Google Compute Engine SSH - different username after switching to OS Login

Question

I created a Compute Engine VM (Ubuntu 18.04), and when I log into it using the SSH button in the VM instances list I'm logged in as user username.

After a while, I realised I needed to be able to use another SSH client as well. As per https://cloud.google.com/compute/docs/instances/connecting-advanced I enabled OS Login by adding a key-value pair in metadata, where key is enable-oslogin and value is TRUE.

I then tried to add my existing SSH key:

gcloud compute os-login ssh-keys add --key-file path/to/key.pub --ttl 0

which was successful except one major problem: it has added the key for user username_gmail_com and will only allow me to ssh to my VM as that user:

ssh username_gmail_com@myinstance

And it has also created that user on my VM. From the web interface, I'm logged in to the VM with that new user as well (/home/username_gmail_com). Of course, I can still access the original user's data (/home/username). When I disable OS Login the web interface logs me in as username again and SSH from another client is disabled.

1. Why is the username different when enabling OS Login?
2. Can I change the username with OS Login enabled?

Edit

There has been an addition to the docs explaining exactly this question. Check here: https://cloud.google.com/compute/docs/oslogin/ and on the page I mentioned above all the way at the bottom under "Expected login behaviors".

Solution

I asked this question here and got a clear answer.

Why is the username different between OS Login enabled and disabled?

OS Login ties your Linux user account to your Google identity so that you have a consistent username, UID, and other posix information, in every VM you log into.

[...]

In order to prevent uniqueness conflicts across different organizations ([email protected] and [email protected]) the domain name is included by default.

[...]

When OS Login is not enabled, the username is set in your SSH key which has no tie-in to a user's Google identity. The username is generated to be convenient, and none of the OS Login-specific concerns apply.

And can I influence the username when OS Login enabled?

The posix information is immutable for consumer identities (non-G Suite users).

So no, I can't, because I'm an individual and not an organisation.

In the end, I solved the inconveniece this caused me by simply recreating the server with OS Login enabled - that of course is one of the strengths of Compute Engine.

Comments

[Wil Koetsier]

Thanks for your answer. Of course I can sudo to transfer files between my 2 users, but that's way to inconvenient (especially when it's not me but, say, a fabfile). Instead, I should be able to ssh to my first user and the second one should never have existed in the first place. From my local console I login with the new username while the Google console (web interface) logs in with my initial username! I wish to correct that, so that I can login from my local console using my initial username.

[Admin]

That's tricky... you could try to trick the google metadata by updating the user name at the end of your ssh-key using the first user name and see if you login inside the same user...

[Wil Koetsier]

I'll give that a try. Meanwhile, Google has decided to login with the new username too - ??? it has something to do with OS Login set to TRUE. Why that switches to another username is a mystery to me.

[Wil Koetsier]

It didn't work, the keys in Compute -> Metadata -> Keys can't be edited. Please also see the edit in my question.

[Admin]

You can't edit the key you must add a new one for this to work

[Wil Koetsier]

Thanks for pointing me to the github repo. The other 2 docs I'd already read (over and over). None of these explain why the account format is used as user_gmail_com instead of just user. The fact that it does that isn't mentioned anywhere, nor how to influence the username used by OS Login, nor why that's done by OS Login but not when OS Login is disabled (with the same google account). Do you have any idea?

[Admin]

@WilKoetsier When using OS Login you want to control users access through IAM, so you add each user to the project. You can not change usernames as they are being extracted from IAM. When OS Login is disabled, you can use any username you wish. For example, if using SSH from the browser, and even if you are logged in to the project with your account, you can “Change Linux Username” by clicking the top right setup icon in the window. More information about the accounts daemon's behavior at this github

[Admin]

You can also ask for improving the OS Login document by clicking on the feedback button on top of the page. But as I mentioned the email format is a standard, and you can not change that behavior. In your feedback, you may also ask for manipulating user names when using OS Login as a new feature. Furthermore, You can repost your question at serverfault.com as an alternative to Superuser

[Andy Shinn]

The "by default" wording makes it sound like it can be changed. They should just remove "by default" from the sentence.