Update validate_jwt to use new JWT header - #1019
Conversation
Sorry, something went wrong.
| For instance: "https://example.com:8443" or | ||
| "https://example.appspot.com" . | ||
| iap_jwt: The contents of the X-Goog-Authenticated-User-JWT header. | ||
| cloud_project_number: The project *number* for your Google Cloud project. |
There was a problem hiding this comment.
Oh no, project number? That's awful! Why is that needed instead of just the project ID?
Sorry, something went wrong.
There was a problem hiding this comment.
The path through Google infrastructure that leads to calling the IAP auth component doesn't propagate the project ID. We could look it up in the server, but then that'd be a latency and reliability hit on every single request. Yeah, agree that it's not the user experience we'd like to have.
Sorry, something went wrong.
| Returns: | ||
| (user_id, user_email, error_str). | ||
| """ | ||
| if not (bool(app_engine_project_id) ^ bool(compute_engine_backend_service_id)): |
There was a problem hiding this comment.
This is a code smell, can you maybe split this into a couple of functions like validate_iap_jwt_from_compute that call a common helper with a target_audience or alternatively have one helper method that figures out the target audience and one to validate the jwt?
Sorry, something went wrong.
There was a problem hiding this comment.
Sorry, something went wrong.
| return _validate_iwp_jwt(iap_jwt, expected_audience) | ||
|
|
||
|
|
||
| def validate_iap_jwt_from_app_engine(iwp_jwt, cloud_project_number, |
There was a problem hiding this comment.
This says app_engine, did you mean compute_engine?
Sorry, something went wrong.
|
@matthewg you'll need to placate travis: https://travis-ci.org/GoogleCloudPlatform/python-docs-samples/builds/253681888?utm_source=github_status&utm_medium=notification |
Sorry, something went wrong.
|
Travis should be happy now. I've updated the test, but you'll need to redeploy gcp-devrel-iap-reflect to pick up the new header name. |
Sorry, something went wrong.
|
Will do, thanks. :) |
Sorry, something went wrong.
No description provided.