Google Idenity Aware Proxy Authenticate with API on SPA

1
votes

I'm curious what is the "best practice" for authenticating against a restful-api that is protected by Google IAP.

Allow me to break it down step by step to elucidate what I am trying to achieve:

  • Go to my dev environment's url: dev.blah.com. Here, I am prompted by IAP to log-in. I log in. I now have access to my SPA.
  • I am browsing my SPA. But! I'm unable to talk to my API, because it is ALSO protected by IAP.

I've read that I can do programmatic authentication in the documentation but I'm unsure if my particular use case is suited for programmatic authentication, or if it will even be SECURE.

So, am I correct in that I will have to implement a client-side programmatic-authentication workflow in order to access my API?

Or is there an alternative way to say "Once I'm authenticated to access THIS IAP-protected resource, i can log into these other resources as well." I cannot simply copy the token because it is http-only and the cookie is restricted to my current domain.

Some additional information:

  • My services are running in a Google Kubernetes Engine cluster and have automatically created load balancers based off of ingress objects I declare.
  • Each IAP-protected environment gets it's own OAuth credentials, and I configure the load-balancers to use IAP using: gcloud compute backend-services update [backend-service] --global --iap=enabled,oauth2-client-id=[the_id],oauth2-client-secret=[the_secret]
1
google-iap

1 Answers

0
votes

let me make sure I understand what you're trying to do. It sounds like you want to call your API from JavaScript inside the web browser, is that correct?

If so, and:

  • All backend services are configured to use the same OAuth client ID.
  • The API and the SPA are serving off the same domain.

then I think things will just work, because the JavaScript-generated HTTP requests will be sent with the IAP session cookie. ... Which must not be your setup, or things would just be working which clearly they aren't. :>

If you're not able to arrange for your API calls to use the IAP session cookie generated when you authenticate to the SPA, this will be tricky. You wouldn't want to use service account authentication from the browser, since that would give all end-users access to the service account.

Hm, it looks like there is a way to do Google OAuth from JavaScript: https://developers.google.com/api-client-library/javascript/features/authentication -- I haven't tried it, but if you're able to get that working, you ought to be able to use a flow like https://cloud.google.com/iap/docs/authentication-howto#authenticating_from_a_desktop_app . If you want to go that route, let me know how it goes and I'd love to help you get unstuck and then get that approach added to our documentation!

--Matthew, Google Cloud IAP engineering