IAP를 사용 설정하도록 OAuth 구성 맞춤설정

이 문서에서는 IAP (Identity-Aware Proxy)의 OAuth 구성을 맞춤설정하는 시기와 방법을 설명합니다.

IAP는 Google 관리 OAuth 클라이언트를 사용하여 사용자를 인증합니다.

Google 관리 OAuth 클라이언트는 브라우저를 통해 IAP가 사용 설정된 애플리케이션에 액세스할 때 동일한 조직 내의 사용자로 액세스를 제한합니다.

커스텀 OAuth 구성을 사용해야 하는 경우

다음을 수행하려면 커스텀 OAuth 구성을 사용해야 합니다.

  • 조직 외부의 사용자가 IAP가 사용 설정된 애플리케이션에 액세스하도록 허용합니다.
  • 인증 중 자체 브랜드 정보를 표시합니다.
  • 애플리케이션에 프로그래매틱 액세스를 사용 설정합니다.

OAuth 구성을 맞춤설정할 때는 OAuth 동의 화면을 구성해야 합니다. 이렇게 하려면 애플리케이션의 브랜딩 정보가 Google 인증 절차를 거쳐야 합니다. 인증 프로세스에 관한 자세한 내용은 OAuth 동의 화면 설정을 참고하세요.

맞춤 OAuth 클라이언트의 사용자 인증 정보를 만들고 관리하는 것은 개발자의 책임입니다. 여기에는 클라이언트 보안 비밀번호를 안전하게 저장하고 필요한 경우 승인된 사용자와 공유하는 것이 포함됩니다.

Google 관리 OAuth 클라이언트 및 커스텀 OAuth 클라이언트 비교

Google 관리 OAuth 클라이언트는 프로그래매틱 방식으로 IAP 보호 애플리케이션에 액세스할 수 없습니다. 하지만 Google 관리 OAuth 클라이언트를 사용하는 IAP 보호 애플리케이션은 programmatic_clients 설정 또는 서비스 계정 JWT를 통해 구성된 별도의 OAuth 클라이언트를 사용하여 프로그래매틱 방식으로 계속 액세스할 수 있습니다.

다음 표에서는 Google 관리 OAuth 클라이언트와 맞춤 OAuth 클라이언트를 비교합니다.

Google 관리 OAuth 클라이언트 맞춤 OAuth 클라이언트
사용자 내부 전용 내부 및 외부용
브랜드 Google Cloud 브랜드 고객 소유 브랜드
OAuth 구성 Google 구성됨 고객이 구성함
OAuth 사용자 인증 정보 Google 관리 고객 관리
애플리케이션 액세스 브라우저 흐름만 브라우저 흐름 및 프로그래매틱 액세스
에서 Google 관리 OAuth 클라이언트로 IAP를 사용 설정할 때 OAuth 클라이언트 경고는 무시해도 됩니다.

맞춤 OAuth 클라이언트 구성을 사용하여 IAP 사용 설정

다음 섹션에서는 여러 리소스에 맞는 맞춤 OAuth 클라이언트 구성을 사용하여 IAP를 사용 설정하는 방법을 설명합니다.

App Engine

콘솔

동적 포함 파일

프로젝트의 OAuth 동의 화면을 구성하지 않았으면, 구성하라는 메시지가 표시됩니다. OAuth 동의 화면을 구성하려면 OAuth 동의 화면 설정을 참조하세요.

IAP 액세스 설정

  1. Identity-Aware Proxy 페이지로 이동합니다.
    IAP(Identity-Aware Proxy) 페이지로 이동
  2. IAP로 보호하려는 프로젝트를 선택합니다.
  3. 액세스 권한을 부여할 리소스 옆에 있는 체크박스를 선택합니다.
  4. 오른쪽 패널에서 주 구성원 추가를 클릭합니다.
  5. 표시된 주 구성원 추가 대화상자에서 프로젝트에 대한 IAP 보안 웹 앱 사용자 역할이 있어야 하는 그룹 또는 개별 사용자의 이메일 주소를 입력합니다.

