[[["容易理解","easyToUnderstand","thumb-up"],["確實解決了我的問題","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["難以理解","hardToUnderstand","thumb-down"],["資訊或程式碼範例有誤","incorrectInformationOrSampleCode","thumb-down"],["缺少我需要的資訊/範例","missingTheInformationSamplesINeed","thumb-down"],["翻譯問題","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["上次更新時間：2025-09-04 (世界標準時間)。"],[[["\u003cp\u003eThis page provides examples of audit logs generated when using Workforce Identity Federation OAuth application integration to allow third-party apps to access Google Cloud resources via external identities.\u003c/p\u003e\n"],["\u003cp\u003eAudit logs are generated when creating and managing OAuth clients, which requires enabling Data Access audit logs for the Identity and Access Management API and the "ADMIN_READ" log type.\u003c/p\u003e\n"],["\u003cp\u003eThe provided log examples showcase the most relevant fields, including project number, principal email, OAuth client ID, and OAuth client credential ID, which are useful for filtering logs.\u003c/p\u003e\n"],["\u003cp\u003eOne example illustrates the log format when creating an OAuth client, while another showcases the log format when creating an OAuth client credential.\u003c/p\u003e\n"]]],[],null,["# Example logs for Workforce Identity Federation OAuth application integration\n\nThis page provides examples of the audit logs that are generated when you use\n[Workforce Identity Federation OAuth application integration](/iam/docs/workforce-oauth-app). With\nWorkforce Identity Federation OAuth application integration, you can allow\nthird-party applications to integrate with Google Cloud through OAuth and\nuse external identities to access Google Cloud resources.\n\nEach of the following examples shows only the most relevant fields in the log entries.\n\nFor more information about enabling and viewing audit logs, see\n[Identity and Access Management audit logging](/iam/docs/audit-logging).\n\nRequired roles\n--------------\n\nIAM can generate audit logs when you create and manage\nOAuth clients. To enable audit logs when managing OAuth clients, you must\n[enable audit logs for Data Access activity](/iam/docs/audit-logging#enabling_audit_logging) for the\nfollowing API:\n\n- Identity and Access Management API (enable log type \"ADMIN_READ\")\n\nLogs for creating an OAuth client\n---------------------------------\n\nThe log entry is similar to the following: \n\n```json\n{\n \"logName\": \"projects/\u003cvar translate=\"no\"\u003ePROJECT_NUMBER\u003c/var\u003e/logs/cloudaudit.googleapis.com%2Factivity\",\n \"protoPayload\": {\n \"@type\": \"type.googleapis.com/google.cloud.audit.AuditLog\",\n \"authenticationInfo\": {\n \"principalEmail\": \u003cvar translate=\"no\"\u003e\u003cspan class=\"devsite-syntax-err\"\u003ePRINCIPAL_EMAIL\u003c/span\u003e\u003c/var\u003e,\n },\n \"methodName\": \"google.iam.admin.v1.OauthClients.CreateOauthClient\",\n \"resourceName\": \"projects/\u003cvar translate=\"no\"\u003ePROJECT_NUMBER\u003c/var\u003e/locations/global\",\n \"serviceName\": \"iam.googleapis.com\",\n \"request\": {\n \"@type\": \"type.googleapis.com/google.iam.admin.v1.CreateOauthClientRequest\",\n \"oauthClient\": {},\n \"oauthClientId\": \u003cvar translate=\"no\"\u003e\u003cspan class=\"devsite-syntax-err\"\u003eOAUTH_CLIENT_ID\u003c/span\u003e\u003c/var\u003e,\n \"parent\": \"projects/\u003cvar translate=\"no\"\u003ePROJECT_NUMBER\u003c/var\u003e/locations/global\"\n }\n },\n \"resource\": {\n \"type\": \"audited_resource\"\n }\n}\n```\n\nThis log entry includes the following values, which you can use to filter logs:\n\n- \u003cvar translate=\"no\"\u003ePROJECT_NUMBER\u003c/var\u003e: the project number of the project that contains the OAuth application integration.\n\n- \u003cvar translate=\"no\"\u003ePRINCIPAL_EMAIL\u003c/var\u003e: the email address of the principal that owns the OAuth client.\n\n- \u003cvar translate=\"no\"\u003eOAUTH_CLIENT_ID\u003c/var\u003e: the identity of the OAuth client\n\nLogs for creating an OAuth client credential\n--------------------------------------------\n\nThe log entry is similar to the following: \n\n```json\n{\n \"logName\": \"projects/\u003cvar translate=\"no\"\u003ePROJECT_NUMBER\u003c/var\u003e/logs/cloudaudit.googleapis.com%2Factivity\",\n \"protoPayload\": {\n \"@type\": \"type.googleapis.com/google.cloud.audit.AuditLog\",\n \"authenticationInfo\": {\n \"principalEmail\": \u003cvar translate=\"no\"\u003e\u003cspan class=\"devsite-syntax-err\"\u003ePRINCIPAL_EMAIL\u003c/span\u003e\u003c/var\u003e,\n },\n \"methodName\": \"google.iam.admin.v1.OauthClients.CreateOauthClientCredential\",\n \"resourceName\": \"projects/\u003cvar translate=\"no\"\u003ePROJECT_NUMBER\u003c/var\u003e/locations/global/oauthClients/\u003cvar translate=\"no\"\u003eOAUTH_CLIENT_ID\u003c/var\u003e\",\n \"serviceName\": \"iam.googleapis.com\",\n \"request\": {\n \"@type\": \"type.googleapis.com/google.iam.admin.v1.CreateOauthClientCredentialRequest\",\n \"oauthClientCredential\": {},\n \"oauthClientCredentialId\": \u003cvar translate=\"no\"\u003e\u003cspan class=\"devsite-syntax-err\"\u003eOAUTH_CLIENT_CREDENTIAL_ID\u003c/span\u003e\u003c/var\u003e,\n \"parent\": \"projects/\u003cvar translate=\"no\"\u003ePROJECT_NUMBER\u003c/var\u003e/locations/global/oauthClients/\u003cvar translate=\"no\"\u003eOAUTH_CLIENT_ID\u003c/var\u003e\"\n }\n },\n \"resource\": {\n \"type\": \"audited_resource\"\n }\n}\n```\n\nThis log entry includes the following values, which you can use to filter logs:\n\n- \u003cvar translate=\"no\"\u003ePROJECT_NUMBER\u003c/var\u003e: the project number of the project that contains the OAuth application integration.\n\n- \u003cvar translate=\"no\"\u003ePRINCIPAL_EMAIL\u003c/var\u003e: the email address of the principal that (owns\\|accessed) the OAuth client.\n\n- \u003cvar translate=\"no\"\u003eOAUTH_CLIENT_ID\u003c/var\u003e: the identity of the OAuth client\n\n- \u003cvar translate=\"no\"\u003eOAUTH_CLIENT_CREDENTIAL_ID\u003c/var\u003e: the identity of the OAuth client credential\n\nWhat's next\n-----------\n\n- [Configure and view the audit logs](/iam/docs/audit-logging) for IAM.\n- Get more information about [Cloud Audit Logs](/logging/docs/audit).\n- Set up [Workforce OAuth application integration](/iam/docs/workforce-oauth-app) using OAuth clients."]]
