Log di esempio per l'integrazione dell'applicazione OAuth di Workforce Identity Federation
Mantieni tutto organizzato con le raccolte
Salva e classifica i contenuti in base alle tue preferenze.
Questa pagina fornisce esempi di audit log generati quando utilizzi
l'integrazione dell'applicazione OAuth di Workforce Identity Federation. Con
l'integrazione delle applicazioni OAuth di Workforce Identity Federation, puoi consentire alle applicazioni di terze parti di integrarsi con Google Cloud tramite OAuth e
utilizzare le identità esterne per accedere Google Cloud alle risorse.
Ciascuno dei seguenti esempi mostra solo i campi più pertinenti nelle voci del log.
[[["Facile da capire","easyToUnderstand","thumb-up"],["Il problema è stato risolto","solvedMyProblem","thumb-up"],["Altra","otherUp","thumb-up"]],[["Difficile da capire","hardToUnderstand","thumb-down"],["Informazioni o codice di esempio errati","incorrectInformationOrSampleCode","thumb-down"],["Mancano le informazioni o gli esempi di cui ho bisogno","missingTheInformationSamplesINeed","thumb-down"],["Problema di traduzione","translationIssue","thumb-down"],["Altra","otherDown","thumb-down"]],["Ultimo aggiornamento 2025-08-21 UTC."],[[["\u003cp\u003eThis page provides examples of audit logs generated when using Workforce Identity Federation OAuth application integration to allow third-party apps to access Google Cloud resources via external identities.\u003c/p\u003e\n"],["\u003cp\u003eAudit logs are generated when creating and managing OAuth clients, which requires enabling Data Access audit logs for the Identity and Access Management API and the "ADMIN_READ" log type.\u003c/p\u003e\n"],["\u003cp\u003eThe provided log examples showcase the most relevant fields, including project number, principal email, OAuth client ID, and OAuth client credential ID, which are useful for filtering logs.\u003c/p\u003e\n"],["\u003cp\u003eOne example illustrates the log format when creating an OAuth client, while another showcases the log format when creating an OAuth client credential.\u003c/p\u003e\n"]]],[],null,["# Example logs for Workforce Identity Federation OAuth application integration\n\nThis page provides examples of the audit logs that are generated when you use\n[Workforce Identity Federation OAuth application integration](/iam/docs/workforce-oauth-app). With\nWorkforce Identity Federation OAuth application integration, you can allow\nthird-party applications to integrate with Google Cloud through OAuth and\nuse external identities to access Google Cloud resources.\n\nEach of the following examples shows only the most relevant fields in the log entries.\n\nFor more information about enabling and viewing audit logs, see\n[Identity and Access Management audit logging](/iam/docs/audit-logging).\n\nRequired roles\n--------------\n\nIAM can generate audit logs when you create and manage\nOAuth clients. To enable audit logs when managing OAuth clients, you must\n[enable audit logs for Data Access activity](/iam/docs/audit-logging#enabling_audit_logging) for the\nfollowing API:\n\n- Identity and Access Management API (enable log type \"ADMIN_READ\")\n\nLogs for creating an OAuth client\n---------------------------------\n\nThe log entry is similar to the following: \n\n```json\n{\n \"logName\": \"projects/\u003cvar translate=\"no\"\u003ePROJECT_NUMBER\u003c/var\u003e/logs/cloudaudit.googleapis.com%2Factivity\",\n \"protoPayload\": {\n \"@type\": \"type.googleapis.com/google.cloud.audit.AuditLog\",\n \"authenticationInfo\": {\n \"principalEmail\": \u003cvar translate=\"no\"\u003e\u003cspan