[[["容易理解","easyToUnderstand","thumb-up"],["確實解決了我的問題","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["難以理解","hardToUnderstand","thumb-down"],["資訊或程式碼範例有誤","incorrectInformationOrSampleCode","thumb-down"],["缺少我需要的資訊/範例","missingTheInformationSamplesINeed","thumb-down"],["翻譯問題","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["上次更新時間：2025-09-04 (世界標準時間)。"],[[["\u003cp\u003eIdentity-Aware Proxy (IAP) can utilize external identity providers such as email/password, OAuth, SAML, OIDC, and phone number, rather than solely relying on Google accounts.\u003c/p\u003e\n"],["\u003cp\u003eIdentity Platform enables multi-tenancy, allowing for the segregation of user populations into isolated pools or "tenants," which is useful in B2B scenarios where a company sells services to other companies.\u003c/p\u003e\n"],["\u003cp\u003eMulti-tenancy is not always necessary, for instance, when an application needs to block access to users outside a specific network, or in cases where subsidiaries of a conglomerate share high-level benefits and therefore can authenticate at the project level.\u003c/p\u003e\n"],["\u003cp\u003eTo enhance security and prevent token leakage, it's possible to assign each IAP resource its own tenant, ensuring that tokens are only valid within the context of that specific tenant.\u003c/p\u003e\n"],["\u003cp\u003eA single IAP resource can accommodate multiple tenants, and the tenant to be used can be determined programmatically or by user selection, with user access managed via claims carried in the JSON Web Token.\u003c/p\u003e\n"]]],[],null,["# External identities\n\nThis article provides additional information on using external identities with\nIdentity-Aware Proxy (IAP) instead of Google accounts.\n\nOverview\n--------\n\nIAP controls access to your applications and resources. It\nleverages user identity and the context of a request to determine if a user\nshould be allowed access. IAP is a building block of\n[Chrome Enterprise Premium](/chrome-enterprise-premium/docs), an enterprise security\nsolution that enables employees to work from untrusted networks without using\na VPN.\n\nBy default, IAP uses Google identities and\nIAM. By leveraging [Identity Platform](/identity-platform/docs)\ninstead, you can authenticate users with a wide range of external identity\nproviders, such as:\n\n- Email/password\n- OAuth (Google, Facebook, Twitter, GitHub, Microsoft, etc.)\n- SAML\n- OIDC\n- Phone number\n- Custom\n- Anonymous\n\nThis is useful if your application is already using an external authentication\nsystem, and migrating your users to Google accounts is impractical.\n\nMulti-tenancy\n-------------\n\nIdentity Platform multi-tenancy was originally designed for B2B scenarios,\nwhere one company is selling a service to other companies. In these cases,\nit's common for developers to want to segregate user populations into isolated\npools. These silos are referred to as **tenants**.\n\nConsider the fictional relationship diagram below:\n\nIn this example, Acme is a car manufacturer (the *agent* ) who uses\nIdentity Platform to provide a service to dealerships (the *tenants*). These\ndealerships in turn provide services to their customers, employees, and\ncontractors. Although the manufacturer owns the service, each dealership\ncould use their own set of identity providers for authentication. User sessions\nand data are scoped on a per-tenant basis, so if a user has relationships with\nmultiple dealerships, each is handled independently.\n\nDepending on your use case, there are a number of ways you can structure your\ntenant hierarchy.\n\n### No tenants\n\nYou only need multi-tenancy if you need to isolate resources. Not all\napplications have this requirement. For example, if you have a single\nApp Engine app and want to block access to all users outside your\nnetwork, there is no need for multi-tenancy. By default, Identity Platform\nstores and authenticates users on a per-project basis, so no additional\nconfiguration is required in this case.\n\nAnother example is a conglomerate with several subsidiaries. Even if each\nsubsidiary has its own managed authentication system (using OIDC or SAML),\nall employees might share the same high-level benefits, such as healthcare,\nvacations, and payroll. In this case, authenticating at the project level\nis sufficient.\n\n### One tenant per resource\n\nBy default, non-tenant Identity Platform tokens are valid at the project\nlevel. Theoretically, this means a user could authenticate with one\nIAP resource, then use the token to access another service\nin the same project. This is a security risk.\n\nTo prevent token leakage, isolate each IAP by assigning\neach its own tenant. Tokens minted in a tenant-specific context are only valid\nfor that specific tenant. If the user attempts to access another\nIAP resource that uses a different tenant, they'll be asked\nto authenticate again.\n\n### Multiple tenants per resource\n\nA single IAP resource can have multiple tenants associated\nwith it.\n\nWhen a user accesses the resource, you have several options for\ndetermining what tenant to use. For example, you might prompt the user to\nenter their email first, and then programmatically locate a tenant that matches\nthe email's domain. Alternatively, you might display a UI that lists all valid\ntenants, and ask the user to choose one.\n\nUsers can belong to multiple tenants with varying levels of access.\nAlthough you can't use IAM to manage access control with external\nidentities, the JSON Web Token generated by IAP carries the\nclaims from the Identity Platform ID token, and the application can filter access\nbased on these claims.\n\nAn example multi-tenancy scenario is an employee benefits company that has many\ncustomers sharing a single web portal. When a user visits the\nportal, they first select their company (the tenant), and then authenticate\nwith whatever provider their employer uses with their corporate credentials.\n\nWhat's next\n-----------\n\n- [Enable IAP for use with external identities](/iap/docs/enable-external-identities)\n- [Learn more about Identity Platform](/identity-platform/docs)"]]
