Skip to content

Commit 7c0545b

Browse files
jabubakejabubake
authored
Cloud IAP samples (#683)
1 parent 6b22d4d commit 7c0545b

File tree

12 files changed

+637
-0
lines changed

12 files changed

+637
-0
lines changed

‎README.md

+1
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,7 @@ Technology Samples:
1919
* [Bigquery](bigquery)
2020
* [Datastore](datastore)
2121
* [Endpoints](endpoints)
22+
* [Identity-Aware Proxy](iap)
2223
* [Key Management Service](kms)
2324
* [Logging](logging)
2425
* [Monitoring](monitoring)

‎appengine/iap/README.md

+37
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
# Cloud Identity-Aware Proxy sample for Google App Engine
2+
3+
This sample demonstrates how to use the [Cloud Identity-Aware Proxy][iap-docs] on [Google App
4+
Engine][ae-docs].
5+
6+
[iap-docs]: https://cloud.google.com/iap/docs/
7+
[ae-docs]: https://cloud.google.com/appengine/docs/java/
8+
9+
## Setup
10+
11+
Install the [Google Cloud SDK](https://cloud.google.com/sdk/) and run:
12+
```
13+
gcloud init
14+
```
15+
If this is your first time creating an App engine application:
16+
```
17+
gcloud app create
18+
```
19+
20+
## Running locally
21+
22+
This application depends on being enabled behind an IAP, so this program should not be run locally.
23+
24+
## Deploying
25+
26+
- Deploy the application to the project
27+
```
28+
mvn clean appengine:deploy
29+
```
30+
- [Enable](https://cloud.google.com/iap/docs/app-engine-quickstart) Identity-Aware Proxy on the App Engine app.
31+
- Add the email account you'll be running the test as to the Identity-Aware Proxy access list for the project.
32+
33+
## Test
34+
35+
Once deployed, access `https://your-project-id.appspot.com` . This should now prompt you to sign in for access.
36+
Sign in with the email account that was added to the Identity-Aware proxy access list.
37+
You should now see the jwt token that was received from the IAP server.

‎appengine/iap/pom.xml

+57
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,57 @@
1+
<!--
2+
Copyright 2017 Google Inc.
3+
4+
Licensed under the Apache License, Version 2.0 (the "License");
5+
you may not use this file except in compliance with the License.
6+
You may obtain a copy of the License at
7+
8+
http://www.apache.org/licenses/LICENSE-2.0
9+
10+
Unless required by applicable law or agreed to in writing, software
11+
distributed under the License is distributed on an "AS IS" BASIS,
12+
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
See the License for the specific language governing permissions and
14+
limitations under the License.
15+
-->
16+
<project>
17+
<modelVersion>4.0.0</modelVersion>
18+
<packaging>war</packaging>
19+
<version>1.0-SNAPSHOT</version>
20+
<groupId>com.example.appengine</groupId>
21+
<artifactId>appengine-iap</artifactId>
22+
23+
<parent>
24+
<groupId>com.google.cloud</groupId>
25+
<artifactId>appengine-doc-samples</artifactId>
26+
<version>1.0.0</version>
27+
<relativePath>..</relativePath>
28+
</parent>
29+
<dependencies>
30+
<dependency>
31+
<groupId>javax.servlet</groupId>
32+
<artifactId>servlet-api</artifactId>
33+
<version>2.5</version>
34+
<scope>provided</scope>
35+
</dependency>
36+
</dependencies>
37+
<build>
38+
<!-- for hot reload of the web application -->
39+
<outputDirectory>${project.build.directory}/${project.build.finalName}/WEB-INF/classes</outputDirectory>
40+
<plugins>
41+
<plugin>
42+
<groupId>org.apache.maven.plugins</groupId>
43+
<version>3.3</version>
44+
<artifactId>maven-compiler-plugin</artifactId>
45+
<configuration>
46+
<source>1.7</source>
47+
<target>1.7</target>
48+
</configuration>
49+
</plugin>
50+
<plugin>
51+
<groupId>com.google.cloud.tools</groupId>
52+
<artifactId>appengine-maven-plugin</artifactId>
53+
<version>1.3.1</version>
54+
</plugin>
55+
</plugins>
56+
</build>
57+
</project>

