9 ms·

Cloud Identity

• andridk 9y ago
  How does this compare to Firebase Auth?
  • bpicolo 9y ago
    Entirely different, this is an okta/onelogin competitor.
• Tepix 9y ago
  Please don't force your users to identify themselves to Google or Facebook. Always provide an alternative.
  • jfasi 9y ago
    > users I'm pretty sure this is aimed at enterprise applications.
    • Tepix 9y ago
      Forcing your employees to be tracked by Google is even worse. They can hardly opt out. I wouldn't be surprised if it's illegal in Europe if a company forces this upon its employees.
      • bognition 9y ago
        They're likely already using google apps
      • lagadu 9y ago
        You don't get it: this is enterprise software. People would login (and only have access) with their enteprise accounts, not their personal ones.
        • Tepix 9y ago
          You're saying that having Google manage the identities will not provide Google with all the data and perhaps even make them trackable by Google? What makes you think so? Cloud identity doesn't appear to be something that you deploy in your network and that is completely isolated from the Google cloud. Quite the contrary.
          • lagadu 9y ago
            Whatever google can or cannot do with the data depends on their ToS but that is a problem for the company that contracts them to deal with as it's their data; not the users. Most importantly, virtually all PaaS and SaaS solutions (office365 being the most well-known) already operate like that; on-prem services are getting pretty scarce nowadays on the enterprise world.
        • natch 9y ago
          I think he/she gets it. It is possible to run your enterprise without using Google software that forces users to pour even more of their data into Google's grasp. So I think the OP was saying that it would be desirable for those enterprises to allow employees an alternative, for those who do not wish to share even more with Google.
          • Gigablah 9y ago
            Why does it matter whether they want to share their work data with Google? It's their company's decision. Their company owns the data. I hope you realize the insanity of the following exchange: "Bob, you should enter your sick leave in Workday." "But I don't want that company know about my sick days. Can I use something different instead?"
            • icebraining 9y ago
              Actually, that example doesn't sound at all insane to me. What if Workday then sells the information that I'm sick a lot to future prospective employers or to health insurers? The employer should have a duty to adequately protect that information. It's not just "their" data.
      • kristiandupont 9y ago
        This looks like an alternative to the typical Active Directory/Exchange setup that many large corporations run.
  • bognition 9y ago
    This is about enterprises managing user accounts.
• bognition 9y ago
  Frankly I'm surprised its taken google so long to release this. I've used Okta for years and love it. Not only does it make it easy for an org to revoke a users credentials across the board it makes it easier for users to log into every service without remembering another password.
• therealmarv 9y ago
  Bad timing
• johns 9y ago
  I think this is the result of the Bitium acquisition.
• polskibus 9y ago
  How does this compare to auth0 (https://auth0.com/ https://auth0.com/). Is this a direct competitor?
  • strangemonad 9y ago
    I’ve deployed Auth0 in production before (and quickly glanced through gcloud identity). This seems aimed at larger enterprises (both in terms of features and pricing). Imagine an enterprize trying to deploy ldap or active directory in the cloud age and keeping all accounts in sync with various SaaS. Auth0 can be used that way but with some work. It really shines when you want to build saas that requires user login. Auth0 is worth every penny (priced by active logins) but I’d be hard pressed to spend 4$ per user if I’m building a consumer saas (but 4$ per employee login is reasonable).
    • mindfulmonkey 9y ago
      Google Identity is not going to be the right solution for integration with other AD/LDAP stores. Really big companies will often have multiple AD/LDAP identity stores with enterprise grade provisioning systems (Sailpoint, Oracle Identity Manager) to keep accounts in sync. This offering from Google is meant as a replacement for AD/Exchange(obviously) for companies that are mid-small. It also offers provisioning to other apps but only those that support SAML Just-In-Time provisioning. I did not immediately see a way to add custom apps to this (for provisioning), so might be limited to just the OOTB apps they provide (List: https://support.google.com/cloudidentity/topic/7661972 https://support.google.com/cloudidentity/topic/7661972) Auth0 today offers SAML integrations and if the target system supports JIT Provisioning, it will work the same as google. And just to clarify, Google's offering is 100% meant for internal users (employees, anyone that you'd give a Google Apps account to)
  • scrollaway 9y ago
    Didn't Google already have an SSO solution? I'm using it in GSuite at our company. Or was it restricted to only GSuite? Edit: BTW, I see this can be set up for Github Business. Does github.com not support SAML?
