[[["易于理解","easyToUnderstand","thumb-up"],["解决了我的问题","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["很难理解","hardToUnderstand","thumb-down"],["信息或示例代码不正确","incorrectInformationOrSampleCode","thumb-down"],["没有我需要的信息/示例","missingTheInformationSamplesINeed","thumb-down"],["翻译问题","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["最后更新时间 (UTC)：2025-08-20。"],[[["\u003cp\u003eGoogle Cloud offers several user authentication methods, including Identity Platform, Firebase Authentication, Google Identity Services for Web, OAuth 2.0 and OpenID Connect, Identity-Aware Proxy (IAP), and Users API, each tailored to different needs and use cases.\u003c/p\u003e\n"],["\u003cp\u003eIdentity Platform is recommended for new projects needing flexible authentication options, enterprise-grade features, and multiple authentication methods such as SAML, OIDC, email/password, social, phone, and custom auth.\u003c/p\u003e\n"],["\u003cp\u003eFirebase Authentication is suggested for rapid deployment and testing of user authentication, supporting various sign-in methods while requiring minimal code.\u003c/p\u003e\n"],["\u003cp\u003eGoogle Identity Services for Web is ideal for authenticating users based on their Google Accounts, or when using Google Admin console for domain management.\u003c/p\u003e\n"],["\u003cp\u003eIdentity-Aware Proxy (IAP) is best for using Google accounts and IAM to control user access by adding an authentication and authorization layer in front of app resources.\u003c/p\u003e\n"]]],[],null,["# Authenticating users\n\n\u003cbr /\u003e\n\n\u003cbr /\u003e\n\n\nGo Java Node.js PHP Python Ruby\n\nTo authenticate users in Google Cloud applications, Google offers the following\nuser authentication methods:\n\nIdentity Platform\n-----------------\n\n[Identity Platform](https://cloud.google.com/identity-platform) is a customer\nidentity and access management (CIAM) platform that lets organizations customize\nidentity and authentication for user sign-up and sign-in in their applications.\nIdentity Platform supports multiple authentication methods (SAML, OIDC,\nemail/password, social, phone, and custom auth) to provide flexible integration\noptions for any identity solution. Identity Platform is built on\nGoogle Cloud's global scale, performance, network, and security, and comes with\nan enterprise-grade support and SLA to meet the demands of virtually any app or\nservice.\n\nThis solution is best for most users who want flexible authentication options\nbased on reliable, enterprise-grade features and SLAs.\n\nIdentity Platform offers its own user identity system. If you're already using\nGoogle Workspace for your domain and want to authenticate users based on that\nlogin, you should use [Google Identity Services for Web](#google-sign-in).\n\nTo learn about integrating Identity Platform with App Engine, try the\nhow-to guide for [signing in users on\nApp Engine](/identity-platform/docs/web/app-engine).\n\nFirebase Authentication\n-----------------------\n\n[Firebase Authentication](https://firebase.google.com/docs/auth/) provides a\ndrop-in, customizable identity and authentication service for user sign-up and\nsign-in. Similar to Identity Platform, Firebase Authentication supports multiple\nauthentication methods (SAML, OIDC, email/password, social, mobile, and custom\nauth) to provide flexible integration options for any identity solution.\n\nFirebase Authentication differs from Identity Platform in that it lacks certain\nenterprise features. For more information, see\n[Differences between Identity Platform and Firebase Authentication](/identity-platform/docs/product-comparison).\n\nThis solution is best if you want the most lightweight way to set up user\nauthentication for an App Engine app. For many users, Firebase Authentication\nis the fastest way to implement or test authentication.\n\nTo learn more about Firebase Authentication, try the following:\n\n- [Firebase Web Tutorial](https://codelabs.developers.google.com/codelabs/firebase-web/)\n highlights how to use Firebase on a website, including user sign-in with Google\n as the Identity Provider.