プログラムによる認証

 using Google.Apis.Auth.OAuth2; using System.Net.Http; using System.Net.Http.Headers; using System.Threading; using System.Threading.Tasks; public class IAPClient {  /// <summary>  /// Makes a request to a IAP secured application by first obtaining  /// an OIDC token.  /// </summary>  /// <param name="iapClientId">The client ID observed on   /// https://console.cloud.google.com/apis/credentials. </param>  /// <param name="uri">HTTP URI to fetch.</param>  /// <param name="cancellationToken">The token to propagate operation cancel notifications.</param>  /// <returns>The HTTP response message.</returns>  public async Task<HttpResponseMessage> InvokeRequestAsync(  string iapClientId, string uri, CancellationToken cancellationToken = default)  {  // Get the OidcToken.  // You only need to do this once in your application  // as long as you can keep a reference to the returned OidcToken.  OidcToken oidcToken = await GetOidcTokenAsync(iapClientId, cancellationToken);  // Before making an HTTP request, always obtain the string token from the OIDC token,  // the OIDC token will refresh the string token if it expires.  string token = await oidcToken.GetAccessTokenAsync(cancellationToken);  // Include the OIDC token in an Authorization: Bearer header to   // IAP-secured resource  // Note: Normally you would use an HttpClientFactory to build the httpClient.  // For simplicity we are building the HttpClient directly.  using HttpClient httpClient = new HttpClient();  httpClient.DefaultRequestHeaders.Authorization = new AuthenticationHeaderValue("Bearer", token);  return await httpClient.GetAsync(uri, cancellationToken);  }  /// <summary>  /// Obtains an OIDC token for authentication an IAP request.  /// </summary>  /// <param name="iapClientId">The client ID observed on   /// https://console.cloud.google.com/apis/credentials. </param>  /// <param name="cancellationToken">The token to propagate operation cancel notifications.</param>  /// <returns>The HTTP response message.</returns>  public async Task<OidcToken> GetOidcTokenAsync(string iapClientId, CancellationToken cancellationToken)  {  // Obtain the application default credentials.  GoogleCredential credential = await GoogleCredential.GetApplicationDefaultAsync(cancellationToken);  // Request an OIDC token for the Cloud IAP-secured client ID.  return await credential.GetOidcTokenAsync(OidcTokenOptions.FromTargetAudience(iapClientId), cancellationToken);  } } 

import ( "context" "fmt" "io" "net/http" "google.golang.org/api/idtoken" ) // makeIAPRequest makes a request to an application protected by Identity-Aware // Proxy with the given audience. func makeIAPRequest(w io.Writer, request *http.Request, audience string) error { // request, err := http.NewRequest("GET", "http://example.com", nil) // audience := "IAP_CLIENT_ID.apps.googleusercontent.com" ctx := context.Background() // client is a http.Client that automatically adds an "Authorization" header // to any requests made. client, err := idtoken.NewClient(ctx, audience) if err != nil { return fmt.Errorf("idtoken.NewClient: %w", err) } response, err := client.Do(request) if err != nil { return fmt.Errorf("client.Do: %w", err) } defer response.Body.Close() if _, err := io.Copy(w, response.Body); err != nil { return fmt.Errorf("io.Copy: %w", err) } return nil } 

 import com.google.api.client.http.HttpRequest; import com.google.api.client.http.HttpRequestInitializer; import com.google.api.client.http.HttpTransport; import com.google.api.client.http.javanet.NetHttpTransport; import com.google.auth.http.HttpCredentialsAdapter; import com.google.auth.oauth2.GoogleCredentials; import com.google.auth.oauth2.IdTokenCredentials; import com.google.auth.oauth2.IdTokenProvider; import com.google.common.base.Preconditions; import java.io.IOException; import java.util.Collections; public class BuildIapRequest {  private static final String IAM_SCOPE = "https://www.googleapis.com/auth/iam";  private static final HttpTransport httpTransport = new NetHttpTransport();  private BuildIapRequest() {}  private static IdTokenProvider getIdTokenProvider() throws IOException {  GoogleCredentials credentials =  GoogleCredentials.getApplicationDefault().createScoped(Collections.singleton(IAM_SCOPE));  Preconditions.checkNotNull(credentials, "Expected to load credentials");  Preconditions.checkState(  credentials instanceof IdTokenProvider,  String.format(  "Expected credentials that can provide id tokens, got %s instead",  credentials.getClass().getName()));  return (IdTokenProvider) credentials;  }  /**  * Clone request and add an IAP Bearer Authorization header with ID Token.  *  * @param request Request to add authorization header  * @param iapClientId OAuth 2.0 client ID for IAP protected resource  * @return Clone of request with Bearer style authorization header with ID Token.  * @throws IOException exception creating ID Token  */  public static HttpRequest buildIapRequest(HttpRequest request, String iapClientId)  throws IOException {  IdTokenProvider idTokenProvider = getIdTokenProvider();  IdTokenCredentials credentials =  IdTokenCredentials.newBuilder()  .setIdTokenProvider(idTokenProvider)  .setTargetAudience(iapClientId)  .build();  HttpRequestInitializer httpRequestInitializer = new HttpCredentialsAdapter(credentials);  return httpTransport  .createRequestFactory(httpRequestInitializer)  .buildRequest(request.getRequestMethod(), request.getUrl(), request.getContent());  } }

