[[["易于理解","easyToUnderstand","thumb-up"],["解决了我的问题","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["很难理解","hardToUnderstand","thumb-down"],["信息或示例代码不正确","incorrectInformationOrSampleCode","thumb-down"],["没有我需要的信息/示例","missingTheInformationSamplesINeed","thumb-down"],["翻译问题","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["最后更新时间 (UTC)：2025-08-20。"],[[["\u003cp\u003eGoogle Cloud offers several user authentication methods, including Identity Platform, Firebase Authentication, Google Identity Services for Web, OAuth 2.0 and OpenID Connect, and Identity-Aware Proxy (IAP).\u003c/p\u003e\n"],["\u003cp\u003eIdentity Platform is recommended for new projects and offers enterprise-grade features like multi-factor authentication and support for various identity providers, whereas Firebase Authentication is ideal for quick and lightweight setup.\u003c/p\u003e\n"],["\u003cp\u003eGoogle Identity Services for Web is best suited for authenticating users with their Google Accounts, while OAuth 2.0 and OpenID Connect are for those seeking complete control and customization over the authentication process.\u003c/p\u003e\n"],["\u003cp\u003eIdentity-Aware Proxy (IAP) uses Google accounts and IAM to manage user access to App Engine services, providing an extra security layer but not protecting against activity within the same project.\u003c/p\u003e\n"],["\u003cp\u003eAuth0 is an additional authentication service that provides authentication with multiple identity providers and single sign-on features.\u003c/p\u003e\n"]]],[],null,["# Authenticating users\n\n\u003cbr /\u003e\n\n\u003cbr /\u003e\n\n\u003cbr /\u003e\n\n\u003cbr /\u003e\n\n\u003cbr /\u003e\n\n\u003cbr /\u003e\n\nGo Java Node.js PHP Python Ruby .NET Custom\n\nTo authenticate users in Google Cloud applications, Google offers the following\nuser authentication methods:\n\nIdentity Platform\n-----------------\n\n[Identity Platform](https://cloud.google.com/identity-platform) is a customer\nidentity and access management (CIAM) platform that lets organizations customize\nidentity and authentication for user sign-up and sign-in in their applications.\nIdentity Platform supports multiple authentication methods (SAML, OIDC,\nemail/password, social, phone, and custom auth) to provide flexible integration\noptions for any identity solution. Identity Platform is built on\nGoogle Cloud's global scale, performance, network, and security, and comes with\nan enterprise-grade support and SLA to meet the demands of virtually any app or\nservice.\n\nThis solution is best for most users who want flexible authentication options\nbased on reliable, enterprise-grade features and SLAs.\n\nIdentity Platform offers its own user identity system. If you're already using\nGoogle Workspace for your domain and want to authenticate users based on that\nlogin, you should use [Google Identity Services for Web](#google-sign-in).\n\nTo learn about integrating Identity Platform with App Engine, try the\nhow-to guide for [signing in users on\nApp Engine](/identity-platform/docs/web/app-engine).\n\nFirebase Authentication\n-----------------------\n\n[Firebase Authentication](https://firebase.google.com/docs/auth/) provides a\ndrop-in, customizable identity and authentication service for user sign-up and\nsign-in. Similar to Identity Platform, Firebase Authentication supports multiple\nauthentication methods (SAML, OIDC, email/password, social, mobile, and custom\nauth) to provide flexible integration options for any identity solution.\n\nFirebase Authentication differs from Identity Platform in that it lacks certain\nenterprise features. For more information, see\n[Differences between Identity Platform and Firebase Authentication](/identity-platform/docs/product-comparison).\n\nThis solution is best if you want the most lightweight way to set up user\nauthentication for an App Engine app. For many users, Firebase Authentication\nis the fastest way to implement or test authentication.\n\nTo learn more about Firebase Authentication, try the following:\n\n- [Firebase Web Tutorial](https://codelabs.developers.google.com/codelabs/firebase-web/)\n highlights how to use Firebase on a website, including user sign-in with Google\n as the Identity Provider.\n\n- [Firebase Quickstart Apps](https://firebase.google.com/docs/samples/) show\n how to integrate Firebase across platforms, using both federated sign-in and\n username/password sign-in examples. Samples demonstrate Firebase Authentication\n using the [JavaScript SDK](https://github.com/firebase/quickstart-js/tree/master/auth)\n as well as on [iOS](https://github.com/firebase/quickstart-ios/tree/master/authentication)\n and [Android](https://github.com/firebase/quickstart-android/tree/master/auth).\n\nGoogle Identity Services for Web\n--------------------------------\n\n[Google Identity Services for Web](https://developers.google.com/identity/gsi/web/guides/overview)\nis a sign-in client library for Google built on the OAuth 2.0 and OpenID Connect\nprotocols. It allows for quick and easy sign-in by providing a Sign in With\nGoogle button that appears on your website or app.\n\nThis solution is best if you want to authenticate users based on their Google\nAccount, or if you are using Google Admin console for your domain.\n\nOAuth 2.0 and OpenID Connect\n----------------------------\n\nOpenID Connect is an identity layer on top of the OAuth 2.0 protocol. Google\noffers an\n[implementation](https://developers.google.com/identity/protocols/oauth2)\nof OAuth 2.0 that conforms to the\n[OpenID Connect specification](http://openid.net/connect/) and is\n[OpenID Certified](http://openid.net/certification/). There are also several\n[other providers](https://en.wikipedia.org/wiki/OpenID_Connect#Adoption)\navailable.\n\nThis solution is best if you want total customization and control of your\nauthentication implementation.\n\nFor more information, see\n[OpenID Connect](https://developers.google.com/identity/openid-connect/openid-connect).\n\nIdentity-Aware Proxy (IAP)\n--------------------------\n\nUnlike the other authentication options that implement authentication within\nyour app, [IAP](/iap/docs/concepts-overview) protects and secures\nyour application by adding an IAM authentication and\nauthorization layer in front of your resources. This layer verifies inbound\nexternal requests before the app can be reached. Users who are not authorized\naccess to your app can't have access to reach your App Engine app.\n\nYou can enable IAP for your whole app, or for specific services\nor versions of your app. IAP-protected services or applications\ncan only be accessed by\n[principals](/iam/docs/overview#concepts_related_identity)\nwhich have the correct\n[IAM role](/iam/docs/understanding-roles).\nWhen a user tries to access an IAP-secured resource,\nIAP performs authentication and authorization checks for you.\nLearn how IAP secures your application resources on the\n[IAP overview](/iap/docs/concepts-overview).\n\nIAP doesn't protect against activity\nwithin a project, such as one App Engine service accessing another\nservice in the same project.\n\nThis solution is best if you want to use Google user accounts and\nIAM to authorize user access.\n\nTo learn how to configure IAP for your App Engine\nresources, see the\n[IAP quickstart](/iap/docs/authenticate-users-google-accounts).\n\nOther authentication services\n-----------------------------\n\n[Auth0](https://auth0.com/) provides authentication with various identity\nproviders and single sign-on features."]]
