如果您在混合云或多云端环境中使用 Google 服务，若要满足这些需求，您可能需要将 Google 的 IAM 功能与外部身份管理解决方案或身份提供商（如 Active Directory）集成。参考架构文档介绍了 Google Workspace 或 Cloud Identity 如何助您实现此类集成。
您的部分员工可能依赖于 Gmail 账号或其他消费者用户账号来访问公司资源。不过，使用这些类型的用户账号可能不符合您的个别需求或政策，因此，您可以将这些用户迁移到 Google Workspace 或 Cloud Identity。如需了解详情，请参阅评估现有用户账号和评估初始配置方案。
如需获取如何采用 Google Workspace 或 Cloud Identity 方面的帮助，请参阅我们的评估和规划指南，了解如何弄清自己的需求以及如何完成采用流程。
[[["易于理解","easyToUnderstand","thumb-up"],["解决了我的问题","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["很难理解","hardToUnderstand","thumb-down"],["信息或示例代码不正确","incorrectInformationOrSampleCode","thumb-down"],["没有我需要的信息/示例","missingTheInformationSamplesINeed","thumb-down"],["翻译问题","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["最后更新时间 (UTC)：2024-07-11。"],[[["\u003cp\u003eIdentity and access management (IAM) involves granting appropriate access to the right individuals for the right resources, which encompasses corporate, customer, and service identities.\u003c/p\u003e\n"],["\u003cp\u003eIAM's foundation consists of managing corporate identities for employees, customer identities for user interaction, and service identities for application interactions, covering identity management processes like provisioning, authentication, and migration.\u003c/p\u003e\n"],["\u003cp\u003eAccess management focuses on granting, revoking, and auditing access to resources, managing permissions, and enforcing access control for Google services, Google Cloud resources, and custom applications.\u003c/p\u003e\n"],["\u003cp\u003eGoogle Workspace and Cloud Identity help manage corporate identities, while Google Cloud service accounts and Kubernetes service accounts manage application identities, and Identity Platform manages customer identities.\u003c/p\u003e\n"],["\u003cp\u003eManaging access to resources includes using IAM to control corporate identities' access to Google services and Google Cloud and using IAP, Sign-In With Google, OAuth 2.0, or OpenID Connect for custom workloads and applications.\u003c/p\u003e\n"]]],[],null,["# Overview of identity and access management\n\nIdentity and access management (generally referred to as *IAM*) is the practice\nof granting the right individuals access to the right resources for the right\nreasons. This series explores the general practice of IAM and the individuals\nwho are subject to it, including the following:\n\n- **Corporate identities:** The identities that you manage for employees of your organization. These identities are used for signing in to workstations, accessing email, or using corporate applications. Corporate identities might also include non-employees such as contractors or partners that need access to corporate resources.\n- **Customer identities:** The identities that you manage for users in order to interact with your website or customer-facing applications.\n- **Service identities:** The identities that you manage in order to enable applications to interact with other applications or the underlying platform.\n\nYou might need to grant access to the following resources:\n\n- Google services such as Google Cloud, Google Analytics, or Google Workspace\n- Resources in Google Cloud, such as projects, Cloud Storage buckets, or virtual machines (VMs)\n- Custom applications or resources managed by such applications\n\nThe guides in this series break down the discussion of IAM into the following\nparts:\n\n- Managing corporate, customer, and service identities forms the foundation of IAM. These topics are boxes 4, 5, and 6 (in green).\n- Relying on identity management as the foundation, boxes 2 and 3 (in blue) denote access management topics. These topics include managing access to Google services, to Google Cloud resources, and to your custom workloads and applications.\n- Box 1 (in yellow) indicates access management topics that are beyond the scope of these guides. To learn about access management for [Google Workspace](https://workspace.google.com/), [Google Marketing Platform](https://marketingplatform.google.com/about/), and other services, see the individual product documentation.\n\nIdentity management\n-------------------\n\nIdentity management focuses on the following processes:\n\n- Provisioning, managing, migrating, and deprovisioning identities, users, and groups.\n- Enabling secure authentication to Google services and to your custom workloads.\n\nThe processes and technologies differ depending on whether you are dealing with\ncorporate identities, application identities, or customer identities.\n\n### Manage corporate identities\n\nCorporate identities are the identities that you manage for your organization's\nemployees. Employees use these identities for signing in to workstations,\naccessing email, or using corporate applications.\n\nIn the context of managing corporate identities, the following are typical\nrequirements:\n\n- Maintaining a single place to manage identities across your organization.\n- Enabling employees to use a single identity and single sign-on across multiple applications in a hybrid computing environment.\n- Enforcing policies such as multi-factor authentication or password complexity for all employees.\n- Meeting compliance criteria that might apply to your business.\n\n[Google Workspace](https://workspace.google.com/)\nand\n[Cloud Identity](/identity)\nare Google's products that let you address these requirements and centrally\nmanage identities and policies.\n\nIf you use Google services in\n[a hybrid or multi-cloud context](/architecture/hybrid-multicloud-patterns),\naddressing these requirements might require that you integrate Google's IAM\ncapabilities with external identity management solutions or identity providers\nsuch as Active Directory. The\n[Reference architectures](/architecture/identity/reference-architectures)\ndocument explains how Google Workspace or Cloud Identity let you\nrealize such an integration.