\n\n- [Firebase Quickstart Apps](https://firebase.google.com/docs/samples/) show\n how to integrate Firebase across platforms, using both federated sign-in and\n username/password sign-in examples. Samples demonstrate Firebase Authentication\n using the [JavaScript SDK](https://github.com/firebase/quickstart-js/tree/master/auth)\n as well as on [iOS](https://github.com/firebase/quickstart-ios/tree/master/authentication)\n and [Android](https://github.com/firebase/quickstart-android/tree/master/auth).\n\nGoogle Identity Services for Web\n--------------------------------\n\n[Google Identity Services for Web](https://developers.google.com/identity/gsi/web/guides/overview)\nis a sign-in client library for Google built on the OAuth 2.0 and OpenID Connect\nprotocols. It allows for quick and easy sign-in by providing a Sign in With\nGoogle button that appears on your website or app.\n\nThis solution is best if you want to authenticate users based on their Google\nAccount, or if you are using Google Admin console for your domain.\n\nOAuth 2.0 and OpenID Connect\n----------------------------\n\nOpenID Connect is an identity layer on top of the OAuth 2.0 protocol. Google\noffers an\n[implementation](https://developers.google.com/identity/protocols/oauth2)\nof OAuth 2.0 that conforms to the\n[OpenID Connect specification](http://openid.net/connect/) and is\n[OpenID Certified](http://openid.net/certification/). There are also several\n[other providers](https://en.wikipedia.org/wiki/OpenID_Connect#Adoption)\navailable.\n\nThis solution is best if you want total customization and control of your\nauthentication implementation.\n\nFor more information, see\n[OpenID Connect](https://developers.google.com/identity/openid-connect/openid-connect).\n\nIdentity-Aware Proxy (IAP)\n--------------------------\n\nUnlike the other authentication options that implement authentication within\nyour app, [IAP](/iap/docs/concepts-overview) protects and secures\nyour application by adding an IAM authentication and\nauthorization layer in front of your resources. This layer verifies inbound\nexternal requests before the app can be reached. Users who are not authorized\naccess to your app can't have access to reach your App Engine app.\n\nYou can enable IAP for your whole app, or for specific services\nor versions of your app. IAP-protected services or applications\ncan only be accessed by\n[principals](/iam/docs/overview#concepts_related_identity)\nwhich have the correct\n[IAM role](/iam/docs/understanding-roles).\nWhen a user tries to access an IAP-secured resource,\nIAP performs authentication and authorization checks for you.\nLearn how IAP secures your application resources on the\n[IAP overview](/iap/docs/concepts-overview).\n\nIAP doesn't protect against activity\nwithin a project, such as one App Engine service accessing another\nservice in the same project.\n\nThis solution is best if you want to use Google user accounts and\nIAM to authorize user access.\n\nTo learn how to configure IAP for your App Engine\nresources, see the\n[IAP quickstart](/iap/docs/authenticate-users-google-accounts).\n\nUsers API\n---------\n\n| **Note:** The Users API is only supported for Python, Java, Go, and PHP apps that use the [legacy bundled services](/appengine/docs/standard/bundled-services-overview).\n\nThe Users API allows an App Engine app to perform the following tasks:\n\n- Detect whether the current user is signed in using a Google Account.\n- Redirect the user to the appropriate sign-in page to sign in.\n- Request the user create a new Google Account if they don't have one already.\n\nWhile a user is signed in to the application, the app can access the user's\nemail address. The app can also detect whether the current user is an\nadministrator, making it easy to implement admin-only areas of the app.\n\nThis solution works well if you are upgrading an existing app from a\nfirst-generation runtime to a second-generation runtime, and want to continue\nto use the Users API. If you want the flexibility of moving to\nCloud Run or another Google Cloud app hosting platform later on,\nwe recommend migrating to a more modern user authentication solution.\n\nTo learn about integrating the Users API, see the\n[Users API overview](/appengine/docs/standard/services/users).\n\nOther authentication services\n-----------------------------\n\n[Auth0](https://auth0.com/) provides authentication with various identity\nproviders and single sign-on features."]]