    다음과 같은 종류의 주 구성원이 이 역할을 가질 수 있습니다.

    • Google 계정: user@gmail.com
    • Google Groups: admins@googlegroups.com
    • 서비스 계정: server@example.gserviceaccount.com
    • Google Workspace 도메인: example.com

    액세스 권한이 있는 Google 계정을 추가해야 합니다.

  6. 역할 드롭다운 목록에서 Cloud IAP > IAP 보안 웹 앱 사용자를 선택합니다.
  7. 저장을 클릭합니다.

IAP 사용 설정 중

  1. IAP(Identity-Aware Proxy) 페이지의 애플리케이션에서 액세스를 제한하려는 애플리케이션을 찾습니다. 리소스에 IAP를 사용하려면
  2. 표시되는 IAP 사용 창에서 사용을 클릭하여 IAP가 리소스를 보호할 것임을 확인합니다. IAP를 사용하면 부하 분산기에 대한 모든 연결에 로그인 사용자 인증 정보가 필요합니다. 프로젝트에서 IAP 보안 웹 앱 사용자 역할이 있는 계정만 액세스할 수 있습니다.

gcloud

Before you set up your project and IAP, you need an up-to-date version of gcloud CLI. For instructions on how to install the gcloud CLI, see Install the gcloud CLI.

  1. To authenticate, use the Google Cloud CLI and run the following command. 
    gcloud auth login
  2. To sign in, follow the URL that appears.
  3. After you sign in, copy the verification code that appears and paste it in the command line.
  4. Run the following command to specify the project that contains the resource that you want to protect with IAP. 
    gcloud config set project PROJECT_ID
  5. Follow the instructions in Creating OAuth clients for IAP to configure the OAuth consent screen and create the OAuth client.
  6. Save the OAuth client ID and secret.
  7. To enable IAP, run the following command. 
    gcloud iap web enable \
    --oauth2-client-id=CLIENT_ID \
    --oauth2-client-secret=CLIENT_SECRET \
    --resource-type=app-engine

After you enable IAP, you can use the gcloud CLI to modify the IAP access policy using the IAM role roles/iap.httpsResourceAccessor. Learn more about managing roles and permissions.

API

  1. Follow the instructions in Creating OAuth clients for IAP to configure the OAuth consent screen and create the OAuth client.

  2. Save the OAuth client ID and secret.

  3. Run the following command to prepare a settings.json file. 

    cat << EOF > settings.json
{
"iap":
  {
    "enabled": true,
    "oauth2ClientId": "CLIENT_ID",
    "oauth2ClientSecret":" CLIENT_SECRET"
  }
}
EOF

  4. Run the following command to enable IAP. 

    curl -X PATCH \
-H "Authorization: Bearer $(gcloud auth application-default print-access-token)" \
-H "Accept: application/json" \
-H "Content-Type: application/json" \
-d @settings.json \
"https://appengine.googleapis.com/v1/apps/PROJECT_ID?updateMask=iap"

After you enable IAP, you can use the Google Cloud CLI to modify the IAP access policy using the IAM role roles/iap.httpsResourceAccessor. Learn more about managing roles and permissions.

Compute Engine

콘솔

If you haven't configured your project's OAuth consent screen, you'll be prompted to do so. To configure your OAuth consent screen, see Setting up your OAuth consent screen.

If you are running GKE clusters version 1.24 or later, you can configure IAP and GKE by using the Kubernetes Gateway API. To do so, complete the following steps and then follow the instructions in Configure IAP. Do not configure BackendConfig.

Setting up IAP access

  1. Go to the Identity-Aware Proxy page.
    Go to the Identity-Aware Proxy page
  2. Select the project you want to secure with IAP.

