Documentation
¶
Overview ¶
Package iap_request_parser admits a caller that Identity-Aware Proxy has already admitted, by verifying the assertion IAP signs rather than trusting that IAP was passed at all.
Why a service behind IAP checks anyway: IAP enforces at the load balancer, so it protects the path through the load balancer and nothing else. A backend reachable by any other route -- its own run.app address, its instance address, a second load balancer pointed at the same backend service, anything already inside the VPC -- is reachable without IAP having seen the request.
The plain headers IAP adds are the trap. X-Goog-Authenticated-User-Email and its siblings are unsigned, so anything that can reach the backend directly can set them to whatever it likes, and a service reading them is trusting its own attacker. The assertion header this reads is signed by Google, which is what makes it evidence rather than assertion.
So a service that restricts its ingress to the load balancer is not relying on this; it is defended twice, which is what leaves an ingress setting changed by accident an inconvenience rather than an exposure.
Index ¶
- Constants
- func AppEngineAudience(projectNumber string, projectId string) string
- func BackendServiceAudience(projectNumber string, backendServiceId string) string
- func JwkUrl() (*url.URL, error)
- func MakeClaimsValidator(audience string, allowedEmails []string, allowedHostedDomains []string) validator.Validator[map[string]any]
- func New(options ...iap_request_parser_config.Option) (request_parser.RequestParser[any], error)
Constants ¶
const HeaderName = "x-goog-iap-jwt-assertion"
HeaderName is the header IAP puts its assertion in. It is a header of its own rather than Authorization, so that a request may carry both this and whatever the service's own callers use.
const Issuer = "https://cloud.google.com/iap"
Issuer is what IAP calls itself in the iss claim.
const JwkUrlString = "https://www.gstatic.com/iap/verify/public_key-jwk"
JwkUrlString is where the keys IAP signs its assertions with are published. They are elliptic curve keys, not the RSA ones Google signs ID tokens with, and they are published somewhere else.
Variables ¶
This section is empty.
Functions ¶
func AppEngineAudience ¶
AppEngineAudience is the audience of an App Engine application behind IAP.
func BackendServiceAudience ¶
BackendServiceAudience is the audience of a service behind a load balancer.
The project number is the numeric one rather than the project id: IAP mints the assertion with what the resource is called internally, and an audience built from the id never matches.
func MakeClaimsValidator ¶
func MakeClaimsValidator( audience string, allowedEmails []string, allowedHostedDomains []string, ) validator.Validator[map[string]any]
MakeClaimsValidator validates the claims of an IAP assertion: not expired, IAP as the issuer, this resource as the audience, and -- where a deployment named any -- an account it admits.
func New ¶
func New(options ...iap_request_parser_config.Option) (request_parser.RequestParser[any], error)
New makes the request parser.
An audience is required rather than defaulted: without one this admits an assertion minted for any service IAP fronts, which is every service behind IAP anywhere.
Types ¶
This section is empty.
Source Files
Directories
¶
| Path | Synopsis |
|---|---|
|
Package iap_request_parser_config holds the settings of an Identity-Aware Proxy request parser.
|
Package iap_request_parser_config holds the settings of an Identity-Aware Proxy request parser. |