\n\nSome of your employees might rely on Gmail accounts or other consumer user\naccounts to access corporate resources. Using these types of user accounts might\nnot comply with your individual requirements or policies, however, so you can\nmigrate these users to Google Workspace or Cloud Identity. For\nmore details, see\n[Assessing your existing user accounts](/architecture/identity/assessing-existing-user-accounts)\nand\n[Assessing onboarding plans](/architecture/identity/assessing-onboarding-plans).\n\nTo help you adopt Google Workspace or Cloud Identity, see our\n[assessment and planning](/architecture/identity/overview-assess-and-plan)\nguides for guidance on how to access your requirements and how to approach the\nadoption process.\n\n### Manage application identities\n\nApplication identities are the identities that you manage in order to let\napplications interact with other applications or with the underlying platform.\n\nIn the context of managing application identities, the following are typical\nrequirements:\n\n- Integrating with third-party APIs and authentication solutions.\n- Enabling authentication across environments in a hybrid or multi-cloud scenario.\n- Preventing leakage of credentials.\n\nGoogle Cloud lets you manage application identities, and address these\nrequirements, by using\n[Google Cloud service accounts](/architecture/identity/overview-google-authentication#service_account)\nand\n[Kubernetes service accounts](/architecture/identity/overview-google-authentication#kubernetes_service_account).\nFor more information about service accounts and best practices for using them,\nsee the\n[Understanding service accounts](/iam/docs/understanding-service-accounts).\n\n### Manage customer identities\n\nCustomer identities are the identities that you manage for users to let them\ninteract with your website or customer-facing applications. Managing customer\nidentities and their access is also referred to as *customer identity and access\nmanagement (CIAM)*.\n\nIn the context of managing customer identities, the following are typical\nrequirements:\n\n- Letting customers sign up for a new account but guarding against abuse, which might include detecting and blocking the creation of bot accounts.\n- Supporting [social sign-on](https://en.wikipedia.org/wiki/Social_login) and integrating with third-party identity providers.\n- Supporting multi-factor authentication and enforcing password complexity requirements.\n\nGoogle's\n[Identity Platform](/identity-platform)\nlets you manage customer identities and address these requirements. For more\ndetails on the feature set and how to integrate Identity Platform with your custom\napplications, see the\n[Identity Platform documentation](/identity-platform/docs).\n\nAccess management\n-----------------\n\nAccess management focuses on the following processes:\n\n- Granting or revoking access to specific resources for identities.\n- Managing roles and permissions.\n- Delegating administrative capabilities to trusted individuals.\n- Enforcing access control.\n- Auditing accesses that are performed by identities.\n\n### Manage access to Google services\n\nYour organization might rely on a combination of Google services. For example,\nyou might use Google Workspace for collaboration, Google Cloud for\ndeploying custom workloads, and Google Analytics for measuring\nadvertising success metrics.\n\nGoogle Workspace or Cloud Identity lets you centrally control\nwhich corporate identities can use which Google services. By restricting access\nto certain services, you establish a base level of access control. You can then\nuse the access management capabilities of the individual services to configure\nfiner-grained access control.\n\nFor more details, read about how to\n[control who can access Google Workspace and Google services](https://support.google.com/a/answer/182442?hl=en&ref_topic=1227583).\n\n### Manage access to Google Cloud\n\nIn Google Cloud, you can use\n[IAM](/iam)\nto grant corporate identities granular access to specific resources. By using\nIAM, you can implement the security principle of *least\nprivilege*, where you grant these identities permissions to access only the\nresources that you specify.\n\nFor more information, see the\n[IAM documentation](/iam/docs/overview).\n\n### Manage access to your workloads and applications\n\nYour custom workloads and applications might differ based on the audience they\nare intended for:\n\n- Some workloads might cater to corporate users---for example, internal line-of-business applications, dashboards, or content management systems.\n- Other applications might cater to your customers---for example, your website, a customer self-service portal, or backends for mobile applications.\n\nThe right way to manage access, enforce access control, and audit access\ndepends on the audience and the way you deploy the application.\n\nTo learn more about how to protect applications and other workloads that cater\nto corporate users, see the\n[IAP documentation](/iap/docs/concepts-overview).\n\nYou can also\n[directly integrate Sign-In With Google](https://developers.google.com/identity/gsi/)\nor use standard protocols such as\n[OAuth 2.0](https://developers.google.com/identity/protocols/OAuth2)\nor\n[OpenID Connect](https://developers.google.com/identity/protocols/OpenIDConnect).\n\nYou can find out how to enforce access to APIs in\n[Istio](/istio)\nand\n[Cloud Endpoints](/endpoints)\ndocumentation. You can use both products whether your applications cater to\ncorporate users or to end users.\n\nWhat's next\n-----------\n\n- Understand the concepts and capabilities of identity management by reading the **Concepts** section.\n- Learn about prescriptive guidance to consider in your architecture or design by reading the **Best practices** section.\n- Learn how to assess your requirements and identify a suitable design by reading the **Assess and plan** section."]]