  3. Select the checkbox next to the resource you want to grant access to.

    If you don't see a resource, ensure that the resource is created and that the BackendConfig Compute Engine ingress controller is synced.

    To verify that the backend service is available, run the following gcloud command:

    gcloud compute backend-services list
  4. On the right side panel, click Add principal.
  5. In the Add principals dialog that appears, enter the email addresses of groups or individuals who should have the IAP-secured Web App User role for the project.

    The following kinds of principals can have this role:

    • Google Account: user@gmail.com
    • Google Group: admins@googlegroups.com
    • Service account: server@example.gserviceaccount.com
    • Google Workspace domain: example.com

    Make sure to add a Google Account that you have access to.

  6. Select Cloud IAP > IAP-secured Web App User from the Roles drop-down list.
  7. Click Save.

Turning on IAP

  1. On the Identity-Aware Proxy page, under APPLICATIONS, find the load balancer that serves the instance group you want to restrict access to. To turn on IAP for a resource,
    To enable IAP:
    • At least one protocol in the load balancer frontend configuration must be HTTPS. Learn about setting up a load balancer.
    • You need the compute.backendServices.update, clientauthconfig.clients.create, clientauthconfig.clients.update, and clientauthconfig.clients.getWithSecret permissions. These permissions are granted by roles, such as the Project Editor role. To learn more, see Managing access to IAP-secured resources.
  2. In the Turn on IAP window that appears, click Turn On to confirm that you want IAP to secure your resource. After you turn on IAP, it requires login credentials for all connections to your load balancer. Only accounts with the IAP-Secured Web App User role on the project will be given access.

gcloud

Before you set up your project and IAP, you need an up-to-date version of the gcloud CLI. For instructions on how to install the gcloud CLI, see Install the gcloud CLI.

  1. To authenticate, use the Google Cloud CLI and run the following command. 
    gcloud auth login
  2. To sign in, follow the URL that appears.
  3. After you sign in, copy the verification code that appears and paste it in the command line.
  4. Run the following command to specify the project that contains the resource that you want to protect with IAP. 
    gcloud config set project PROJECT_ID
  5. Follow the instructions in Creating OAuth clients for IAP. to configure the OAuth consent screen and create the OAuth client.
  6. Save the OAuth client ID and secret.
  7. To enable IAP, run either the globally or regionally scoped command.

    Global scope 
    gcloud compute backend-services update BACKEND_SERVICE_NAME \
    --global \
    --iap=enabled,oauth2-client-id=CLIENT_ID,oauth2-client-secret=CLIENT_SECRET
     Regional scope 
    gcloud compute backend-services update BACKEND_SERVICE_NAME \
    --region REGION_NAME \
    --iap=enabled,oauth2-client-id=CLIENT_ID,oauth2-client-secret=CLIENT_SECRET

After you enable IAP, you can use the gcloud CLI to modify the IAP access policy using the IAM role roles/iap.httpsResourceAccessor. Learn more about managing roles and permissions.

API

  1. Follow the instructions in Creating OAuth clients for IAP to configure the OAuth consent screen and create the OAuth client.

  2. Save the OAuth client ID and secret.

  3. Run the following command to prepare a settings.json file. 

    cat << EOF > settings.json
{
"iap":
  {
    "enabled": true,
    "oauth2ClientId": "CLIENT_ID",
    "oauth2ClientSecret": "CLIENT_SECRET"
  }
}
EOF

  4. Run the following command to enable IAP. 

    curl -X PATCH \
-H "Authorization: Bearer $(gcloud auth application-default print-access-token)" \
-H "Accept: application/json" \
-H "Content-Type: application/json" \
-d @settings.json \
"https://compute.googleapis.com/compute/v1/projects/PROJECT_ID/REGION/backendServices/BACKEND_SERVICE_NAME"

After you enable IAP, you can use the gcloud CLI to modify the IAP access policy using the IAM role roles/iap.httpsResourceAccessor. Learn more about managing roles and permissions.

