python-docs-samples/iap/validate_jwt.py at master · git-connected/python-docs-samples · GitHub

History

48 lines (40 loc) · 1.79 KB

Raw

# Licensed under the Apache License, Version 2.0 (the "License");

# you may not use this file except in compliance with the License.

# You may obtain a copy of the License at

# http://www.apache.org/licenses/LICENSE-2.0

# Unless required by applicable law or agreed to in writing, software

# distributed under the License is distributed on an "AS IS" BASIS,

# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.

# See the License for the specific language governing permissions and

# limitations under the License.

"""Sample showing how to validate the Identity-Aware Proxy (IAP) JWT.

This code should be used by applications in Google Compute Engine-based

environments (such as Google App Engine flexible environment, Google

Compute Engine, Google Container Engine, Google App Engine) to provide

an extra layer of assurance that a request was authorized by IAP.

"""

# [START iap_validate_jwt]

from google.auth.transport import requests

from google.oauth2 import id_token

def validate_iap_jwt(iap_jwt, expected_audience):

"""Validate an IAP JWT.

Args:

iap_jwt: The contents of the X-Goog-IAP-JWT-Assertion header.

expected_audience: The Signed Header JWT audience. See

https://cloud.google.com/iap/docs/signed-headers-howto

for details on how to get this value.

Returns:

(user_id, user_email, error_str).

"""

try:

decoded_jwt = id_token.verify_token(

iap_jwt, requests.Request(), audience=expected_audience,

certs_url='https://www.gstatic.com/iap/verify/public_key')

return (decoded_jwt['sub'], decoded_jwt['email'], '')

except Exception as e:

return (None, None, '**ERROR: JWT validation error {}**'.format(e))

# [END iap_validate_jwt]

python-docs-samples/iap/validate_jwt.py at master · git-connected/python-docs-samples · GitHub

Uh oh!

Expand file tree

Breadcrumbs

validate_jwt.py

Latest commit

History

Breadcrumbs

validate_jwt.py

File metadata and controls