Exemples de journaux pour l'intégration d'applications OAuth de la fédération des identités des employés
Restez organisé à l'aide des collections
Enregistrez et classez les contenus selon vos préférences.
Cette page fournit des exemples de journaux d'audit générés lorsque vous utilisez l'intégration d'applications OAuth avec la fédération d'identités des employés. Grâce à l'intégration d'applications OAuth de la fédération des identités des employés, vous pouvez autoriser les applications tierces à s'intégrer à Google Cloud via OAuth et à utiliser des identités externes pour accéder aux ressources Google Cloud .
Chacun des exemples suivants n'affiche que les champs les plus pertinents des entrées de journal.
Cloud IAM peut générer des journaux d'audit lorsque vous créez et gérez des clients OAuth. Pour activer les journaux d'audit lors de la gestion des clients OAuth, vous devez activer les journaux d'audit pour l'accès aux données pour l'API suivante:
API Identity and Access Management (activer le type de journal "ADMIN_READ")
Sauf indication contraire, le contenu de cette page est régi par une licence Creative Commons Attribution 4.0, et les échantillons de code sont régis par une licence Apache 2.0. Pour en savoir plus, consultez les Règles du site Google Developers. Java est une marque déposée d'Oracle et/ou de ses sociétés affiliées.
Dernière mise à jour le 2025/09/04 (UTC).
[[["Facile à comprendre","easyToUnderstand","thumb-up"],["J'ai pu résoudre mon problème","solvedMyProblem","thumb-up"],["Autre","otherUp","thumb-up"]],[["Difficile à comprendre","hardToUnderstand","thumb-down"],["Informations ou exemple de code incorrects","incorrectInformationOrSampleCode","thumb-down"],["Il n'y a pas l'information/les exemples dont j'ai besoin","missingTheInformationSamplesINeed","thumb-down"],["Problème de traduction","translationIssue","thumb-down"],["Autre","otherDown","thumb-down"]],["Dernière mise à jour le 2025/09/04 (UTC)."],[[["\u003cp\u003eThis page provides examples of audit logs generated when using Workforce Identity Federation OAuth application integration to allow third-party apps to access Google Cloud resources via external identities.\u003c/p\u003e\n"],["\u003cp\u003eAudit logs are generated when creating and managing OAuth clients, which requires enabling Data Access audit logs for the Identity and Access Management API and the "ADMIN_READ" log type.\u003c/p\u003e\n"],["\u003cp\u003eThe provided log examples showcase the most relevant fields, including project number, principal email, OAuth client ID, and OAuth client credential ID, which are useful for filtering logs.\u003c/p\u003e\n"],["\u003cp\u003eOne example illustrates the log format when creating an OAuth client, while another showcases the log format when creating an OAuth client credential.\u003c/p\u003e\n"]]],[],null,["# Example logs for Workforce Identity Federation OAuth application integration\n\nThis page provides examples of the audit logs that are generated when you use\n[Workforce Identity Federation OAuth application integration](/iam/docs/workforce-oauth-app). With\nWorkforce Identity Federation OAuth application integration, you can allow\nthird-party applications to integrate with Google Cloud through OAuth and\nuse external identities to access Google Cloud resources.\n\nEach of the following examples shows only the most relevant fields in the log entries.\n\nFor more information about enabling and viewing audit logs, see\n[Identity and Access Management audit logging](/iam/docs/audit-logging).