Recent content in Posts on Identity, access, and stuff - Johannes Passing's blog about IAM
Gemini Enterprise lets us register ADK agents and make them available in the Gemini Enterprise app. When registering an agent, we can configure authorization . Gemini Enterprise then prompts users to perform an OAuth 2.0 authorization flow and forwards the resulting access token to the agent. The ADK lets agents read the forwarded access token from context.session.state , but doesn’t have…
When deploying an agent to Agent Platform, we can choose to assign it an agent identity instead of a service account. When the agent requests an ID token from the metadata server, it then no longer receives a Google-issued ID token. Instead, it receives a JWT-SVID that looks similar to the following when decoded: { "alg": "RS256", "kid": "78ab40e4a0319f9ced58024f5bb66e6387d68066", "typ": "JWT" }.{…
When federating Google Cloud with an identity provider like Entra, we need to decide whether to set up single sign-on using Cloud Identity/Workspace or whether to use Workforce Identity Federation. Which approach works best depends on a number of factors, but these factors aren’t always obvious. In a new set of articles published on the Google Cloud website, I’m trying to shed some light on…
Gemini Enterprise lets us register custom ADK agents that run on Vertex AI Agent Engine. Once registered, users can find those agents in the Gemini Enterprise app and interact with them using chat. To do anything meaningful, most ADK agents need to interact with other APIs and services – MCP servers, Google Cloud APIs, custom applications deployed on Google Cloud or elsewhere. These APIs need…
Update : See here for an updated version of this post. Gemini Enterprise now supports registering custom ADK agents that run on Vertex AI Agent Engine. Once connected, Gemini Enterprise users can discover and interact with these agents via chat. As these ADK agents are chat-based, they generally fit the notion of an “assistant” or “interactive agent”: they operate in a…
Google Cloud uses token-based authentication to secure its APIs. But there’s more than one way to obtain a token, and there are well over a dozen different types of tokens. In a new set of articles on the Google Cloud website, I dive into the different types of tokens, their security properties, purposes, and ways to obtain them: Token overview describes how user authentication differs from…
Emergency access users tend to be highly privileged and as such, require robust protection through measures like multi-factor authentication or context-aware access. However, this protection also increases the risk of being unable to utilize them during an actual emergency. In a new article, Best practices for continuous access to Google Cloud , I outlined some strategies for balancing the need to…
Although Kubernetes resources are best managed using infrastructure-as-code (IaC), it’s sometimes useful to be able to interact with the cluster directly – whether that’s for diagnostics or other purposes. However, as with any other access, it’s best to grant such access only when needed and to let it auto-expire when it’s no longer required. One option to manage…
Context-aware access is Google’s approach to zero trust. Using context-aware access, we can protect access to the Google Cloud Console, APIs, VMs, Workspace, and many other resources in a way that not only takes the user’s identity into account, but also other factors such as their location, browser, and device posture. However, context-aware access isn’t a singular service or…
Before we can call a Google API, we have to obtain an OAuth access token. As we learned before, there are different types of access tokens , and service account access tokens are a little different from user access tokens . The vast majority of Google Cloud APIs don’t discriminate between these two types of token and work with both. But beyond Google Cloud, there are still many Google APIs…
Given an OAuth client ID such as 1234567890-9iuxy238472ny4qmfad0ppg77s61vabo14j0s.apps.googleusercontent.com , how can we find out which Google Cloud project the OAuth client belongs to? If we look closely at OAuth client IDs, we notice that they follow a common pattern: NUMBER-GIBBERISH.apps.googleusercontent.com This pattern isn’t a coincidence: NUMBER is the project number of the Google Cloud…
Google Cloud IAM implements discretionary access control , meaning each resource - be it a folder, project, or VM - has an IAM policy. We can think of this policy as an access control list, outlining who can access the resource and what actions they’re permitted to take. This model is extremely flexible. But as we scale, management can become a challenge: As the number of resources, IAM…
