[[["易于理解","easyToUnderstand","thumb-up"],["解决了我的问题","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["很难理解","hardToUnderstand","thumb-down"],["信息或示例代码不正确","incorrectInformationOrSampleCode","thumb-down"],["没有我需要的信息/示例","missingTheInformationSamplesINeed","thumb-down"],["翻译问题","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["最后更新时间 (UTC)：2025-09-04。"],[],[],null,["This document and the [Token types](/docs/authentication/token-types) document\ncover the multiple tokens used by Google Cloud for authentication and\nauthorization. They're intended for people who want to learn how token-based\nauthentication works, or who want to implement authentication without using the\n[Cloud Client Libraries](/apis/docs/cloud-client-libraries).\n\nYou don't need to know this information when you interact with Google Cloud\nAPIs using the Cloud Client Libraries, the Google Cloud console, or the\nGoogle Cloud CLI---the process of selecting the right type of token, and\nobtaining and refreshing those tokens is handled automatically for you.\n\nUser authentication\n\nWhen human users interact with Google Cloud, they don't interact with\nGoogle Cloud APIs directly. Instead, they use a *client* to act on their behalf.\nThe client that they use might be a web application, a desktop application, or a\nutility like the Google Cloud CLI or `curl`.\n\nBecause the client makes requests and not the user, Google Cloud can't request\nidentity information from the user directly to check if they have permission to\nuse an API. Instead, this identity is passed to the API through the client in\nthe form of a token, which is included in each API request.\n\nA user authentication token encodes the following information:\n\n- The identity of the user.\n\n- The identity of the client.\n\n- Assurance that the client is allowed to act on behalf of the user.\n\nAuthenticating the user and authorizing the client involves the following\nparties:\n\n- A user.\n\n- A client that acts on behalf of the user.\n\n- An authorization server, which Google APIs rely on to authenticate the client.\n\n- A Google Cloud API that the client interacts with.\n\nClients can't issue tokens themselves. Instead, they must work with an\nauthorization server to do the following:\n\n1. Authenticate the user.\n\n2. Authenticate the client.\n\n3. Authorize the client to act on the user's behalf.\n\n4. Issue a token to the client.\n\nA user who authenticates by signing in to their Google Account is a\n[*user* principal](/architecture/identity/overview-google-authentication#google_identities).\nThe principal has a\n[principal identifier](/iam/docs/principal-identifiers) similar to the\nfollowing: \n\n user:alex@example.com\n\nA user who authenticates using\n[workforce identity federation](/iam/docs/workforce-identity-federation) and an\nexternal identity provider is a *workforce identity pool* principal. The\nprincipal has a principal identifier similar to the following: \n\n principal://iam.googleapis.com/locations/global/workforcePools/\u003cvar translate=\"no\"\u003ePOOL_ID\u003c/var\u003e/subject/raha@altostrat.com\n\nWorkload authentication\n\nSome clients need to interact with Google APIs on their own behalf. For example,\na scheduled job might need to read data from BigQuery or\nCloud Storage without any human user being involved.\n\nClients that act unattended and on their own behalf are referred to as\n*workloads*. Unlike user authentication, workload authentication combines\nauthenticating the user and authorizing the client into a single step. Because\nof this, a workload authentication token encodes the identity of only the\nclient.\n\nWorkload authentication and authorization involves the following parties:\n\n- A workload, acting as both a client and a user, and on its own behalf.\n\n- An authorization server, which Google APIs rely on to authenticate the client.\n\n- A Google Cloud API that the client interacts with.\n\nTo access Google Cloud APIs, clients must work with an authorization server to\ndo the following:\n\n1. Authenticate the client.\n\n2. Authorize the client.\n\n3. Issue a token to the client.\n\nAn authenticated workload is also referred to as a principal, but workloads use\ndifferent principal identifiers than users.\n\nA workload that authenticates using a service account is a\n[*service account* principal](/architecture/identity/overview-google-authentication#service_account).\nThe principal has a principal identifier similar to the following: \n\n serviceAccount:my-service-account@my-project.iam.gserviceaccount.com\n\nA workload that authenticates using\n[workload identity federation](/iam/docs/workload-identity-federation) is a\n*workload identity pool* principal. The principal has a principal identifier\nsimilar to the following: \n\n principal://iam.googleapis.com/projects/\u003cvar translate=\"no\"\u003ePROJECT_NAME\u003c/var\u003e/locations/global/workloadIdentityPools/\u003cvar translate=\"no\"\u003ePOOL_ID\u003c/var\u003e/subject/\u003cvar translate=\"no\"\u003eSUBJECT_ATTRIBUTE_VALUE\u003c/var\u003e\n\nAuthorization servers\n\nGoogle Cloud shares specific authentication and authorization facilities with\nother Google services. Shared facilities include\n[Sign in with Google](https://developers.google.com/identity/siwg), and the\n[OpenID Connect](https://developers.google.com/identity/openid-connect/openid-connect)\nand\n[OAuth 2.0](https://developers.google.com/identity/protocols/oauth2) services\nprovided by [Google Identity](https://developers.google.com/identity).\n\nOther authentication-related services, such as Workload Identity Federation and\nWorkforce Identity Federation, are specific to Google Cloud and can't be used for\nother Google services.\n\nBecause of this split, Google Cloud uses two authorization servers. One is\nshared with other Google services, and the other is specific to Google Cloud.\nThe following table describes the different servers and their properties.\n\n| Authorization server | Authentication type | Authentication APIs | Principals |\n|------------------------------------------------------------------------|-------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|\n| Google authorization server | - User authentication - Workload authentication | - [Google OAuth 2.0 API](https://developers.google.com/identity/protocols/oauth2) - [SAML](/identity-platform/docs/web/saml) | - User ([managed user](/architecture/identity/overview-google-authentication#managed_user_account)) - User ([consumer account](/architecture/identity/overview-google-authentication#consumer_account)) - [Service account](/architecture/identity/overview-google-authentication#service_account) |\n| Google Cloud Identity and Access Management (IAM) authorization server | - User authentication - Workload authentication | - [Security Token Service](/iam/docs/reference/sts/rest) (STS) API - IAM [Service Account Credentials API](/iam/docs/reference/credentials/rest) - [Metadata servers](/docs/authentication/get-id-token#metadata-server) | - [Workforce identity pool principal](/iam/docs/principals-overview#workforce) - [Workload identity pool principal](/iam/docs/principals-overview#workload) - [Service account](/architecture/identity/overview-google-authentication#service_account) |\n\nThe authorization servers are global services and can be accessed from any\n[Google Cloud region](/about/locations). However, not all regions contain\ndeployments of both authorization servers:\n\n- The Google authorization server is available in select regions.\n\n- The Google Cloud IAM authorization server is available in all regions.\n\nTo optimize reliability, use the Google Cloud IAM authorization\nserver whenever possible.\n\nWhat's next\n\nRead about [token types](/docs/authentication/token-types)."]]
