These samples are used on the following documentation pages:

• https://cloud.google.com/iap/docs/authentication-howto
• https://cloud.google.com/iap/docs/signed-headers-howto

1. Add the contents of this directory's requirements.txt file to the one inside your application.
2. Copy make_iap_request.py into your application.

1. Follow the instructions in Installing a third-party library to install the google-auth and requests libraries into your application.
2. Copy make_iap_request.py into the same folder as app.yaml .

1. Click here to visit Google Cloud Platform Console and enable the IAM API on your project.
2. Create a VM with the IAM scope:

   gcloud compute instances create INSTANCE_NAME
   --scopes=https://www.googleapis.com/auth/iam
   

3. Give your VM's default service account the Service Account Actor role:

   gcloud projects add-iam-policy-binding PROJECT_ID
   --role=roles/iam.serviceAccountActor
   --member=serviceAccount:SERVICE_ACCOUNT
   

4. Install the libraries listed in requirements.txt, e.g. by running:

   virtualenv/bin/pip install -r requirements.txt
   

5. Copy make_iap_request.py into your application.

1. Create a service account and download its private key. See https://cloud.google.com/iam/docs/creating-managing-service-account-keys for more information on how to do this.
2. Set the environment variable GOOGLE_APPLICATION_CREDENTIALS to the path to your service account's .json file.
3. Install the libraries listed in requirements.txt, e.g. by running:

   virtualenv/bin/pip install -r requirements.txt
   

4. Copy make_iap_request.py into your application.

If you prefer to manage service account credentials manually, this method can also be used in the App Engine flexible environment, Compute Engine, and Kubernetes Engine. Note that this may be less secure, as anyone who obtains the service account private key can impersonate that account!

1. Install the libraries listed in requirements.txt, e.g. by running:

   virtualenv/bin/pip install -r requirements.txt
   

2. Copy validate_jwt.py into your application.

Ensure that you are in the correct working directory: (/python-docs-samples/iap):

1. Install the libraries listed in /python-docs-samples/iap/requirements.txt, e.g. by running:

      virtualenv/bin/pip install -r requirements.txt
   

2. Call sign_jwt in the python file. This example would create a JWT for the service account email@gmail.com to access the IAP protected application hosted at https://example.com.

      sign_jwt("email@gmail.com", "https://example.com")
   

3. Use the result of the call to access your IAP protected resource programmatically:

      curl --verbose --header 'Authorization: Bearer SIGNED_JWT' "https://example.com"
   

1. Install the libraries listed in /python-docs-samples/iap/requirements.txt, e.g. by running:

      virtualenv/bin/pip install -r requirements.txt
   

2. Create a service account and download its private key. See https://cloud.google.com/iam/docs/creating-managing-service-account-keys for more information on how to do this.

3. Call sign_jwt_with_local_credentials_file, using the downloaded local credentials for the service account.

      sign_jwt_with_local_credentials_file("path/to/key/file.json", "https://example.com")
   

4. Use the result of the call to access your IAP protected resource programmatically:

      curl --verbose --header 'Authorization: Bearer SIGNED_JWT' "https://example.com"
   

1. Deploy app_engine_app to a project.
2. Enable Identity-Aware Proxy on that project's App Engine app.
3. Add the service account you'll be running the test as to the Identity-Aware Proxy access list for the project.
4. Update iap_test.py with the hostname for your project.
5. Run the command: GOOGLE_CLOUD_PROJECT=project-id pytest iap_test.py