‎appengine/iap/src/main/java/com/example/appengine/iap/JwtServlet.java

+34
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
/**
2+
* Copyright 2017 Google Inc.
3+
*
4+
* <p>Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file
5+
* except in compliance with the License. You may obtain a copy of the License at
6+
*
7+
* <p>http://www.apache.org/licenses/LICENSE-2.0
8+
*
9+
* <p>Unless required by applicable law or agreed to in writing, software distributed under the
10+
* License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either
11+
* express or implied. See the License for the specific language governing permissions and
12+
* limitations under the License.
13+
*/
14+
package com.example.appengine.iap;
15+
16+
import java.io.IOException;
17+
import javax.servlet.http.HttpServlet;
18+
import javax.servlet.http.HttpServletRequest;
19+
import javax.servlet.http.HttpServletResponse;
20+
21+
/**
22+
* Identity Aware Proxy (IAP) Test application to reflect jwt token issued by IAP. IAP must be
23+
* enabled on application. {@see https://cloud.google.com/iap/docs/app-engine-quickstart}
24+
*/
25+
@SuppressWarnings("serial")
26+
public class JwtServlet extends HttpServlet {
27+
28+
private static final String IAP_JWT_HEADER = "x-goog-authenticated-user-jwt";
29+
30+
@Override
31+
public void doGet(HttpServletRequest req, HttpServletResponse resp) throws IOException {
32+
resp.getWriter().print(IAP_JWT_HEADER + ":" + req.getHeader(IAP_JWT_HEADER));
33+
}
34+
}

‎appengine/iap/src/main/webapp/WEB-INF/appengine-web.xml

+16
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
<?xml version="1.0" encoding="utf-8"?>
2+
<!--
3+
Copyright 2017 Google Inc.
4+
Licensed under the Apache License, Version 2.0 (the "License");
5+
you may not use this file except in compliance with the License.
6+
You may obtain a copy of the License at
7+
http://www.apache.org/licenses/LICENSE-2.0
8+
Unless required by applicable law or agreed to in writing, software
9+
distributed under the License is distributed on an "AS IS" BASIS,
10+
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
11+
See the License for the specific language governing permissions and
12+
limitations under the License.
13+
-->
14+
<appengine-web-app xmlns="http://appengine.google.com/ns/1.0">
15+
<threadsafe>true</threadsafe>
16+
</appengine-web-app>

‎appengine/iap/src/main/webapp/WEB-INF/web.xml

+14
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
<?xml version="1.0" encoding="utf-8"?>
2+
<web-app xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="http://java.sun.com/xml/ns/javaee"
3+
xmlns:web="http://java.sun.com/xml/ns/javaee/web-app_2_5.xsd"
4+
xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-app_2_5.xsd"
5+
version="2.5">
6+
<servlet>
7+
<servlet-name>hello</servlet-name>
8+
<servlet-class>com.example.appengine.iap.JwtServlet</servlet-class>
9+
</servlet>
10+
<servlet-mapping>
11+
<servlet-name>hello</servlet-name>
12+
<url-pattern>/</url-pattern>
13+
</servlet-mapping>
14+
</web-app>

‎appengine/pom.xml

+1
Original file line numberDiff line numberDiff line change
@@ -61,6 +61,7 @@
6161
<module>guestbook-objectify</module>
6262
<module>helloworld</module>
6363
<module>helloworld-new-plugins</module>
64+
<module>iap</module>
6465
<module>images</module>
6566
<module>logs</module>
6667
<module>mailgun</module>

