google.subject: required field that indicates the principal that isbeing authenticated to IAM, and will be logged in all API accesses for whichCloud Audit Logging is configured.

• google.groups: optional field that indicates asserted groups thatthe user should be considered to belong to. You can create IAM bindings usingthe groups attribute and access to a resource will be granted if any of thegroups asserted here match a group in the respective binding.

• google.display_name: optional field that overrides the name of theuser. If not set,google.subject will be displayed instead. Thisattribute cannot be used in IAM policies. The maximum length of this field is100 characters.

• google.profile_photo: optional fields that may be set to a validURL specifying the user's thumbnail photo. When set, the image will be visibleas the user's profile picture. If not set, a generic user icon will be displayedinstead. This attribute cannot be used in IAM policies.

Custom attributes can also be mapped by specifyingattribute.{custom_attribute}, replacing{custom_attribute} with the name of the custom attribute to bemapped. A maximum of 50 custom attribute mappings can be defined. The maximumlength of a mapped attribute key is 2048 characters and may only contain thecharacters [a-z0-9].

These attributes can then be referenced in IAM policies to define fine-grainedaccess for the workforce pool to Google Cloud resources by specifying:

• google.subject:principal://iam.googleapis.com/locations/global/workforcePools/{pool}/subject/{value}

• google.groups:principalSet://iam.googleapis.com/locations/global/workforcePools/{pool}/group/{value}

• attribute.{custom_attribute}:principalSet://iam.googleapis.com/locations/global/workforcePools/{pool}/attribute.{custom_attribute}/{value}

Each value must be aCommonExpression Language function that maps an Identity Provider credential tothe normalized attribute specified by the corresponding map key.

The following keywords may be referenced in the expressions:

• assertion: JSON representing the authentication credential issuedby the Identity Provider.

The maximum length of an attribute mapping expression is 2048 characters. Whenevaluated, the total size of all mapped attributes must not exceed 8KB.

Example: Map thesub claim of the incoming credential to thesubject Google Cloud IAM attribute.

{"google.subject":"assertion.sub"}

--idp-metadata-path=PATH_TO_FILE

XML file with configuration metadata for the SAML identity provider. Themetadata file must follow theSAML2.0 metadata specification. Use a full or relative path to a local filecontaining the value of idp_metadata_path.

--async

Return immediately, without waiting for the operation in progress to complete.

--attribute-condition=ATTRIBUTE_CONDITION

ACommon ExpressionLanguage expression, in plain text, to restrict which otherwise validauthentication credentials issued by the provider should be accepted.

The expression must output a boolean representing whether to allow thefederation.

The following keywords may be referenced in the expressions:

• assertion: JSON representing the authentication credential issuedby the Provider.
• google: The Google attributes mapped from the assertion in theattribute_mappings.google.profile_photo andgoogle.display_name are not supported.
• attribute: The custom attributes mapped from the assertion in theattribute_mappings.

The maximum length of the attribute condition expression is 4096 characters. Ifunspecified, all valid authentication credential will be accepted.

Example: Only allow credentials with a mappedgoogle.groups valueofadmins.

"'admins' in google.groups"

--description=DESCRIPTION

A description for the workforce pool provider. Cannot exceed 256 characters inlength.

--detailed-audit-logging

Enables detailed audit logging for this provider, which populates additionaldebug information in STS Cloud Audit Logs. Specify--no-detailed-audit-logging to disable it.

--disabled

Disables the workforce pool provider. You cannot use a disabled provider toperform new token exchanges or sign-ins. However, existing tokens still grantaccess. Specify--no-disabled to enable a disabled pool.

--display-name=DISPLAY_NAME

A display name for the workforce pool provider. Cannot exceed 32 characters inlength.

--scim-usage=SCIM_USAGE

Specifies whether the workforce identity pool provider uses SCIM-managed groupsinstead of thegoogle.groups attribute mapping for authorizationchecks.

Thescim_usage andextended_attributes_oauth2_clientfields are mutually exclusive. A request that enables both fields on the sameworkforce identity pool provider will produce an error.

