Commit e557c951 authored by xuwang's avatar xuwang
Browse files

doc(gke-iap-auth): correct Google sign-in screen description 



No-session shows the generic enter-email field (no account button); existing
sessions show an account chooser. Either way, entering the domain address
federates to the org IdP without a Google password prompt.

Co-Authored-By: default avatarClaude Opus 4.8 <noreply@anthropic.com>
parent ea8ee0b5

docs/gke-iap-auth.md

+6 −4
Original line number Diff line number Diff line
@@ -57,10 +57,12 @@ sign-in redirect uses Google's IAP project client (`369001918367-…`). 


When the org's domain is a Google Workspace domain (e.g. `stanford.edu`), signing

in "with Google" using a domain account **already federates to the org's SSO/IdP**

(e.g. SAML/Shibboleth) behind the scenes. The `accounts.google.com` screen is

Google's account chooser/sign-in; after picking the account, Google redirects to

the org IdP and back. If the browser already has an active domain Google session,

Google skips the chooser — the redirect is near-instant.

(e.g. SAML/Shibboleth) behind the scenes. What the `accounts.google.com` screen

shows depends on existing Google sessions: with none you get the generic "enter

email or phone" field (no account button); with one or more you get an account

chooser. Either way, once you enter/pick the domain address, Google recognizes the

federated domain and redirects to the org IdP (no Google password prompt), then

returns to the app. With an active domain session the hop is near-instant.



**Can the Google page be skipped (go straight to the org IdP)?** Not with standard

IAP. IAP authenticates *Google* identities, so the OAuth flow always goes through