When you migrate to Google Cloud Platform, there are many options to choose from for managing the users lifecycle. You can start by manually creating a few users in your Cloud environment, but that can be tedious, error-prone, and not scalable. You can also import a CSV file into Cloud Identity. But after that operation, the users lifecycle does not sync with your source environment. Meaning, that if a user changes a password or leaves the company, their user profile in Cloud Identity will not be affected. There is a way to create a trust relationship between your directory services and Cloud Identity called Google Cloud Directory Sync, which is the recommended approach. Google Cloud Directory Sync is a Google provided connector tool that integrates with most enterprise LDAP management systems and synchronizes identities on a schedule. It runs in a dedicated machine on-premises, and communicates with Cloud Identity via well-established protocols. Google Cloud Directory Sync is a one way synchronization tool, which keeps your on-premises active directory as the single point of truth. It synchronizes users in groups in order for them to use your Cloud environment. This gives you granular control over corporate users that you want to grant Direct GCP resource access to. Google Cloud Directory Sync only sinks objects like users and groups without their passwords. Once a user is synced to Cloud Identity, it needs to also have a password or a means of authentication. There are a few options to choose from. The first option is to create a password for the users in Cloud identities admin council. The users will authenticate against Cloud Identity and their Cloud password doesn't sync back to Active Directory. A recommended alternative is to set up SSO, using SAML 2. Here, there are two options. The first is to use Cloud Identity, which is a managed, highly available service, as your main Identity Provider. Alternatively, you can federate the authentication of your synced to Cloud users back to on-premises. When you configure SSO, the user will be authenticated directly against your on-premises identity provider, which eliminates the need to manually manage passwords in the cloud. That also means, that your on-premises identity provider must be highly available so that users will be able to access Cloud resources. If you do not use SSO and would like to sign into Google Cloud platform, with the same passwords you use on-premises, G Suite password sync will synchronize user passwords from active directory to Cloud Identity in real-time. G Suite Password Sync intercepts the raw passwords and applies a salted SHA512 hash before they are transmitted over an encrypted TLS tunnel. Only the salted version is sent to Cloud Identity using native APIs.
