A security engineer is configuring a SAML 2.0 workforce identity pool provider using the Google Cloud CLI (gcloud). The organization has the following requirements for workforce users authenticating to Google Cloud: Map the incoming SAML subject identifier to the standard Google subject attribute in all lowercase characters. Map the SAML assertion attribute for department (assertion.attributes.department[0]) to a custom workforce attribute. Enforce an assertion condition using Common Expression Language (CEL) so that only users belonging to the SecOps-Engineers group claim and possessing an email ending with @example.com are permitted to authenticate to the workforce pool. Which configuration flags should the security engineer provide in the gcloud iam workforce-pools providers create-saml command?

--attribute-mapping="google.subject=assertion.subject.lowerAscii(),attribute.department=assertion.attributes.department[0],google.groups=assertion.attributes.groups" --attribute-condition="'SecOps-Engineers' in assertion.attributes.groups && assertion.attributes.email[0].endsWith('@example.com')": ### What Workforce Identity Federation Attribute Mapping and Conditions Are **Workforce Identity Federation** allows enterprise users to authenticate directly to Google Cloud services using external Identity Providers (IdPs) via SAML 2.0 or OIDC without account synchronization. When establishing a provider, administrators configure **attribute mappings** to map IdP assertion claims to Google Cloud attributes (such as `google.subject`, `google.groups`, and custom `attribute.*` keys) and define **attribute conditions** using **Common Expression Language (CEL)** expressions to restrict authentication access at the provider boundary. ### How It Meets the Requirements - **Lowercased Subject Identifier**: Mapping `google.subject=assertion.subject.lowerAscii()` ensures the unique subject identity is extracted from the SAML assertion and normalized to lowercase using the CEL `.lowerAscii()` string transformation function. - **Custom Attribute Mapping**: Custom SAML attributes must use the `attribute.` prefix. Mapping `attribute.department=assertion.attributes.department[0]` correctly exposes the department claim to IAM policies and downstream access configurations. - **CEL Assertion Condition**: Specifying `--attribute-condition="'SecOps-Engineers' in assertion.attributes.groups && assertion.attributes.email[0].endsWith('@example.com')"` evaluates whether `'SecOps-Engineers'` is present in the list of groups and verifies that the user's email ends with the mandatory `@example.com` domain using logical `&&` and standard CEL list/string operators. ### Key Advantages and Capabilities - **Zero Account Synchronization**: Eliminates the operational burden of synchronizing external directory objects into Cloud Identity. - **Pre-Authentication Perimeter Defense**: Drops unauthorized authentication exchanges at the Security Token Service (STS) boundary if the CEL condition evaluates to `false`. - **Granular IAM Authorization**: Exposes custom mapped attributes (`attribute.department`) and standard groups (`google.groups`) for use in IAM condition bindings and service access controls. ### Why This Is Optimal This syntax strictly adheres to Google Cloud's CEL specification for Workforce Identity Federation providers, combining proper attribute naming conventions with valid CEL methods (`.lowerAscii()`, `in`, `&&`, and `.endsWith()`).

Workforce Identity Federation Cel Attribute Mapping | Professional Cloud Security Engineer

Workforce Identity Federation Cel Attribute Mapping

Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.

A security engineer is configuring a SAML 2.0 workforce identity pool provider using the Google Cloud CLI (gcloud). The organization has the following requirements for workforce users authenticating to Google Cloud:

Map the incoming SAML subject identifier to the standard Google subject attribute in all lowercase characters.
Map the SAML assertion attribute for department (assertion.attributes.department[0]) to a custom workforce attribute.
Enforce an assertion condition using Common Expression Language (CEL) so that only users belonging to the SecOps-Engineers group claim and possessing an email ending with @example.com are permitted to authenticate to the workforce pool.

Which configuration flags should the security engineer provide in the gcloud iam workforce-pools providers create-saml command?

--attribute-mapping="google.subject=assertion.subject,google.custom.department=assertion.attributes.department,google.groups=assertion.attributes.groups" --condition="assertion.attributes.groups.contains('SecOps-Engineers') AND assertion.attributes.email.like('%@example.com')"

--attribute-mapping="google.subject=assertion.subject.toLower(),attribute.department=assertion.attributes.department[0],google.groups=assertion.attributes.groups" --attribute-condition="assertion.attributes.groups.has('SecOps-Engineers') && assertion.attributes.email[0].matches('*@example.com')"

--attribute-mapping="google.subject=assertion.email,attribute.department=assertion.attributes.department,google.groups=assertion.attributes.groups" --attribute-condition="'SecOps-Engineers' in google.groups && google.subject.endsWith('@example.com')"

--attribute-mapping="google.subject=assertion.subject.lowerAscii(),attribute.department=assertion.attributes.department[0],google.groups=assertion.attributes.groups" --attribute-condition="'SecOps-Engineers' in assertion.attributes.groups && assertion.attributes.email[0].endsWith('@example.com')"

Professional Cloud Security Engineer

Workforce Identity Federation Cel Attribute Mapping

Related questions