The primary focus of JIT Access has been privileged access management (PAM) – enabling users to request just-in-time privileged access to Google Cloud projects on a temporary basis. When I published the project in 2022, Google Cloud didn’t provide any such capabilities as part of the platform, so the project filled an important gap. With Privileged Access Manager in preview now, that…
Allowing users to connect to Google Cloud VMs using SSH is convenient and often unavoidable. But it’s not without risks. In a new set of articles published on the Google Cloud website, I cover a range of best practices that we can use to better secure SSH access to our VM instances and protect our workloads: Controling network access describes best practices for implementing zero trust…
Libssh2 lets us choose between multiple different crypto backends. On Windows, an attractive option is to use the WinCNG backend. CNG is part of the operating system , it’s maintained by Microsoft and serviced by Windows update, and reusing OS functionality helps us keep our binaries small. However, the WinCNG backend used to have a significant limitation: it lacked support for ECDSA . Given…
When users sign in to an application that uses Google OAuth or OpenID Connect, they typically see a consent screen. But there’s more than one type of consent screen, and the type of consent screen that users end up seeing not only depends on the publisher, but also on the administrative controls applied on the consumer side. Let’s take a look at the various consent screens that we…
Using workload identity federation, we can let Azure-hosted applications authenticate to Google Cloud using their managed identity , no service account keys required. More specifically, we can configure the Google Cloud client libraries so that they don’t look for a service account key, but instead obtain an Azure access token and exchange it against a Google Cloud access token. Setting up…
Microsoft might not be the premier source of information about Google Cloud, but their cloud security benchmark (MCSB) turns out to provide some sound advice : GCP guidance: Use Identity-Aware Proxy (IAP) Desktop to create an access path (a connection session) to the compute instance for privileged tasks. IAP Desktop allows RDP and SSH connectivity to your destination hosts through port…
Modern web applications typically use OAuth or OpenID Connect to authenticate users, but older intranet applications often still rely on Integrated Windows Authentication (IWA) to deliver a single sign-on experience for users. The authentication protocol used for IWA is not always clear: IWA can use NTLM, Kerberos, or both, depending on how the application is configured. This ambiguity can become…
Using workload identity federation, we can let an AWS-hosted application authenticate to Google Cloud using its AWS credentials, no service account keys required. Or, more specifically, we can configure the Google Cloud client library to take the application’s AWS credentials, perform a token exchange, impersonate a Google Cloud service account, and use the service account’s identity…
Before a workload can access Google Cloud APIs, it needs to authenticate and obtain an access token. For a workload that runs on Google Cloud, we can attach a service account to the compute resource that runs the workload, and that lets the workload authenticate without any additional secrets or keys. But for IoT devices or on-premises workloads, it’s more difficult. One way to authenticate…
When we have an AWS or Azure workload that needs to access Google Cloud resources, we can let the workload use workload identity federation to authenticate in a key-less fashion . But workload identity federation isn’t limited to authenticating workloads between cloud providers. There are many other scenarios where it can be interesting to use workload identity federation, for example: A…
To obtain an access token or ID token for a user, we need a Client ID and secret. Using these client credentials, we can initiate an OAuth code flow to let the user authorize our app, and as a result, we get an access token. If we use the right parameters , we also receive an ID token and refresh token. If we look at the tokens we receive, we can see which Client ID they were issued to: The ID…
Update Sep 2025: I published a more detailed version of article on the Google Cloud website, see Token types . Whenever we want to call a Google or Google Cloud API, we need an access token. But there’s more than one way to obtain an access token, and depending on which way we use, the resulting access token might behave a little differently. What kinds of access tokens are there, and how do…
Version 1.2 of JIT Access now supports multi-party approval: When granting eligible access, we can now decide whether to allow a user to activate the access by themselves (self-approval), or whether they need approval from another user (multi-party approval). Eligible role bindings JIT Access works by adding the notion of eligible role bindings to Cloud IAM. Unlike a regular IAM role binding , an…