‎iap/README.md

+34
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
# Cloud Identity-Aware Proxy Java Samples
2+
Cloud Identity-Aware Proxy (Cloud IAP) lets you manage access to applications running in Compute Engine, App Engine standard environment, and Container Engine. Cloud IAP establishes a central authorization layer for applications accessed by HTTPS, enabling you to adopt an application-level access control model instead of relying on network-level firewalls. When you enable Cloud IAP, you must also use signed headers or the App Engine standard environment Users API to secure your app.
3+
4+
## Setup
5+
- A Google Cloud project with billing enabled
6+
- A service account with private key credentials is required to create signed bearer tokens.
7+
- [Create an App engine service account](https://cloud.google.com/docs/authentication#getting_credentials_for_server-centric_flow) and download the credentials file as JSON.
8+
- Set the environment variable `GOOGLE_APPLICATION_CREDENTIALS` to point to the service account credentials file.
9+
- Install the [Google Cloud SDK](https://cloud.google.com/sdk/) and run:
10+
```
11+
gcloud init
12+
```
13+
14+
## Description
15+
- [BuildIapRequest.java](src/main/java/com/example/iap/BuildIapRequest.java) demonstrates how to set the
16+
`Authorization : Bearer` header with a signed JWT token to authorize access to an IAP protected URL.
17+
- [VerifyIapRequestHeader.java](src/main/java/com/example/iap/VerifyIapRequestHeader.java) demonstrates how to
18+
verify the JWT token in an incoming request to an IAP protected resource.
19+
20+
## Testing
21+
- Deploy the [demo app engine application](../appengine/iap/README.md). This application will return the JWT token to an authorized incoming request.
22+
It will be used to test both the authorization of an incoming request to an IAP protected resource and the JWT token returned from IAP.
23+
- [Enable](https://cloud.google.com/iap/docs/app-engine-quickstart) Identity-Aware Proxy on the App Engine app.
24+
- Add the service account email to the Identity-Aware Proxy access list for the project.
25+
- Set the environment variable `IAP_PROTECTED_URL` to point to `https://your-project-id.appspot.com`
26+
- Run the integration test:
27+
```
28+
mvn -Dtest=com.example.iap.BuildAndVerifyIapRequestIT verify
29+
```
30+
31+
## References
32+
[JWT library for Java](https://github.com/auth0/java-jwt)
33+
[Cloud IAP docs](https://cloud.google.com/iap/docs/)
34+
[Service account credentials](https://cloud.google.com/docs/authentication#getting_credentials_for_server-centric_flow)

‎iap/pom.xml

+69
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,69 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
<!--
3+
Copyright 2017 Google Inc.
4+
5+
Licensed under the Apache License, Version 2.0 (the "License");
6+
you may not use this file except in compliance with the License.
7+
You may obtain a copy of the License at
8+
9+
http://www.apache.org/licenses/LICENSE-2.0
10+
11+
Unless required by applicable law or agreed to in writing, software
12+
distributed under the License is distributed on an "AS IS" BASIS,
13+
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14+
See the License for the specific language governing permissions and
15+
limitations under the License.
16+
-->
17+
<!-- [START pom] -->
18+
<project>
19+
<modelVersion>4.0.0</modelVersion>
20+
<packaging>jar</packaging>
21+
<groupId>com.example</groupId>
22+
<artifactId>iap-samples</artifactId>
23+
<version>1.0-SNAPSHOT</version>
24+
25+
<properties>
26+
<maven.compiler.source>1.8</maven.compiler.source>
27+
<maven.compiler.target>1.8</maven.compiler.target>
28+
<project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
29+
</properties>
30+
31+
<dependencyManagement>
32+
<dependencies>
33+
<dependency>
34+
<groupId>com.fasterxml.jackson.core</groupId>
35+
<artifactId>jackson-core</artifactId>
36+
<version>2.8.6</version>
37+
</dependency>
38+
</dependencies>
39+
</dependencyManagement>
40+
41+
<dependencies>
42+
<dependency> <!-- REQUIRED -->
43+
<groupId>javax.servlet</groupId> <!-- Java Servlet API -->
44+
<artifactId>javax.servlet-api</artifactId>
45+
<version>3.1.0</version>
46+
</dependency>
47+
48+
<!-- [START dependencies] -->
49+
<dependency>
50+
<groupId>com.google.auth</groupId>
51+
<artifactId>google-auth-library-oauth2-http</artifactId>
52+
<version>0.6.0</version>
53+
</dependency>
54+
<dependency>
55+
<groupId>com.auth0</groupId>
56+
<artifactId>java-jwt</artifactId>
57+
<version>3.2.0</version>
58+
</dependency>
59+
<!-- [END dependencies] -->
60+
61+
<!-- Test dependencies -->
62+
<dependency>
63+
<groupId>junit</groupId>
64+
<artifactId>junit</artifactId>
65+
<version>4.12</version>
66+
</dependency>
67+
</dependencies>
68+
</project>
69+
<!-- [END pom] -->

0 commit comments

Comments
 (0)