Go 1.11 已达到支持终止期限，将于 2026 年 1 月 31 日
弃用。弃用后，您将无法部署 Go 1.11 应用，即使您的组织之前曾使用组织政策重新启用旧版运行时的部署也是如此。现有的 Go 1.11 应用在
弃用日期之后将继续运行并接收流量。我们建议您
迁移到最新支持的 Go 版本。
对用户进行身份验证
使用集合让一切井井有条
根据您的偏好保存内容并对其进行分类。
为了对 Google Cloud 应用中的用户进行身份验证，Google 提供了以下方法：
| 身份验证服务 |
用途 |
| Firebase Authentication |
提供多种用户身份验证选项，包括 Google、Facebook 和 Twitter。这种验证方式支持的用户数量最多，而且需要维护的代码量最小。 |
| Google 登录 |
Google 登录可提供 Gmail 和 Google Workspace 账号登录机制并支持动态密码 (OTP)。这是支持 Google 专用账号或在现有登录系统中支持 Google 账号的最简单的方法。 |
| OAuth 2.0 和 OpenID Connect |
OpenID Connect 可让您从最底层开始处理和使用身份验证令牌，自定义程度最高。 |
| Google Cloud Identity Platform |
Identity Platform 是一个客户身份和访问权限管理 (CIAM) 平台，可帮助组织为应用添加身份和访问权限管理功能。此选项非常适合希望成为自己的身份提供商的用户。 |
| Users API
|
Users API 是用于对 Google 和 Google Workspace 账号进行身份验证的旧版捆绑服务之一。此内置 API 仅适用于 App Engine。 |
| Identity-Aware Proxy (IAP)
|
IAP 允许您在请求到达应用资源之前控制对 App Engine 服务的访问权限。您可以使用 IAP 为应用建立一个中央授权层，并使用签名标头或 App Engine Users API 来保护应用的安全。
与此表格中的其他身份验证服务不同，IAP 会先执行身份验证，然后应用才可供访问。本页面中的其他选项在应用中实现身份验证。 |
Firebase Authentication
Firebase 身份验证提供安全可靠的现成身份验证系统，支持您的用户使用任何想用的账号进行登录。除了使用 Google、Facebook、Twitter 等进行联合登录之外，Firebase 身份验证还支持密码身份验证，因而您可以随着桌面设备和移动设备用户数量的增长轻松扩大身份验证系统的规模。
Firebase 身份验证是为 Google App Engine 应用设置用户身份验证的最简单方法。如需详细了解 Firebase 身份验证，请参阅以下资源：
Google 登录
如果您想在自己的网站或应用中提供 Google 登录按钮，或者您的网域使用了 Google 管理控制台并且您希望根据其登录信息对用户进行身份验证，则可以使用 Google 登录，这是我们以 OAuth 2.0 和 OpenID Connect 协议为基础构建的登录客户端库。
Google 登录适用于 Web 应用、iOS 和 Android。
OAuth 2.0 和 OpenID Connect
Google 登录基于 Google 的 OAuth 2.0 实现，该实现符合 OpenID Connect 规范并已通过 OpenID 认证。
OpenID Connect 是以 OAuth 2.0 协议为基础构建的身份层，您的应用可以使用它来检索用户个人资料信息。
Identity Platform 提供可自定义的普适性身份和身份验证服务，为您处理用户注册和登录流程。Identity Platform 支持多种身份验证方法（SAML、OIDC、电子邮件地址/密码、社交媒体服务、电话号码和自定义身份验证），以便为各种身份验证解决方案提供灵活的集成选项。Identity Platform 以Google Cloud的全球规模、性能、网络和安全性为基础，提供企业级的支持和服务等级协议 (SLA)，可满足几乎所有应用或服务的需求。
Identity Platform 提供了自己的用户身份系统。如果您已为您的网域使用 Google Workspace，并且想要根据该登录信息对用户进行身份验证，则应使用 Google 登录。
如需了解如何将 Identity Platform 与 App Engine 集成，请参阅在 App Engine 上登录用户方法指南。
Users API
Users API 允许应用执行以下任务：
- 检测当前用户是否已登录。
- 将用户重定向到相应的登录页面进行登录。
- 如果用户还没有 Google 账号，则要求他们创建一个账号。
用户登录应用后，应用可以访问用户的电子邮件地址。应用还可以检测当前用户是否为管理员，从而轻松实现仅管理员能够访问的应用区域。
如需了解详情，请参阅 Users API 概览。
Identity-Aware Proxy (IAP)
对于入站外部请求，IAP 通过在资源的前面添加一个身份验证和授权层来保护应用的安全。IAP 无法针对项目内的活动提供保护，例如同一项目内的其他 App Engine 服务。未经授权的用户将无权访问您的 App Engine 应用。
受 IAP 保护的服务或应用只能由具有正确 Identity and Access Management (IAM) 角色的主账号访问。如果用户尝试访问受 IAP 保护的资源，IAP 会为您执行身份验证和授权检查。如需了解 IAP 如何保护应用资源，请参阅 IAP 概览。
您可以为整个应用、特定服务或应用版本启用 IAP。请参阅 IAP 快速入门，了解如何为 App Engine 资源配置 IAP。
如未另行说明，那么本页面中的内容已根据知识共享署名 4.0 许可获得了许可，并且代码示例已根据 Apache 2.0 许可获得了许可。有关详情，请参阅 Google 开发者网站政策。Java 是 Oracle 和/或其关联公司的注册商标。
最后更新时间 (UTC)：2025-08-20。
[[["易于理解","easyToUnderstand","thumb-up"],["解决了我的问题","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["很难理解","hardToUnderstand","thumb-down"],["信息或示例代码不正确","incorrectInformationOrSampleCode","thumb-down"],["没有我需要的信息/示例","missingTheInformationSamplesINeed","thumb-down"],["翻译问题","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["最后更新时间 (UTC)：2025-08-20。"],[[["\u003cp\u003eGoogle Cloud offers multiple authentication methods for applications, including Firebase Authentication, Google Sign-In, OAuth 2.0/OpenID Connect, Identity Platform, Users API, and Identity-Aware Proxy (IAP).