• tammer 9y ago
  Anyone compared this to Azure AD?
• joeblau 9y ago
  Is this like One Login?
  • manigandham 9y ago
    Yes
• AhtiK 9y ago
  I keep wondering why is the pricing of this, auth0 etc so high, is this mostly for the employees and smaller groups? I can't see paying $6/mo/user to manage users for a non-enterprise SaaS offering.
  • deleted 9y ago
    [deleted]
  • Touche 9y ago
    It's so bizarre there must be some mistake. Does this do significantly more than AWS Cognito which free for the first 50k users? https://aws.amazon.com/cognito/ https://aws.amazon.com/cognito/ This price point doesn't make sense outside of the niche SaaS offerings that can charge in the thousands per month.
    • moduspwnens14 9y ago
      Cognito doesn't address the same use case. You're seeing Cognito User Pool pricing. Cognito User Pools is basically having AWS host your user / password / details database for an app you're building. It takes care of some details like verifying e-mail addresses / phone numbers and integrates with Cogito Federated Identities, which makes it easy for your app to (for example) allow login via Google, Facebook, or an account they create (which is stored in that user pool). This Google service looks more comparable to Okta or auth0. That is like if you're a sysadmin at a big company and you want one place where your users can be authenticated, which can then allow access to all of the web apps you use (Dropbox, Salesforce, Gmail, etc.). EDIT: And to tie them together a little: If you were building a web app using Cognito, you could likely add a federated identity via Okta, auth0, or this Google service, which would then allow your users to log in directly to your service through that without having to create / manage an account separately.
    • gtsteve 9y ago
      The equivalent AWS product is AWS SSO [0] which requires a Directory Service instance (circa $100/mo) [0]https://aws.amazon.com/single-sign-on/ https://aws.amazon.com/single-sign-on/
    • 9y ago
• nartz 9y ago
  If any google developers are out there - it would be great to be able to try this service out without having to type in a ton of information to get started - i just want to log in and see how it works - how it compares to IAM, auth0, etc.
• gumby 9y ago
  Given the recently revealed consequences of people using a major third party (Facebook) for user authentication is this really going in the right direction?
  • gk1 9y ago
    This is about managing the identities and permissions of employees, not end-users.
    • gumby 9y ago
      I do understand that, but you are outsourcing a linchpin of your infrastructure to a third party. Are these identities completely disjoint with regular google ones or are they comingled (i.e. do you need two different browsers to read your work gmail and your personal gmail?)
      • icebraining 9y ago
        Yes, they are disjoint, and no, you don't need two browsers, Gmail can handle two different accounts in the same browser simultaneously nowadays.
• deleted 9y ago
  [deleted]
• manigandham 9y ago
  This is for companies to manage access for their own employees and other corporate users. If you use G-Suite, then you already have this and can login with your company email account to many external apps without a separate password. It makes sense that Google is extracting it into a separate product but most companies just stick with whatever their productivity software provider is, like G-Suite or Microsoft Office 365. Many companies also use OneLogin or Okta for extra customization on top of G-Suite/O365.
  • dragonwriter 9y ago
    > It makes sense that Google is extracting it into a separate product but most companies just stick with whatever their productivity software provider is, like G-Suite or Microsoft Office 365. While available standalone, this is explicitly pitched also as an upgrade (Premium Edition) to what is included with GSuite (which is Cloud Identity Free Edition).
