Question

Your company uses Okta as its corporate identity provider and does not want to create or synchronize any user accounts into Cloud Identity. A group of contractors and internal analysts, all authenticated through Okta, need short-lived, browser-based access to the Google Cloud Console to view BigQuery datasets in a single project. You must grant these external identities access without provisioning Google accounts for them. What should you do?

Accepted Answer

Configure a workforce identity pool with an OIDC/SAML provider mapped to Okta, then grant IAM roles to the pool's principalSet at the project level.

Answer

Configure a workload identity pool federated with Okta and have each analyst impersonate a service account to open the Console.

Answer

Use Cloud Identity directory sync (GCDS) to import the Okta users into Cloud Identity and assign them the BigQuery Data Viewer role.

Answer

Create individual Google accounts for each contractor and analyst, enable SSO with Okta, then grant them the BigQuery Data Viewer role.