聯合工作負載的身分反映
您可以搭配工作負載身分集區和身分反映功能使用 Certificate Authority Service，以聯盟第三方身分並取得證明該身分的憑證。
身分反映是一種特殊的憑證核發模式，可限制沒有權限的憑證要求者，只能要求具有與其憑證中身分相符的主體別名 (SAN) 的憑證。舉例來說，具有同盟第三方身分識別權杖的 Cloud Service Mesh 工作負載，或許可以要求使用對應於其網格身分識別的 SAN 憑證，但無法要求使用任何其他 SAN 憑證。
除非另有註明，否則本頁面中的內容是採用創用 CC 姓名標示 4.0 授權，程式碼範例則為阿帕契 2.0 授權。詳情請參閱《Google Developers 網站政策》。Java 是 Oracle 和/或其關聯企業的註冊商標。
上次更新時間：2025-09-04 (世界標準時間)。
[[["容易理解","easyToUnderstand","thumb-up"],["確實解決了我的問題","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["難以理解","hardToUnderstand","thumb-down"],["資訊或程式碼範例有誤","incorrectInformationOrSampleCode","thumb-down"],["缺少我需要的資訊/範例","missingTheInformationSamplesINeed","thumb-down"],["翻譯問題","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["上次更新時間：2025-09-04 (世界標準時間)。"],[[["\u003cp\u003eIdentity reflection allows federating a third-party identity to obtain a certificate that attests to that identity through the Certificate Authority Service and workload identity pools.\u003c/p\u003e\n"],["\u003cp\u003eThis process restricts certificate requesters to only request certificates with a subject alternative name (SAN) that matches their identity.\u003c/p\u003e\n"],["\u003cp\u003eIdentity reflection is especially useful for workloads, like those in Cloud Service Mesh, that use federated third-party identity tokens.\u003c/p\u003e\n"],["\u003cp\u003eYou can use Identity reflection with IAM workload identity federation to reflect third-party identities.\u003c/p\u003e\n"]]],[],null,["# Identity reflection for federated workloads\n===========================================\n\nYou can use Certificate Authority Service with [workload identity pools](/iam/docs/workload-identity-federation#pools)\nand identity reflection to federate a third-party identity and obtain a certificate\nthat attests to this identity.\n\nIdentity reflection is a special certificate issuance mode that limits an\nunprivileged certificate requester to requesting certificates with a *subject\nalternative name (SAN)* corresponding to the identity in their credential. For\nexample, an Cloud Service Mesh\nworkload with a federated third-party identity token might be able to request a\ncertificate with a SAN corresponding to its Mesh identity, but cannot request a\ncertificate with any other SAN.\n\nWhat's next\n-----------\n\n- Learn how to reflect [third-party identities](/certificate-authority-service/docs/tutorials/using-3pi-with-reflection) using IAM workload identity federation.\n- Learn more about [SPIFFE](https://spiffe.io)."]]