    • manigandham 9y ago
      Yes, like I said most companies pick onelogin/okta for that layer on top, which have even more features and customization. It's also further complicated by the fact that GSuite and Office 365 have multiple tiers with more identity features and the Cloud Identity Premium edition seems to be 90% about mobile device management.
  • m-p-3 9y ago
    We use G Suite and even though it provides identity services, our master is still Active Directory. I'm not in charge of these systems, but I'm wondering how viable it would be to use this as the master source and have AD retrive identity data from it instead.
  • jonathansorum 9y ago
    From this comparison table, you can see the differences between Cloud Identity Free (included in G Suite) and the features in the separate product Cloud Identity Premium https://support.google.com/cloudidentity/answer/7431902 https://support.google.com/cloudidentity/answer/7431902
• relaunched 9y ago
  Is this a re-brand of Google's Beyond Corp?
  • manigandham 9y ago
    Beyond Corp isn't a product, it's a security model where you treat everything as a publically accessible resource without any special intranets, VPNs or other gateways. Employees use your apps the same way your customers do. Internal apps would obviously be limited to company accounts, but this simplifies security and deployment by reusing the same infrastructure and oversight across both public and private apps.
    • relaunched 9y ago
      It also might be a product, Google's Identity Aware Proxy (IAP). https://cloud.google.com/iap/ https://cloud.google.com/iap/
      • manigandham 9y ago
        Sure. It's not a BeyondCorp product but a way to implement the BeyondCorp security model. These are all separate pieces of architecture: 1) Corporate user database with access rights and permissions. This can be Google's G-Suite if you're already using it or this new Cloud Identity product. 2) Access to external corporate apps (like Salesforce) using OpenID or SAML connections with the above mentioned user system. 3) Access to internal or custom-built corporate apps (like a sales dashboard). You can use the APIs and build it into your app or use the IAP product to act as a smart firewall that will handle the authentication for you and just give your app a simple HTTP header with the user's name/email so you don't need to build any user auth in the app itself.
    • fortyfivan 9y ago
      Disclaimer: I work at ScaleFT - we offer BeyondCorp-like access controls as a service for servers (SSH & RDP) and internal web apps. Exactly right... BeyondCorp is more of a reference architecture than a product. Google's own internal implementation is what the research papers focus on, but we're seeing more companies adopt similar models by shifting access controls to the application layer, where a request can be independently authenticated (corporate IdP) and authorized (RBAC, policies) against more dynamic conditions - such as the security posture of the user's device. The Identity piece is a critical component to the system as the user system of record, but really just one of the inputs in a BeyondCorp-like environment.
• dvh 9y ago
  Technical note: when you submit post about Google service on HN always write in the title whether it is new service or cancelled service. Thank you.
  • rdsubhas 9y ago
    beta or tata.
• singhrac 9y ago
  Anyone else notice that they're now rolling out Product Sans / Google Sans on new branding pages (News Initiative, here, etc.)? I personally like it a lot, but I wish I could use it (I guess I can always use Futura and tinker a bit).
• akurilin 9y ago
  Wish this had come out a few months back when we rolled out Okta to the entire org and moved away from Google being the main identity provider. Wonder if it's worth now to roll that back and have Google be the point of entry? One of the things that I appreciate about Okta is that it sends pretty clear onboarding and 2FA enabling instructions, which I believe G Suite left up to you. Signup into a 2FA-mandated G Suite account was always tricky, having to use recovery codes to get in for the first time. It was terrifying to non-technical users. The one advantage I can think of, of Google vs Okta/auth0 etc is that most SaaS products seem to give you Google SSO for free, but charge the full enterprise pricing for SAML. e.g. Asana and Slack will not let you SAML from Okta unless you upgrade to their most expensive tier, but Google SSO is always free.
  • pm90 9y ago
    My personal advice: don't move back unless you have a good reason to. If you're a big enough customer to talk directly to a Google sales person, use that as a bargaining chip to get a cheaper offer.