\u003c/p\u003e\n"],["\u003cp\u003eFirebase Authentication provides a comprehensive system for user sign-in with various identity providers and is the simplest way to implement authentication for Google App Engine apps.\u003c/p\u003e\n"],["\u003cp\u003eGoogle Sign-In, built on OAuth 2.0 and OpenID Connect, is designed for easy integration of Google account logins into websites or apps, especially when using Google Admin console.\u003c/p\u003e\n"],["\u003cp\u003eIdentity Platform is a customizable customer identity and access management (CIAM) service that supports diverse authentication methods, providing flexible options for user sign-up and sign-in.\u003c/p\u003e\n"],["\u003cp\u003eIdentity-Aware Proxy (IAP) adds an external authentication and authorization layer to App Engine services, securing the application by verifying access rights before requests reach the application resources.\u003c/p\u003e\n"]]],[],null,["# Authenticating Users\n\nTo authenticate users in Google Cloud applications, Google offers the following\nmethods:\n\nFirebase Authentication\n-----------------------\n\n[Firebase Authentication](https://firebase.google.com/docs/auth/) gives you a\nrobust, secure authentication system-in-a-box that helps you do sign in with any\naccount your users want to use. Firebase Authentication supports password\nauthentication in addition to federated sign-in with Google, Facebook, Twitter,\nand more, allowing you to easily scale your authentication system as you grow on\ndesktop and mobile.\n\nFirebase Authentication is the easiest way to set up user authentication for a\nGoogle App Engine app. To learn more about Firebase Authentication, try the\nfollowing:\n\n- [Firebase Web Tutorial](https://codelabs.developers.google.com/codelabs/firebase-web/)\n highlights how to use Firebase on a website, including user sign-in with Google\n as the Identity Provider.\n\n- [Firebase Quickstart Apps](https://firebase.google.com/docs/samples/) show\n how to integrate Firebase across platforms, using both federated sign-in and\n username/password sign-in examples. Samples demonstrate Firebase Authentication\n using the [JavaScript SDK](https://github.com/firebase/quickstart-js/tree/master/auth)\n as well as on [iOS](https://github.com/firebase/quickstart-ios/tree/master/authentication)\n and [Android](https://github.com/firebase/quickstart-android/tree/master/auth).\n\nGoogle Sign-In\n--------------\n\nIf you want to provide a Google login button for your website or app, or you're\nusing Google Admin console for your domain and you want to authenticate users based\non that login, you can use [Google Sign-in](https://developers.google.com/identity/),\nwhich is our sign-in client library built on the OAuth 2.0 and OpenID Connect\nprotocols.\n\nGoogle Sign-In is available for\n[Web Apps](https://developers.google.com/identity/gsi/web/guides/overview),\n[iOS](https://developers.google.com/identity/sign-in/ios/),\nand [Android](https://developers.google.com/identity/sign-in/android/).