Workforce Identity Pool Create Login Config

What gcloud iam workforce-pools create-login-config is

The gcloud iam workforce-pools create-login-config command generates a client-side configuration file containing the necessary authorization endpoints and audience URI to facilitate interactive, browser-based authentication for external identities using Workforce Identity Federation.

How it meets the requirements

• Interactive browser-based authentication: It creates a configuration file specifying the authorization URL (https://auth.cloud.google/authorize), Security Token Service endpoints (token_url and token_info_url), and the external account audience matching the workforce pool provider.
• Enables gcloud sign-in: Users can initiate interactive authentication by executing gcloud auth login --login-config=login.json or by activating the file with gcloud config set auth/login_config_file login.json.
• No credential synchronization: It relies entirely on Workforce Identity Federation protocols, validating external IdP assertions dynamically without requiring user provisioning in Cloud Identity.

Key advantages and capabilities

• Streamlined workforce onboarding: Distributes a standardized endpoint definition file to users without embedding sensitive secrets or private keys.
• Audience encapsulation: Automatically structures the workforce provider resource name (//iam.googleapis.com/locations/global/workforcePools/WORKFORCE_POOL_ID/providers/PROVIDER_ID) as the target audience.
• Seamless integration: Directly coordinates authentication handshakes between the local gcloud CLI, the browser, Google's authorization endpoint, and the external identity provider.
• Centralized access control: Allows administrators to enforce session lifetimes and revoke provider access globally without altering local client binaries.

Why this is optimal

Generating a login configuration via create-login-config is the standard, documented method in Google Cloud for interactive browser-based workforce federation. It explicitly prepares the client environment to redirect to the configured external identity provider for credential challenge and returns the federated token to the CLI.