• horsecaptin 9y ago
  It is becoming more and more difficult to trust companies that have their fingers in too many pies.
• tomashertus 9y ago
  I find it very interesting that it took Google such a long time to introduce this service. They had to have a SSO implementation in place for years and with such lucrative prices in the identity market(all products are around $4/user a month) it is low-hanging fruit for Google and seems like obvious step. In addition, many companies are already tight to GSuite and GMail, so I assume another Google Service will be easy to adopt. Would be interesting to see how this will affect Okta and other direct competitors such as Ping Identity, Janrain and Centrify in the long term. I really like their "Google-grade Security" marketing! Edit: Spelling
  • puzzle 9y ago
    Yeah, I asked Eric Sachs (who runs the identity efforts at Google) and others a few times over the years. They always directed me to Okta, Ping, etc.
    • kjgkjhfkjf 9y ago
      Eric Sachs no longer runs identity at Google. You have your explanation why right here.
      • puzzle 9y ago
        Hah, interesting. His old site is still up https://sites.google.com/site/ericsachs2/ https://sites.google.com/site/ericsachs2/ but at least his LinkedIn page is up to date. Thanks!
  • hb3b 9y ago
    They acquired Bitium. An identity as a service is in the works. Since the Oktas and Onelogins have virtual LDAPs I’m sure that will be coming as well.
• kyrra 9y ago
  This seems to be a single product of many things announced today. There were 2 Cloud blog posts covering things that happened[0][1]. It seems to all be GSuite/Cloud focused, but there are some big things in there if you use these. Stuff like FedRAMP Rev. 4, Access Transparency reporting, security partnerships, and other stuff. [0] https://cloudplatform.googleblog.com/2018/03/introducing-new-ways-to-protect-and-control-your-GCP-services-and-data.html https://cloudplatform.googleblog.com/2018/03/introducing-new... [1] https://cloudplatform.googleblog.com/2018/03/expanding-our-Google-Cloud-security-partnerships.html https://cloudplatform.googleblog.com/2018/03/expanding-our-G...
• arca_vorago 9y ago
  This seems promising. I've been the google superadmin on a few companies and the fight between AD/LDAP and other services and online applications was always hackish. I wonder if the sync is still using this: https://support.google.com/a/answer/106368?hl=en https://support.google.com/a/answer/106368?hl=en The benefit was that AD was the authority, so companies still felt "in control". If Cloud Identity is moving authority over to google, that might be an issue, but if it does it well, probably not so much. The entire LDAP/AD/SSO area is ripe for disruption, because far too many companies are trying to be google and force it all online. Many companies would just be happy with a robust on-premise solution that could replace or augment the others completely. Don't get me started on radius...
  • r00fus 9y ago
    LDAP/AD and SSO are two different beasts. Everyone uses SAML in my experience and it's a bit clunky but it works and the edge cases are fairly well known. Is this actually a competitor to AD?
    • arca_vorago 9y ago
      I don't think it's designed as a competitor to AD, but rather to smooth the AD-cloud user transition, especially as more and more companies buy into SaaS like O365/GApps, etc. You are right about SAML of course, but my point is how the lines between SSO/SAML etc and AD/LDAP etc are getting blured because companies want them to essentially work as a single unit. Here are a couple of the interesting alternatives in the arena: https://github.com/apereo/cas https://github.com/apereo/cas https://www.univention.com/products/ucs/ https://www.univention.com/products/ucs/ https://www.shibboleth.net/ https://www.shibboleth.net/ https://wso2.com/ https://wso2.com/ One of my planned side projects is to test each of these.
• eyepulp 9y ago
  I don't see Gitlab explicitly listed as a supported service, but wonder if that would be supported or require google or gitlab to make the integration happen. (This is on a GL EE instance we manage). And what about public-facing web apps developed in-house? Can we add SAML integrations that would work with this for employee access? These are probably basic questions, but I couldn't seem to find the details on the site.
