Google Cloud Platform

Configure GCP Workforce Identity Federation

Prerequisites

  • Administrator access to the Google Cloud Console
  • A SplitSecure Identity Provider created and approved
  • A Google Cloud organization set up
  • The IAM Workforce Pool Admin role (roles/iam.workforcePoolAdmin) or Owner role on the organization
  • IAM and Resource Manager APIs enabled
  • A separate browser or browser profile with SplitSecure configured (for testing)

GCP Configuration

Create a Workforce Identity Pool

  1. Go to Workforce Identity Pools page

  2. Select your organization

  3. Click Create Pool

  4. Configure the pool settings:

    Field Value Notes
    Name e.g., “SplitSecure Pool” Display name for the pool
    Pool ID (Auto-generated from name) Take note of this value
    Description (Optional) e.g., “Workforce pool for SplitSecure SSO”

Click Next

Add a SAML Identity Provider

  1. In the Providers section, click Add Provider
  2. For Select a Provider vendor, choose Generic Identity Provider
  3. For Select an authentication protocol, choose SAML
  4. Click Continue
Field Value Notes
Name e.g., “SplitSecure Provider” Display name for the provider
Provider ID (Auto-generated) Take note of this value
Description (Optional) e.g., “SplitSecure SAML provider”
IDP metadata file (XML) Upload the metadata file from SplitSecure Download at Secure Accounts → SAML2 Identity Providers → [Your IdP] → Details → Download Metadata
Enable provider On
  1. Click Continue
  2. The “Share your provider information with IdP” card should appear, but you can safely continue since the SplitSecure interface will ask you for the Workforce Pool ID and the Workforce Provider ID
  3. Set the Attribute mapping to map your IdP attributes to GCP attributes
  4. Optionally add attribute conditions and enable Detailed Logging
  5. Click Submit

SplitSecure Configuration

Configure SplitSecure with GCP SP Details

  1. In SplitSecure, navigate to Secure Accounts → Create Account → Google Cloud Platform

  2. Enter a name for your account

  3. Select the Identity Provider

  4. Configure the following:

    Field Value
    Workforce Pool ID e.g., splitsecurepool
    Workforce Provider ID e.g., split-secure-provider

You can find these values at Workforce Identity Pools page

Click Create Account

Grant IAM Access to Federated Users

Before users can access GCP resources, you must grant them IAM roles.

Navigate to IAM

  1. In the Google Cloud Console, go to IAM & Admin → IAM
  2. Select the project, folder, or organization where you want to grant access

Grant Roles to Federated Principals

Click Grant Access and add principals using the following formats:

Grant Access to a Single User

principal://iam.googleapis.com/locations/global/workforcePools/POOL_ID/subject/USER_SUBJECT

Replace USER_SUBJECT with the user’s subject attribute value (e.g., email).

Grant Access to a Group

principalSet://iam.googleapis.com/locations/global/workforcePools/POOL_ID/group/GROUP_ID

Grant Access to All Users in the Pool

principalSet://iam.googleapis.com/locations/global/workforcePools/POOL_ID/*

More at Principal Identifiers

Assign Roles

  1. In the New principals field, enter the principal identifier
  2. In Select a role, choose the appropriate role (e.g., Viewer, Editor, Storage Admin)
  3. Click Save

Test Authentication

Access the Federated Console

Users can access the Google Cloud Console (federated) using the following URL format:

https://console.cloud.google/

Or use the workforce provider-specific sign-in URL:

https://auth.cloud.google/signin/locations/global/workforcePools/POOL_ID/providers/PROVIDER_ID

Test Authentication (SP-Initiated)

  1. Navigate to the federated console URL
  2. You should be redirected to SplitSecure for authentication
  3. Enter your email address when prompted
  4. Click Request Access
  5. Complete the authentication flow
  6. Upon success, you’ll be redirected to the Google Cloud Console

Troubleshooting

Issue Possible Cause Solution
User cannot access resources No IAM roles granted Grant appropriate roles to the federated principal
Attribute mapping errors Incorrect CEL expression Check attribute mapping syntax; enable detailed audit logging
“Subject not found” error NameID mismatch Ensure SAML NameID matches the expected subject format
Session expires too quickly Default session duration Increase session duration in pool settings
User not in correct group Group attribute not mapped Add google.groups attribute mapping
Multi-tenant IdP access issue Missing attribute condition Add attribute condition to restrict access to correct tenant

External Resources

Last updated:

Previous page

Microsoft Entra ID

Next page

Google Workspace