> For the complete documentation index, see [llms.txt](https://docs.forestall.io/forestall/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.forestall.io/forestall/unified-identities/gcp-identities/workforce-providers.md).

# Workforce Providers

Open **Unified Identities › Resources**, filter **Providers** to **GCP Identities › Workforce Provider**, then select a row to open its details. Workforce Providers define how external workforce (human user, e.g., SAML or OIDC identity providers such as Entra ID) identities federate into a Workforce Identity Pool.

<figure><img src="https://3408039743-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FObpV44hoVkNmo5bFuVVL%2Fuploads%2Fgit-blob-264a5a5c1f01910b0cdc81a9edfd6ce00e8cc556%2FGCPWorkforceProviderListPage.png?alt=media" alt=""><figcaption><p>Workforce Providers</p></figcaption></figure>

### Workforce Providers Details

Opening a workforce provider shows the **`Details`**, **`Attribute Condition`**, and **`Attribute Mapping`** tabs. The card title can carry a `Tier 0`/`Tier 2` badge, a provider type badge (**SAML** or **OIDC**) and a `Disabled` badge.

{% hint style="info" %}
You can analyze the object in the [Graph](/forestall/visualize/visualize.md) by clicking the **Graph »** button next to the `Information` title.
{% endhint %}

<figure><img src="https://3408039743-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FObpV44hoVkNmo5bFuVVL%2Fuploads%2Fgit-blob-cbbe8f41af95ecc10b9459ab192dfbf0e240c8b1%2FGCPWorkforceProviderDetailPage.png?alt=media" alt=""><figcaption><p>GCP Workforce Provider Details</p></figcaption></figure>

The Details tab contains attributes about the GCP Workforce Provider. The page also includes an **Issues** panel that lists any security findings related to the provider, along with a Risk score and Exposure Point.

### Information

| Attribute                     | Description                                                                                                                |
| ----------------------------- | -------------------------------------------------------------------------------------------------------------------------- |
| Display Name                  | The human-readable name of the provider (e.g., `Entra-ID`).                                                                |
| Name                          | The full resource path of the provider (e.g., `locations/global/workforcePools/workforce-pool-test-2/providers/entra-id`). |
| SAML Provider / OIDC Provider | The provider type (`SAML` or `OIDC`).                                                                                      |
| State                         | The lifecycle state of the provider (e.g., `ACTIVE`).                                                                      |
| Description                   | A free-text description of the provider (e.g., `test`).                                                                    |
| Disabled                      | Indicates whether the provider is currently disabled.                                                                      |
| Issuer URI                    | The URI of the external OIDC issuer, for OIDC providers.                                                                   |
| Parent Pool                   | The workforce identity pool of the provider; links to the pool details.                                                    |
| Location                      | The location of the provider (e.g., `global`).                                                                             |

### **Attribute Condition**

Displays the CEL condition used to restrict which external identities may federate through the provider.

### **Attribute Mapping**

Displays the mapping between external identity attributes and Google Cloud attributes in `Source Attribute` and `Target Attribute` columns.

#### **Issues**

Lists security findings associated with the provider (e.g., *Workforce Identity Federation Provider Has No Attribute Condition*), each tagged with relevant categories such as Least Privilege or Credential Security, and a severity rating (e.g., High).