  • manigandham 9y ago
    Gitlab already has several plugins for auth, for example you can use OmniAuth to have users login with an external identity provider: https://docs.gitlab.com/ee/integration/omniauth.html https://docs.gitlab.com/ee/integration/omniauth.html No extra products needed if they're already using one of those supported providers. OpenID Connect makes things much simpler than traditional SAML unless you need all the extra enterprise provisioning features.
    • eyepulp 9y ago
      Ah - cool. That makes sense!
• hoodoof 9y ago
  The linked page is not clear on what this actually is. Which AWS service is it the same as?
  • Yeroc 9y ago
    Not sure about AWS but it looks like an answer to Microsoft's Azure AD hosted services.
• tambourine_man 9y ago
  Page is broken on iPhone SE. Overflow hidden larger than viewport. Unfortunately, poor mobile usability on their dev sites is very common for Google, which is something I could never understand
• altmind 9y ago
  just last week i worked on integrating google4business and aws login. in the end of the day, i spend half of a day and had never made this work. one of the steps of their's guide required to create oauth application, assign it some specific scopes and use their api browser to submit some jsons to create some custom attributes for the company users. i spend the whole time figuring out how their oauth works and why their api endpoint authentication never worked for me. the whole experience left me with a feel of extreme complexity and I feel completely lost in oauth and SAML. i just checked the guides and it seems there are no changes to the aws integration guide - integration mechanism for aws is still the same :(
• deleted 9y ago
  [deleted]
• staticfish 9y ago
  For the uninformed, how is this different to implementing Google Oauth?
• askvictor 9y ago
  Do I understand correctly that this is basically G-Suite without the apps? Or are there extra features in this (if so, are those coming to G-Suite as well? I recently redid the identity system for my organisation. Despite using G-Suite as our productivity platform, we ended up going with AzureAD for our identity services for these reasons: * We needed RADIUS services. No way to get those from Google. It's messy with AzureAD (you need to run AzureAD Domain Services and an NPS server in a VM), but possible. * A lot of SAML app vendors only seem to know about the existence of (i.e. have built their SAML implementation based around) ADFS (which is close enough to AzureAD). Those either outright didn't work with Google, or involved a messy workaround and a heap of time. * G-Suite only allows for OU-based access control to SAML apps (unless you want to implement and maintain some code to do this for you, which kind of defeats the point of cloud-based identity IMO). AzureAD can do this by groups or even ad-hoc users.
  • manigandham 9y ago
    This is an extra service, the same way you can use Onelogin or Okta on top of G-Suite to do federation and syncing. There's a free tier which is already included in G-Suite or Google Cloud and the premium tier which has more control: https://support.google.com/cloudidentity/answer/7319251 https://support.google.com/cloudidentity/answer/7319251
    • askvictor 9y ago
      Still not entirely certain of the link between this and G-Suite. Do I understand correctly that G-Suite includes Cloud Identity (Free edition), but Premium addition is an optional add on to G-Suite? But both Free and Premium versions of Cloud Identity can be used without a G-Suite subscription? So the Free version is basically G-Suite without the productivity Apps? The site doesn't really make it clear what the Free Tier does, and seems to be pushing hard to sign up for the Free trial of premium.
      • manigandham 9y ago
        Yes, yes and yes. The marketing sucks and the documentation is a confusing mess, but this is what it looks like: 1) Cloud Identity Free = User accounts, SSO, with Google or external identity provider. 2) Cloud Identity Premium = Advanced user management, device control, compliance, reporting, etc. 3) G-Suite Productivity Apps 4) Google Cloud Platform G-Suite or GCP include Identity Free Edition, but you can use Identity on its own. And then you can always upgrade it to Premium edition for more control. https://support.google.com/cloudidentity/answer/7431902 https://support.google.com/cloudidentity/answer/7431902