User Auth - Google Cloud Identity Platform

[Grant_Stead]

I would like to see Google Cloud: Identity Platform integrated as a source for authentication.

@praveen curious if/where this is on the road map.

We made the leap, and are moving away from Oracle Cloud, and into Google Cloud, and currently we’re using AWS exclusively for Cognito. It’s the only thing that we have AWS for… Well, we do use IAM, API Gateway, and Lambda to effect Cognito.

If we could use Google Identity, then we would be fully Google Cloud.

[pravse]

Hi Grant, congrats on the move away from Oracle Cloud :]

Yes. GCP Identity Platform is on the near-term roadmap, as is the Firebase Identity Provider.

Adding @Scott_Haaland and @vinothp FYI

[Grant_Stead]

That’s awesome to hear!
I know we use Firebase for notifications, what would make me want to use one over the other?

[pravse]

https://cloud.google.com/identity-platform/docs/product-comparison

Generally speaking, GCP Identity Platform is the richer solution.

[Grant_Stead]

Awesome documentation is one of the main reasons that we’re moving to Google Cloud…
Thanks for pointing me to that article!

[Grant_Stead]

@Scott_Haaland Let me know if/when you need some testing

[Grant_Stead]

@Jonathon and @Stefan_Quartemont

[Stefan_QREW]

Very cool!!! I’m watching this one.

I know some of our customers would like to move off of Cognito if possible and have deeper integration with GCP for centralized billing for the various supporting services they use to augment AppSheet.

[shaaland]

@Stefan_Quartemont @Grant_Stead - Please send me customer names and any use cases (like, which GCP services are they using with AppSheet, how does their Auth model work, etc…) offline via email. shaaland at google dot com

[Grant_Stead]

I don’t have any specific customers that currently “care” what auth we use… (We are using AWS Cognito because it’s a separate auth pool, so it is agnostic, meaning I can sign someone up with an @yahoo email…)

I guess in this case, I am the customer, and being that we’re on the google cloud stack now, and AWS Cognito is the only reason we’re on the AWS stack, we would prefer be completely off AWS. (I’m sure that GC would prefer us be off AWS as well… LOL)

[dbaum]

Did this ever get implemented? @pravse commented 2 years ago that "GCP Identity Platform is on the near-term roadmap". I'm setting up authentication for the first time, and I'd certainly prefer to start with this Google solution rather that go down the AWS road.

[zito]

Hi @dbaum - I wasn't here two years ago, so I can't comment on how the GCP identity platform was prioritized, but we have not implemented support for the GCP identity platform and do not have current plans to do so.  We've had some discussions lately about supporting Cloud Identity, but no immediate timeframes or commitments on that front (we will certainly follow up if that changes).

Cloud Identity has a free and a paid edition, and supports directory management, integration with active directory,  and also offers device management and some other security-related features.  Anecdotally, it's also simpler to configure and use for non-developers.  This doesn't preclude us from offering other solutions in the future, of course, but this is where our current requirements gathering and scoping is focused.  

[dbaum]

Thanks for the status, @zito. In the time since I wrote, I've set up Cognito authentication by following steps detailed in Control user access using AWS Cognito - AppSheet Help. Since AppSheet provides that helpful guide, it would certainly also be helpful if there were an AppSheet guide to invoking the Cognito API to manage users from AppSheet.

Regarding the Google authentication services: The Control user access using OpenID Connect - AppSheet Help article says that it's possible to "use any authentication provider that supports the standard OpenID Connect protocol". So, perhaps it's already possible to use Identity Platform and/or Cloud Identity as a generic OIDC authentication service? If so, it would be great for AppSheet to provide a guide on setting that up. While it's crucial that AppSheet is compatible with other companies' platforms, there's often a benefit to AppSheet creators to remain within the Google ecosystem (e.g., to avoid the complex challenges  inherent in interacting with AWS APIs from outside the AWS ecosystem that I alluded to) and any tutorials that facilitate and enable that are appreciated.

[Jonathon]

Just popping in to add this related thread to the discussion:

https://www.googlecloudcommunity.com/gc/Feature-Ideas/Firebase-data-connection/idc-p/330522