An enterprise is designing a secure identity and access architecture across its hybrid environment and Google Cloud Platform (GCP). The security team has defined two core integration requirements: Requirement 1: Corporate employees must authenticate via browser-based Single Sign-On (SSO) into the Google Cloud Console using the organization's existing on-premises enterprise Identity Provider (IdP). Requirement 2: A custom customer-facing web application needs to securely call Google Cloud REST APIs (such as BigQuery and Cloud Storage) on behalf of authenticated users with limited, scoped access, without ever storing or handling the users' enterprise passwords. Which protocol design aligns with Google Cloud security best practices to satisfy both requirements?

Configure SAML 2.0 federation with Cloud Identity for employee console Single Sign-On, and implement OAuth 2.0 authorization flows to issue scoped access tokens for REST API access.: ### What SAML 2.0 and OAuth 2.0 are in GCP **Security Assertion Markup Language (SAML) 2.0** is an XML-based open standard designed primarily for federated identity and browser-based web Single Sign-On (SSO). **OAuth 2.0** is an industry-standard authorization framework designed to issue short-lived, scoped access tokens that grant delegated authority to client applications accessing protected HTTP/REST APIs without exposing user credentials. ### How it meets Requirement 1 (Workforce Console SSO) - **SAML 2.0 web SSO**: Cloud Identity and Google Workspace support SAML 2.0 identity federation. When corporate employees navigate to the Google Cloud Console, Google acts as the **Service Provider (SP)** and redirects the browser to the corporate enterprise **Identity Provider (IdP)** via standard SAML authentication requests. - **Centralized identity validation**: Upon successful authentication, the IdP returns a signed SAML assertion containing identity attributes (such as the user's `NameID`), allowing Google Cloud to establish an authenticated session for the employee. ### How it meets Requirement 2 (Delegated API Access) - **OAuth 2.0 delegated authorization**: When an application requires access to Google Cloud APIs on behalf of a user, the application uses standard OAuth 2.0 authorization grant flows (such as Authorization Code Flow with PKCE) to obtain a short-lived OAuth 2.0 access token. - **Granular scoping**: OAuth 2.0 access tokens contain specific authorization scopes (e.g., `https://www.googleapis.com/auth/bigquery.readonly`), ensuring the application only performs actions explicitly delegated by the user. ### Key advantages - **Clear separation of concerns**: Uses SAML 2.0 for human interactive authentication into web portals and OAuth 2.0 for programmatically delegating granular permissions to RESTful services. - **Credential protection**: Prevents intermediate web applications from capturing or caching user passwords. - **Short-lived access**: Replaces permanent keys with short-lived tokens, reducing the blast radius of credential compromise. - **Native GCP integration**: Directly aligns with Google Cloud's authentication endpoints and Cloud Identity SSO configurations. ### Why this is optimal This architecture leverages each protocol for its intended engineering purpose: SAML 2.0 handles federated enterprise workforce authentication across trust domains, while OAuth 2.0 handles modern, scoped API authorization headers.

Saml Vs Oauth2 Gcp Iam Use Cases | Professional Cloud Security Engineer

Saml Vs Oauth2 Gcp Iam Use Cases

Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.

An enterprise is designing a secure identity and access architecture across its hybrid environment and Google Cloud Platform (GCP). The security team has defined two core integration requirements:

Requirement 1: Corporate employees must authenticate via browser-based Single Sign-On (SSO) into the Google Cloud Console using the organization's existing on-premises enterprise Identity Provider (IdP).
Requirement 2: A custom customer-facing web application needs to securely call Google Cloud REST APIs (such as BigQuery and Cloud Storage) on behalf of authenticated users with limited, scoped access, without ever storing or handling the users' enterprise passwords.

Which protocol design aligns with Google Cloud security best practices to satisfy both requirements?

Implement OAuth 2.0 Client Credentials Grant for employee console access, and configure OpenID Connect (OIDC) ID tokens for scoped REST API authorization.

Enforce SAML 2.0 tokens for both employee console authentication and microservice API calls via direct XML assertion validation at Google API endpoints.

Configure SAML 2.0 federation with Cloud Identity for employee console Single Sign-On, and implement OAuth 2.0 authorization flows to issue scoped access tokens for REST API access.

Implement OAuth 2.0 Authorization Code flow for employee console Single Sign-On, and use SAML 2.0 assertion headers on each microservice REST API call.

Professional Cloud Security Engineer

Saml Vs Oauth2 Gcp Iam Use Cases

Related questions