[[["容易理解","easyToUnderstand","thumb-up"],["確實解決了我的問題","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["難以理解","hardToUnderstand","thumb-down"],["資訊或程式碼範例有誤","incorrectInformationOrSampleCode","thumb-down"],["缺少我需要的資訊/範例","missingTheInformationSamplesINeed","thumb-down"],["翻譯問題","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["上次更新時間：2025-08-21 (世界標準時間)。"],[[["\u003cp\u003eThis guide outlines how to sign in to the Google Cloud CLI using a browser-based sign-in with a federated identity.\u003c/p\u003e\n"],["\u003cp\u003eYou can sign in using workforce identity pool and provider IDs, an existing login configuration file, or provided configuration file contents.\u003c/p\u003e\n"],["\u003cp\u003eA login configuration file can be created using \u003ccode\u003egcloud iam workforce-pools create-login-config\u003c/code\u003e, including the option to activate it as the default with the \u003ccode\u003e--activate\u003c/code\u003e flag.\u003c/p\u003e\n"],["\u003cp\u003eTo sign in with a login configuration file, use \u003ccode\u003egcloud auth login --login-config="LOGIN_CONFIG_FILE_PATH"\u003c/code\u003e, or simply \u003ccode\u003egcloud auth login\u003c/code\u003e if the file has been activated previously.\u003c/p\u003e\n"],["\u003cp\u003eThe login configuration file should be secured due to the potential risk of credential interception if a malicious actor modifies the file.\u003c/p\u003e\n"]]],[],null,["# Sign in to the gcloud CLI with your federated identity\n\nThis document describes how to sign in to the Google Cloud CLI with your\nfederated identity by using a browser-based sign in.\n\nBefore you begin\n----------------\n\n1. Ensure that your administrator has set up and configured [Workforce Identity Federation](/iam/docs/workforce-identity-federation).\n\n2. Ensure that you have information that supports one of the following options.\n Your administrator can provide this information.\n\n - **Workforce identity pool and provider IDs** : a workforce identity pool ID\n and a workforce identity pool provider ID that you can use to [create a login configuration file](#use-pool-provider-ids).\n\n - **Existing configuration file** : a path to an existing login configuration\n file that you can use to [sign in to the gcloud CLI](#sign-in-gcloud).\n\n - **Configuration file contents** : configuration file contents that you can\n [save to a configuration file](#save-configuration-file).\n\nObtain a login configuration file\n---------------------------------\n\nThis section describes how you can obtain a login configuration file that you\ncan use to sign in to the gcloud CLI.\n\n### Create a login configuration file\n\nYou can use the workforce identity pool ID and workforce identity pool provider\nID to create a login configuration file.\n\n\nTo create the login configuration file, run the following command. You can optionally activate\nthe file as the default for the gcloud CLI by adding the\n[`--activate` flag](/sdk/gcloud/reference/iam/workforce-pools/create-login-config).\nYou can then run `gcloud auth login` without specifying\nthe configuration file path each time. \n\n```bash\ngcloud iam workforce-pools create-login-config \\\n locations/global/workforcePools/WORKFORCE_POOL_ID/providers/PROVIDER_ID \\\n --output-file=LOGIN_CONFIG_FILE_PATH\n```\n\nReplace the following:\n\n- \u003cvar translate=\"no\"\u003eWORKFORCE_POOL_ID\u003c/var\u003e: the workforce pool ID\n- \u003cvar translate=\"no\"\u003ePROVIDER_ID\u003c/var\u003e: the provider ID\n- \u003cvar translate=\"no\"\u003eLOGIN_CONFIG_FILE_PATH\u003c/var\u003e: the path to a configuration file that you specify---for example, `login.json`\n\n\nThe file contains the endpoints used by the gcloud CLI to\nenable the browser-based authentication flow and set the audience to the\nIdP that was configured in the workforce identity pool provider. The file\ndoesn't contain confidential information.\n\nThe output looks similar to the following: \n\n```json\n{\n \"type\": \"external_account_authorized_user_login_config\",\n \"audience\": \"//iam.googleapis.com/locations/global/workforcePools/\u003cvar translate=\"no\"\u003eWORKFORCE_POOL_ID\u003c/var\u003e/providers/\u003cvar translate=\"no\"\u003eWORKFORCE_PROVIDER_ID\u003c/var\u003e\",\n \"auth_url\": \"https://auth.cloud.google/authorize\",\n \"token_url\": \"https://sts.googleapis.com/v1/oauthtoken\",\n \"token_info_url\": \"https://sts.googleapis.com/v1/introspect\",\n}\n```\n\n\n| **Caution:** We recommend that you first ensure that the contents of this file are correct and then safeguard the file---for example, by making it read-only and restricting access with an ACL. The file isn't validated; a malicious actor with write access to this file can change the endpoints and intercept credentials.\n\n\u003cbr /\u003e\n\nTo stop `gcloud auth login` from using this configuration file automatically, you can unset it by running `gcloud config unset auth/login_config_file`.\n\n\u003cbr /\u003e\n\nYou can now [sign in to the gcloud CLI](#sign-in-gcloud).\n\n### Save a login configuration file\n\nYou can save credential configuration file contents that were provided to you\nto a file. Note the path, and then [sign in to the gcloud CLI](#sign-in-gcloud).\n\nSign in to the gcloud CLI\n-------------------------\n\nTo sign in to the gcloud CLI with a login configuration file, run the\nfollowing command: \n\n gcloud auth login --login-config=\"\u003cvar translate=\"no\"\u003eLOGIN_CONFIG_FILE_PATH\u003c/var\u003e\"\n\nReplace \u003cvar translate=\"no\"\u003eLOGIN_CONFIG_FILE_PATH\u003c/var\u003e with the path to\nthe login configuration file, if you haven't activated this file before.\nHowever, if you have previously activated this file using the\n`--activate` flag, then you don't need to specify the file again.\nInstead, run the following command: \n\n gcloud auth login"]]