\n\nOAuth 2.0 and OpenID Connect\n----------------------------\n\nGoogle Sign-in is based on Google's OAuth 2.0 implementation,\nwhich conforms to the [OpenID Connect specification](http://openid.net/connect/),\nand is [OpenID Certified](http://openid.net/certification/).\n\nOpenID Connect is an identity layer on top of the OAuth 2.0 protocol, and your\napp can use it to [retrieve user profile information](https://developers.google.com/identity/protocols/OpenIDConnect#obtaininguserprofileinformation).\n\nIdentity Platform\n-----------------\n\n[Identity Platform](https://cloud.google.com/identity-platform) provides a drop-in,\ncustomizable identity and authentication service for user sign-up and sign-in.\nIdentity Platform supports multiple authentication methods (SAML, OIDC,\nemail/password, social, phone, and custom auth) to provide flexible integration\noptions for any identity solution. Identity Platform is built on\nGoogle Cloud's global scale, performance, network, and security, and comes with\nan enterprise-grade support and SLA to meet the demands of virtually any app or\nservice.\n\nIdentity Platform offers its own user identity system. If you're already using\nGoogle Workspace for your domain and want to authenticate users based on that\nlogin, you should use [Google Sign-In](#google_sign-in).\n\nTo learn about integrating Identity Platform with App Engine, try the\nhow-to guide for [signing in users on\nApp Engine](https://cloud.google.com/identity-platform/docs/web/app-engine).\n\nUsers API\n---------\n\nThe Users API allows an application to perform the following tasks:\n\n- Detect whether the current user is signed in.\n- Redirect the user to the appropriate sign-in page to sign in.\n- Request the user create a new Google account if they don't have one already.\n\nWhile a user is signed in to the application, the app can access the user's\nemail address. The app can also detect whether the current user is an\nadministrator, making it easy to implement admin-only areas of the app.\n\nMore information is available on the [Users API overview](../users).\n\nIdentity-Aware Proxy (IAP)\n--------------------------\n\nIAP protects and secures your application by adding an\nauthentication and authorization layer in front of your resources, for\ninbound external requests. IAP doesn't protect against activity\nwithin a project, such as another App Engine service inside the same\nproject. Users who are not authorized access to your app can't have access to\nreach your App Engine app.\n\nIAP-protected services or applications, can only be accessed by [principals](/iam/docs/overview#concepts_related_identity)\nwhich have the correct [Identity and Access Management (IAM) role](/iam/docs/understanding-roles).\nWhen a user tries to access an IAP-secured resource, IAP\nperforms authentication and authorization checks for you. Learn how\nIAP secures your application resources on the [IAP overview](/iap/docs/concepts-overview).\n\nYou can enable IAP for your whole app, or for specific services\nor versions of your app. See the [IAP quickstart](/iap/docs/authenticate-users-google-accounts)\nto learn how to configure IAP for your App Engine\nresources."]]