When an on-premises application needs to access Google Cloud, it’s tempting to just let it use a service account key. But if the application runs in an Active Directory environment and has domain credentials, there’s a better alternative: we can let it use its NTLM or Kerberos credentials and “exchange” them against Google credentials. To exchange Active Directory…
With Just-in-Time Access , we can implement just-in-time privileged access management on Google Cloud by allowing users to temporarily elevate their access to certain projects. The application relies on the notion of eligible role bindings : These are role bindings with a special IAM condition, has({}.jitAccessConstraint) . Once we grant a user such an eligible role binding , that role starts to…
Any call we make against a Google API is charged against a project quota . Depending on the API that we’re using, that project quota might limit the frequency of calls, the total number of calls, or even the number of calls per user. But which project’s quota is it that’s being charged? To find out, we need to distinguish between two classes of APIs: Resource-oriented APIs are…
To implement role-based access control to Google Cloud resources, it’s often useful to create a set of groups, where each group represents a role for a certain set of resources. For example, we might create groups such as database reader and database admin that grant access to a set of database-related resources. How can we automate the management of these groups, without granting our automation…
When developing applications that use the Google Cloud API, being able to trace and inspect HTTP requests with a tool like Fiddler can be a great debugging aid. But getting Fiddler to work with the Java client libraries can be a bit tricky. Suppose we have a Java application that uses the Resource Manager API to do things like listing Google Cloud projects. To do that, the application uses two…
The first thing we often do after creating a new Windows VM on Google Cloud is join the VM to Active Directory. Typically, this entails the following steps: Generate Windows credentials Log on by using RDP Initiate the domain join Log on again with a domain user and delete the local admin account created in (1) This process is tedious. And if we forget to perform step (4), we’re also leaving…
When we use a tool like gcloud or IAP Desktop for the first time, we need to authorize it. Google Sign-in then shows us a consent screen that lists all the things the tool might do on our behalf (or more precisely, which scopes we’re authorizing), and and we can decide whether to consent or deny. In the case of gcloud, the consent screen looks like this: Notice that we only have two choices:…
When we run License Tracker for the first time, the tool analyzes the last 90 days of audit logs to determine how many VMs and physical servers we’ve been using . Going back 90 days in history is useful, but can we go back further? License Tracker analyzes the Admin Activity audit logs . These logs are enabled by default and retained for 400 days. So there shouldn’t be anything in the…
When we bring our own Windows licenses (BYOL) to Google Cloud, we must keep track of the number of physical servers that we’re using those licenses on. That’s because Windows Server is licensed by core and not by VM. By using sole-tenant nodes , we can control which nodes our VMs run on. A node is an abstraction of a physical server and at any point in time, a node corresponds to…
To deploy software or infrastructure automatically, many deployment pipelines need access to Google Cloud – and the way to accomplish that is to let the pipelines use a service account. Letting a deployment pipeline use a service account to access Google Cloud has some advantages: The lifecycle of a service account is disconnected from the lifecycle of user accounts. By configuring a pipeline to…
Update : Libssh2 now supports ECDSA . Libssh2 lets us choose between multiple different crypto backends. But that doesn’t mean these backends are interchangeable. When we build libssh2 , we must make a choice on which crypto backend we want to use. The most common choice is probably OpenSSL, but we can also use libgcrypt, mbedTLS, wolfSSL or WinCNG . The last option, WinCNG, is interesting for a…
Secure LDAP is a Cloud Identity feature that lets it emulate an LDAP server. From an application’s perspective, Secure LDAP makes Cloud Identity look somewhat similar to Active Directory – but authentication works a little differently. Before we can query Active Directory using LDAP, we typically need to authenticate first. We can do that by providing a username and password (simple…
AWS lets us use access keys to authenticate programmatically. That’s useful for local development, or if we want to let tools access AWS on our behalf. The closest thing to access keys on Google Cloud seem to be service account keys. But are they really that similar? AWS access keys and service account keys have a number of things in common: We can create them to let applications or tools…