Cloud Run

콘솔

If you haven't configured your project's OAuth consent screen, you're prompted to do so. To configure your OAuth consent screen, see Setting up your OAuth consent screen

Setting up IAP access

  1. Open the Identity-Aware Proxy page.
    Go to Identity-Aware Proxy
  2. Select the project you want to secure with IAP.
  3. Under Applications, select the checkbox next to the load balancer backend service to which you want to add members.
  4. On the right side panel, click Add member.

  5. In the Add members dialog, enter the accounts of groups or individuals who should have the IAP-secured Web App User role for the project. The following kinds of accounts can be members:

    • Google Account: user@gmail.com - This can also be a Google Workspace account, such as user@google.com or some other Google Workspace domain.
    • Google Group: admins@googlegroups.com
    • Service account: server@example.gserviceaccount.com
    • Google Workspace domain: example.com

  6. Select Cloud IAP > IAP-secured Web App User from the Roles list.

  7. Click Save.

Turning on IAP

  1. On the IAP page, under Applications, find the load balancer backend service to which you want to restrict access. Click the IAP toggle to enable IAP on a resource.
  2. In the Turn on IAP window that appears, click Turn On to confirm that you want IAP to secure your resource. After you turn on IAP, it requires login credentials for all connections to your load balancer. Only accounts with the IAP-Secured Web App User role on the project will be given access.

  3. To authorize IAP to send traffic to the backend Cloud Run service, follow the instructions at Add principals to a service to add the following principle and role.

    • Principal: service-[PROJECT-NUMBER]@gcp-sa-iap.iam.gserviceaccount.com
    • Role: Cloud Run Invoker

gcloud

  1. Follow the instructions in Creating OAuth clients for IAP to configure the OAuth consent screen and create the OAuth client.
  2. Save the OAuth client ID and secret.
  3. If you have not previously done so, create a service account by running the following command. If you previously created a service account, running the command does not create duplicate service accounts. 
    gcloud beta services identity create \
    --service=iap.googleapis.com --project=PROJECT_ID
  4. Grant the invoker permission to the service account, created in the previous step, by running the following command. 
    gcloud run services add-iam-policy-binding SERVICE-NAME \
    --member='serviceAccount:service-PROJECT-NUMBER@gcp-sa-iap.iam.gserviceaccount.com' \
    --role='roles/run.invoker'

  5. Enable IAP by running either the globally or regionally scoped command, depending on whether your load balancer backend service is global or regional. Use the OAuth client ID and secret from the previous step.

    Global scope 

    gcloud compute backend-services update BACKEND_SERVICE_NAME \
    --global \
    --iap=enabled,oauth2-client-id=CLIENT_ID,oauth2-client-secret=CLIENT_SECRET

    Regional scope 

    gcloud compute backend-services update BACKEND_SERVICE_NAME \
    --region REGION_NAME \
    --iap=enabled,oauth2-client-id=CLIENT_ID,oauth2-client-secret=CLIENT_SECRET
    Replace the following:

    • BACKEND_SERVICE_NAME: the name of the backend service.
    • CLIENT_ID: the OAuth client ID, from the previous step.
    • CLIENT_SECRET: the OAuth client secret, from the previous step.
    • REGION_NAME: the region in which you want to enable IAP.

After you enable IAP, you can use the Google Cloud CLI to modify the IAP access policy using the Identity and Access Management role roles/iap.httpsResourceAccessor. See Managing roles and permissions for more information.

Google Kubernetes Engine

콘솔

If you haven't configured your project's OAuth consent screen, you'll be prompted to do so. To configure your OAuth consent screen, see Setting up your OAuth consent screen.

If you are running GKE clusters version 1.24 or later, you can configure IAP and GKE by using the Kubernetes Gateway API. To do so, complete the following steps and then follow the instructions in Configure IAP. Do not configure BackendConfig.