\n\nRequired roles\n--------------\n\nIAM can generate audit logs when you create and manage\nOAuth clients. To enable audit logs when managing OAuth clients, you must\n[enable audit logs for Data Access activity](/iam/docs/audit-logging#enabling_audit_logging) for the\nfollowing API:\n\n- Identity and Access Management API (enable log type \"ADMIN_READ\")\n\nLogs for creating an OAuth client\n---------------------------------\n\nThe log entry is similar to the following: \n\n```json\n{\n \"logName\": \"projects/\u003cvar translate=\"no\"\u003ePROJECT_NUMBER\u003c/var\u003e/logs/cloudaudit.googleapis.com%2Factivity\",\n \"protoPayload\": {\n \"@type\": \"type.googleapis.com/google.cloud.audit.AuditLog\",\n \"authenticationInfo\": {\n \"principalEmail\": \u003cvar translate=\"no\"\u003e\u003cspan class=\"devsite-syntax-err\"\u003ePRINCIPAL_EMAIL\u003c/span\u003e\u003c/var\u003e,\n },\n \"methodName\": \"google.iam.admin.v1.OauthClients.CreateOauthClient\",\n \"resourceName\": \"projects/\u003cvar translate=\"no\"\u003ePROJECT_NUMBER\u003c/var\u003e/locations/global\",\n \"serviceName\": \"iam.googleapis.com\",\n \"request\": {\n \"@type\": \"type.googleapis.com/google.iam.admin.v1.CreateOauthClientRequest\",\n \"oauthClient\": {},\n \"oauthClientId\": \u003cvar translate=\"no\"\u003e\u003cspan class=\"devsite-syntax-err\"\u003eOAUTH_CLIENT_ID\u003c/span\u003e\u003c/var\u003e,\n \"parent\": \"projects/\u003cvar translate=\"no\"\u003ePROJECT_NUMBER\u003c/var\u003e/locations/global\"\n }\n },\n \"resource\": {\n \"type\": \"audited_resource\"\n }\n}\n```\n\nThis log entry includes the following values, which you can use to filter logs:\n\n- \u003cvar translate=\"no\"\u003ePROJECT_NUMBER\u003c/var\u003e: the project number of the project that contains the OAuth application integration.\n\n- \u003cvar translate=\"no\"\u003ePRINCIPAL_EMAIL\u003c/var\u003e: the email address of the principal that owns the OAuth client.\n\n- \u003cvar translate=\"no\"\u003eOAUTH_CLIENT_ID\u003c/var\u003e: the identity of the OAuth client\n\nLogs for creating an OAuth client credential\n--------------------------------------------\n\nThe log entry is similar to the following: \n\n```json\n{\n \"logName\": \"projects/\u003cvar translate=\"no\"\u003ePROJECT_NUMBER\u003c/var\u003e/logs/cloudaudit.googleapis.com%2Factivity\",\n \"protoPayload\": {\n \"@type\": \"type.googleapis.com/google.cloud.audit.AuditLog\",\n \"authenticationInfo\": {\n \"principalEmail\": \u003cvar translate=\"no\"\u003e\u003cspan class=\"devsite-syntax-err\"\u003ePRINCIPAL_EMAIL\u003c/span\u003e\u003c/var\u003e,\n },\n \"methodName\": \"google.iam.admin.v1.OauthClients.CreateOauthClientCredential\",\n \"resourceName\": \"projects/\u003cvar translate=\"no\"\u003ePROJECT_NUMBER\u003c/var\u003e/locations/global/oauthClients/\u003cvar translate=\"no\"\u003eOAUTH_CLIENT_ID\u003c/var\u003e\",\n \"serviceName\": \"iam.googleapis.com\",\n \"request\": {\n \"@type\": \"type.googleapis.com/google.iam.admin.v1.CreateOauthClientCredentialRequest\",\n \"oauthClientCredential\": {},\n \"oauthClientCredentialId\": \u003cvar translate=\"no\"\u003e\u003cspan class=\"devsite-syntax-err\"\u003eOAUTH_CLIENT_CREDENTIAL_ID\u003c/span\u003e\u003c/var\u003e,\n \"parent\": \"projects/\u003cvar translate=\"no\"\u003ePROJECT_NUMBER\u003c/var\u003e/locations/global/oauthClients/\u003cvar translate=\"no\"\u003eOAUTH_CLIENT_ID\u003c/var\u003e\"\n }\n },\n \"resource\": {\n \"type\": \"audited_resource\"\n }\n}\n```\n\nThis log entry includes the following values, which you can use to filter logs:\n\n- \u003cvar translate=\"no\"\u003ePROJECT_NUMBER\u003c/var\u003e: the project number of the project that contains the OAuth application integration.\n\n- \u003cvar translate=\"no\"\u003ePRINCIPAL_EMAIL\u003c/var\u003e: the email address of the principal that (owns\\|accessed) the OAuth client.\n\n- \u003cvar translate=\"no\"\u003eOAUTH_CLIENT_ID\u003c/var\u003e: the identity of the OAuth client\n\n- \u003cvar translate=\"no\"\u003eOAUTH_CLIENT_CREDENTIAL_ID\u003c/var\u003e: the identity of the OAuth client credential\n\nWhat's next\n-----------\n\n- [Configure and view the audit logs](/iam/docs/audit-logging) for IAM.\n- Get more information about [Cloud Audit Logs](/logging/docs/audit).\n- Set up [Workforce OAuth application integration](/iam/docs/workforce-oauth-app) using OAuth clients."]]