/**  * TODO(developer): Uncomment these variables before running the sample.  */ // const url = 'https://some.iap.url'; // const targetAudience = 'IAP_CLIENT_ID.apps.googleusercontent.com'; const {GoogleAuth} = require('google-auth-library'); const auth = new GoogleAuth(); async function request() {  console.info(`request IAP ${url} with target audience ${targetAudience}`);  const client = await auth.getIdTokenClient(targetAudience);  const res = await client.fetch(url);  console.info(res.data); } request().catch(err => {  console.error(err.message);  process.exitCode = 1; });

namespace Google\Cloud\Samples\Iap; # Imports Auth libraries and Guzzle HTTP libraries. use Google\Auth\ApplicationDefaultCredentials; use GuzzleHttp\Client; use GuzzleHttp\HandlerStack; /**  * Make a request to an application protected by Identity-Aware Proxy.  *  * @param string $url The Identity-Aware Proxy-protected URL to fetch.  * @param string $clientId The client ID used by Identity-Aware Proxy.  */ function make_iap_request($url, $clientId) {  // create middleware, using the client ID as the target audience for IAP  $middleware = ApplicationDefaultCredentials::getIdTokenMiddleware($clientId);  $stack = HandlerStack::create();  $stack->push($middleware);  // create the HTTP client  $client = new Client([  'handler' => $stack,  'auth' => 'google_auth'  ]);  // make the request  $response = $client->get($url);  print('Printing out response body:');  print($response->getBody()); }

from google.auth.transport.requests import Request from google.oauth2 import id_token import requests def make_iap_request(url, client_id, method="GET", **kwargs):  """Makes a request to an application protected by Identity-Aware Proxy.  Args:  url: The Identity-Aware Proxy-protected URL to fetch.  client_id: The client ID used by Identity-Aware Proxy.  method: The request method to use  ('GET', 'OPTIONS', 'HEAD', 'POST', 'PUT', 'PATCH', 'DELETE')  **kwargs: Any of the parameters defined for the request function:  https://github.com/requests/requests/blob/master/requests/api.py  If no timeout is provided, it is set to 90 by default.  Returns:  The page body, or raises an exception if the page couldn't be retrieved.  """ # Set the default timeout, if missing if "timeout" not in kwargs: kwargs["timeout"] = 90 # Obtain an OpenID Connect (OIDC) token from metadata server or using service # account. open_id_connect_token = id_token.fetch_id_token(Request(), client_id) # Fetch the Identity-Aware Proxy-protected URL, including an # Authorization header containing "Bearer " followed by a # Google-issued OpenID Connect token for the service account. resp = requests.request( method, url, headers={"Authorization": "Bearer {}".format(open_id_connect_token)}, **kwargs ) if resp.status_code == 403: raise Exception( "Service account does not have permission to " "access the IAP-protected application." ) elif resp.status_code != 200: raise Exception( "Bad response from application: {!r} / {!r} / {!r}".format( resp.status_code, resp.headers, resp.text ) ) else: return resp.text 

# url = "The Identity-Aware Proxy-protected URL to fetch" # client_id = "The client ID used by Identity-Aware Proxy" require "googleauth" require "faraday" # The client ID as the target audience for IAP id_token_creds = Google::Auth::Credentials.default target_audience: client_id headers = {} id_token_creds.client.apply! headers resp = Faraday.get url, nil, headers if resp.status == 200  puts "X-Goog-Iap-Jwt-Assertion:"  puts resp.body else  puts "Error requesting IAP"  puts resp.status  puts resp.headers end