The principle of least privilege states that we should grant users just enough access to carry out everyday activities, but no more. But what about the occasional case where a user does need privileged access , maybe to handle an incident or perform a rare configuration change? If we grant users all the access they might ever need, then we’re violating the principle of least privilege. But not…
When we allow users to use SSH to connect to Linux VMs on Google Cloud, we need to keep track of their public keys, and which VMs they have access to. That can be easier said than done. Google Cloud lets us choose between two ways of managing SSH keys for Linux VMs. The classic (and default) way is to use metadata-based keys , where we upload SSH keys to instance or project metadata.…
Before we deploy an application to Google Cloud, we typically want to test it locally. If the application uses Google Cloud APIs, then we somehow need to ensure that the application can authenticate. We could use a service account key for that, but the best practices for using and managing service accounts (guess who wrote these) advise against that approach : During your daily work, you might use…
Google Cloud lets us enable OS Login for a project by adding an entry to the project’s metadata : gcloud compute project-info add-metadata \ --metadata enable-oslogin=TRUE Project metadata “inherits down” down to all VM instances, so the command above enables OS Login for all VMs in that project. But is that sufficient to enforce the use of OS Login? Or does it leave any…
IAP Desktop uses a UI that’s similar to Visual Studio: We can dock tool windows, let them auto-hide when we don’t need them, or let them float as separate windows. But that flexibility didn’t apply to RDP windows – they always stayed at the center, and IAP Desktop wouldn’t let us rearrange them. This limitation wasn’t accidental: Floating and docking aren’t standard MDI features . Instead, it’s a…
Previously , we explored two ways of authenticating to Google Cloud using Kerberos and NTLM credentials. Both ways involved authenticating to AD FS using Integrated Windows Authentication, obtaining either an OAuth access token or a SAML assertion, and then using workload identity federation : We saw that one advantage of SAML over OIDC is that it lets us propagate additional claims to workload…
A term we commonly encounter in the realm of access management is privileged access . The term seems pretty self-explanatory, but finding a good definition isn’t easy. In the book Privileged Attack Vectors , Morey Haber defines the term privilege as: A special right or permission granted, or available only to, a particular person or group to perform special or sensitive operations upon or…
When an application needs to access Google Cloud APIs, it needs credentials. On Google Cloud, we can attach a service account to the underlying compute resource to let the application obtain credentials. On AWS and Azure, we can achieve something to the same effect by using workload identity federation . But what about on-premises? What Google Cloud, AWS, and Azure all have in common is that they…
Workload identity federation supports OpenID Connect, so it should be compatible with AD FS. But until recently, workload identity federation didn’t work with AD FS-issued access tokens – only ID tokens worked properly. What was the issue there? For ID Tokens, OpenID Connect is pretty specific about their format : They need to be JSON Web Tokens (JWTs), they must contain certain claims, and they…
When an application that’s running on-premises needs to access Google Cloud services, it needs to authenticate somehow. Typically, it’s best to use workload identity federation for this purpose, but that doesn’t work in all environments. So there’s sometimes no way around using a service account key. The main problem with service account keys is that they are a secret, and that they need to be…
Before we can call a Google Cloud API, we have to obtain an OAuth access token. We can obtain access tokens for a user (by following the OAuth authorize flow ) or for a service account, and most APIs will happily accept both kinds of tokens. But there are some APIs that won’t accept access tokens issued to service accounts. Examples for such APIs include the Cloud Identity API , parts of the…
By default, IAP Desktop uses the rsa-ssh public key signature algorithm when authenticating to a Linux VM. rsa-ssh is ubiquitous and still commonly used – but it still relies on SHA1, which led the OpenSSH team to deprecate it a while ago : It is now possible to perform chosen-prefix attacks against the SHA-1 hash algorithm for less than USD$50K. For this reason, we will be disabling the 'ssh-rsa'…