Useenabled-for-groups to enable SCIM-managed groups. Usescim-usage-unspecified to disable SCIM-managed groups.

SCIM_USAGE must be one of:enabled-for-groups,scim-usage-unspecified.

--extended-attributes-client-id=EXTENDED_ATTRIBUTES_CLIENT_ID

The OAuth 2.0 client ID for retrieving extended attributes from the identityprovider. Required to get extended group memberships for a subset of GoogleCloud products.

--extended-attributes-client-secret-value=EXTENDED_ATTRIBUTES_CLIENT_SECRET_VALUE

The OAuth 2.0 client secret for retrieving extended attributes from the identityprovider. Required to get extended group memberships for a subset of GoogleCloud products.

--extended-attributes-issuer-uri=EXTENDED_ATTRIBUTES_ISSUER_URI

OIDC identity provider's issuer URI. Must be a valid URI using thehttps scheme. Required to get the OIDC discovery document.

--extended-attributes-type=EXTENDED_ATTRIBUTES_TYPE

Represents the identity provider and type of claims that should be fetched.EXTENDED_ATTRIBUTES_TYPE must be (only one value issupported):azure-ad-groups-id.

--extended-attributes-filter=EXTENDED_ATTRIBUTES_FILTER

The filter used to request specific records from the IdP. By default, all of thegroups that are associated with a user are fetched. For Microsoft Entra ID, youcan add$search query parameters using [Keyword Query Language](https://learn.microsoft.com/en-us/sharepoint/dev/general-development/keyword-query-language-kql-syntax-reference).To learn more about$search querying in Microsoft Entra ID, see[Use the$search query parameter](https://learn.microsoft.com/en-us/graph/search-query-parameter).

Additionally, Workforce Identity Federation automatically adds the following[$filter query parameters](https://learn.microsoft.com/en-us/graph/filter-query-parameter), based on thevalue ofattributes_type. Values passed tofilter areconverted to$search query parameters. Additional$filter query parameters cannot be added using this field.

• AZURE_AD_GROUPS_ID:securityEnabled filter is applied.

--extra-attributes-client-id=EXTRA_ATTRIBUTES_CLIENT_ID

The OAuth 2.0 client ID for retrieving extra attributes from the identityprovider. Required to get the access token using client credentials grant flow.

--extra-attributes-client-secret-value=EXTRA_ATTRIBUTES_CLIENT_SECRET_VALUE

The OAuth 2.0 client secret for retrieving extra attributes from the identityprovider. Required to get the access token using client credentials grant flow.

--extra-attributes-issuer-uri=EXTRA_ATTRIBUTES_ISSUER_URI

OIDC identity provider's issuer URI. Must be a valid URI using thehttps scheme. Required to get the OIDC discovery document.

--extra-attributes-type=EXTRA_ATTRIBUTES_TYPE

Represents the identity provider and type of claims that should be fetched.EXTRA_ATTRIBUTES_TYPE must be one of:azure-ad-groups-mail,azure-ad-groups-id.

--extra-attributes-filter=EXTRA_ATTRIBUTES_FILTER

The filter used to request specific records from the IdP. By default, all of thegroups that are associated with a user are fetched. For Microsoft Entra ID, youcan add$search query parameters using [Keyword Query Language](https://learn.microsoft.com/en-us/sharepoint/dev/general-development/keyword-query-language-kql-syntax-reference).To learn more about$search querying in Microsoft Entra ID, see[Use the$search query parameter](https://learn.microsoft.com/en-us/graph/search-query-parameter).

Additionally, Workforce Identity Federation automatically adds the following[$filter query parameters](https://learn.microsoft.com/en-us/graph/filter-query-parameter), based on thevalue ofattributes_type. Values passed tofilter areconverted to$search query parameters. Additional$filter query parameters cannot be added using this field.

• AZURE_AD_GROUPS_MAIL:mailEnabled andsecurityEnabled filters are applied.
• AZURE_AD_GROUPS_ID:securityEnabled filter is applied.

Run$gcloud help for details.