我正在尝试从 GCP 环境外部通过 Python 以编程方式访问受 IAP 保护的 App Engine 标准应用程序。我尝试了各种方法,包括此处文档中显示的方法:https ://cloud.google.com/iap/docs/authentication-howto#iap-make-request-python 。这是我的代码:
from google.auth.transport.requests import Request
from google.oauth2 import id_token
import requests
def make_iap_request(url, client_id, method='GET', **kwargs):
"""Makes a request to an application protected by Identity-Aware Proxy.
Args:
url: The Identity-Aware Proxy-protected URL to fetch.
client_id: The client ID used by Identity-Aware Proxy.
method: The request method to use
('GET', 'OPTIONS', 'HEAD', 'POST', 'PUT', 'PATCH', 'DELETE')
**kwargs: Any of the parameters defined for the request function:
https://github.com/requests/requests/blob/master/requests/api.py
If no timeout is provided, it is set to 90 by default.
Returns:
The page body, or raises an exception if the page couldn't be retrieved.
"""
# Set the default timeout, if missing
if 'timeout' not in kwargs:
kwargs['timeout'] = 90
# Obtain an OpenID Connect (OIDC) token from metadata server or using service
# account.
open_id_connect_token = id_token.fetch_id_token(Request(), client_id)
print(f'{open_id_connect_token=}')
# Fetch the Identity-Aware Proxy-protected URL, including an
# Authorization header containing "Bearer " followed by a
# Google-issued OpenID Connect token for the service account.
resp = requests.request(
method, url,
headers={'Authorization': 'Bearer {}'.format(
open_id_connect_token)}, **kwargs)
print(f'{resp=}')
if resp.status_code == 403:
raise Exception('Service account does not have permission to '
'access the IAP-protected application.')
elif resp.status_code != 200:
raise Exception(
'Bad response from application: {!r} / {!r} / {!r}'.format(
resp.status_code, resp.headers, resp.text))
else:
return resp.text
if __name__ == '__main__':
res = make_iap_request(
'https://MYAPP.ue.r.appspot.com/',
'Client ID from IAP>App Engine app>Edit OAuth Client>Client ID'
)
print(res)
当我在本地运行它时,我将 GOOGLE_APPLICATION_CREDENTIALS 环境变量设置为本地 JSON 凭据文件,其中包含我要使用的服务帐户的密钥。我还尝试在 Cloud Functions 中运行它,因此它可能会使用元数据服务来获取 App Engine 默认服务帐户(我认为?)。
在这两种情况下,我都能够生成一个看起来有效的令牌。使用 jwt.io,我看到它包含预期的数据并且签名有效。但是,当我使用令牌向应用程序发出请求时,我总是会收到以下异常:
应用程序的错误响应:401 / {'X-Goog-IAP-Generated-Response':'true','Date':'Tue,2021 年 2 月 9 日 19:25:43 GMT','Content-Type':'text /html', '服务器': '谷歌前端', '内容长度': '47', 'Alt-Svc': 'h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; 马=2592000;v="46,43"'} / '无效的 GCIP ID 令牌:JWT 签名无效'
我可能做错了什么?