Question

Your organization already manages employee identities in an on-premises Active Directory and a third-party identity provider (Okta) that supports SAML 2.0. Leadership wants employees to sign in to Google Cloud using their existing Okta credentials, and wants Okta to remain the authoritative source for authentication. You must ensure that when users authenticate, they are redirected to Okta and that Google Cloud does not store or validate their passwords. What should you configure?

Accepted Answer

Configure Cloud Identity with third-party SSO by setting Okta as the SAML identity provider (IdP) and Cloud Identity as the service provider (SP).

Answer

Enable Google Cloud Directory Sync (GCDS) and let it synchronize password hashes from Active Directory to Cloud Identity.

Answer

Create all users manually in the Cloud Identity Admin console and enforce 2-Step Verification for each account.

Answer

Configure workload identity federation so Okta issues tokens that map to Google Cloud service accounts for each employee.