class=\"devsite-syntax-err\"\u003ePRINCIPAL_EMAIL\u003c/span\u003e\u003c/var\u003e,\n },\n \"methodName\": \"google.iam.admin.v1.OauthClients.CreateOauthClient\",\n \"resourceName\": \"projects/\u003cvar translate=\"no\"\u003ePROJECT_NUMBER\u003c/var\u003e/locations/global\",\n \"serviceName\": \"iam.googleapis.com\",\n \"request\": {\n \"@type\": \"type.googleapis.com/google.iam.admin.v1.CreateOauthClientRequest\",\n \"oauthClient\": {},\n \"oauthClientId\": \u003cvar translate=\"no\"\u003e\u003cspan class=\"devsite-syntax-err\"\u003eOAUTH_CLIENT_ID\u003c/span\u003e\u003c/var\u003e,\n \"parent\": \"projects/\u003cvar translate=\"no\"\u003ePROJECT_NUMBER\u003c/var\u003e/locations/global\"\n }\n },\n \"resource\": {\n \"type\": \"audited_resource\"\n }\n}\n```\n\nThis log entry includes the following values, which you can use to filter logs:\n\n- \u003cvar translate=\"no\"\u003ePROJECT_NUMBER\u003c/var\u003e: the project number of the project that contains the OAuth application integration.\n\n- \u003cvar translate=\"no\"\u003ePRINCIPAL_EMAIL\u003c/var\u003e: the email address of the principal that owns the OAuth client.\n\n- \u003cvar translate=\"no\"\u003eOAUTH_CLIENT_ID\u003c/var\u003e: the identity of the OAuth client\n\nLogs for creating an OAuth client credential\n--------------------------------------------\n\nThe log entry is similar to the following: \n\n```json\n{\n \"logName\": \"projects/\u003cvar translate=\"no\"\u003ePROJECT_NUMBER\u003c/var\u003e/logs/cloudaudit.googleapis.com%2Factivity\",\n \"protoPayload\": {\n \"@type\": \"type.googleapis.com/google.cloud.audit.AuditLog\",\n \"authenticationInfo\": {\n \"principalEmail\": \u003cvar translate=\"no\"\u003e\u003cspan class=\"devsite-syntax-err\"\u003ePRINCIPAL_EMAIL\u003c/span\u003e\u003c/var\u003e,\n },\n \"methodName\": \"google.iam.admin.v1.OauthClients.CreateOauthClientCredential\",\n \"resourceName\": \"projects/\u003cvar translate=\"no\"\u003ePROJECT_NUMBER\u003c/var\u003e/locations/global/oauthClients/\u003cvar translate=\"no\"\u003eOAUTH_CLIENT_ID\u003c/var\u003e\",\n \"serviceName\": \"iam.googleapis.com\",\n \"request\": {\n \"@type\": \"type.googleapis.com/google.iam.admin.v1.CreateOauthClientCredentialRequest\",\n \"oauthClientCredential\": {},\n \"oauthClientCredentialId\": \u003cvar translate=\"no\"\u003e\u003cspan class=\"devsite-syntax-err\"\u003eOAUTH_CLIENT_CREDENTIAL_ID\u003c/span\u003e\u003c/var\u003e,\n \"parent\": \"projects/\u003cvar translate=\"no\"\u003ePROJECT_NUMBER\u003c/var\u003e/locations/global/oauthClients/\u003cvar translate=\"no\"\u003eOAUTH_CLIENT_ID\u003c/var\u003e\"\n }\n },\n \"resource\": {\n \"type\": \"audited_resource\"\n }\n}\n```\n\nThis log entry includes the following values, which you can use to filter logs:\n\n- \u003cvar translate=\"no\"\u003ePROJECT_NUMBER\u003c/var\u003e: the project number of the project that contains the OAuth application integration.\n\n- \u003cvar translate=\"no\"\u003ePRINCIPAL_EMAIL\u003c/var\u003e: the email address of the principal that (owns\\|accessed) the OAuth client.\n\n- \u003cvar translate=\"no\"\u003eOAUTH_CLIENT_ID\u003c/var\u003e: the identity of the OAuth client\n\n- \u003cvar translate=\"no\"\u003eOAUTH_CLIENT_CREDENTIAL_ID\u003c/var\u003e: the identity of the OAuth client credential\n\nWhat's next\n-----------\n\n- [Configure and view the audit logs](/iam/docs/audit-logging) for IAM.\n- Get more information about [Cloud Audit Logs](/logging/docs/audit).\n- Set up [Workforce OAuth application integration](/iam/docs/workforce-oauth-app) using OAuth clients."]]