Setting up IAP access

  1. Go to the Identity-Aware Proxy page.
    Go to the Identity-Aware Proxy page
  2. Select the project you want to secure with IAP.

  3. Select the checkbox next to the resource you want to grant access to.

    If you don't see a resource, ensure that the resource is created and that the BackendConfig Compute Engine ingress controller is synced.

    To verify that the backend service is available, run the following gcloud command:

    gcloud compute backend-services list
  4. On the right side panel, click Add principal.
  5. In the Add principals dialog that appears, enter the email addresses of groups or individuals who should have the IAP-secured Web App User role for the project.

    The following kinds of principals can have this role:

    • Google Account: user@gmail.com
    • Google Group: admins@googlegroups.com
    • Service account: server@example.gserviceaccount.com
    • Google Workspace domain: example.com

    Make sure to add a Google Account that you have access to.

  6. Select Cloud IAP > IAP-secured Web App User from the Roles drop-down list.
  7. Click Save.

Turning on IAP

  1. On the Identity-Aware Proxy page, under APPLICATIONS, find the load balancer that serves the instance group you want to restrict access to. To turn on IAP for a resource,
    To enable IAP:
    • At least one protocol in the load balancer frontend configuration must be HTTPS. Learn about setting up a load balancer.
    • You need the compute.backendServices.update, clientauthconfig.clients.create, clientauthconfig.clients.update, and clientauthconfig.clients.getWithSecret permissions. These permissions are granted by roles, such as the Project Editor role. To learn more, see Managing access to IAP-secured resources.
  2. In the Turn on IAP window that appears, click Turn On to confirm that you want IAP to secure your resource. After you turn on IAP, it requires login credentials for all connections to your load balancer. Only accounts with the IAP-Secured Web App User role on the project will be given access.

GKE

Configure the BackendConfig

If you are running GKE clusters version 1.24 or later, you can configure IAP and GKE by using the Kubernetes Gateway API. See Configure IAP for instructions.

  1. Follow the instructions in Creating OAuth clients for IAP to configure the OAuth consent screen and create the OAuth client.

  2. Create a Kubernetes Secret to wrap the OAuth client. 

    kubectl create secret generic MY_SECRET --from-literal=client_id=CLIENT_ID \
  --from-literal=client_secret=CLIENT_SECRET
    Replace the following:

    • MY_SECRET: The name of the secret to create
    • CLIENT_ID: The OAuth client ID
    • CLIENT_SECRET: The OAuth client secret

    You should receive confirmation, like the following output, that the Secret was successfully created: 

    secret "MY_SECRET" created

  3. Add the OAuth credentials to the BackendConfig. 

    apiVersion: cloud.google.com/v1
kind: BackendConfig
metadata:
  name: CONFIG_DEFAULT
  namespace: my-namespace
spec:
iap:
  enabled: true
  oauthclientCredentials:
    secretName: MY_SECRET

  4. Enable IAP by associating Service ports with your BackendConfig. See Associating BackendConfig with your Ingress. One way to make this association is to make all ports for the service default to your BackendConfig, which you can do by adding the following annotation to your Service resource: 

    metadata:
  annotations:
      beta.cloud.google.com/backend-config: '{"default": "CONFIG_DEFAULT"}}'

After you enable IAP, you can use the gcloud CLI to modify the IAP access policy using the IAM role roles/iap.httpsResourceAccessor. Learn more about managing roles and permissions.

Troubleshooting

If the secretName you referenced doesn't exist or isn't structured properly, one of the following error messages will display:

  • BackendConfig default/config-default is not valid: error retrieving secret "foo": secrets "foo" not found. To resolve this error, make sure that you've created the Kubernetes Secret correctly as described in step 2.

  • BackendConfig default/config-default is not valid: secret "foo" missing client_secret data. To resolve this error, make sure that you've created the OAuth credentials correctly. Also, make sure that you referenced the correct client_id and client_secret keys.