How-to guides

Using Google identities

• Enabling IAP for App Engine

  Use the Google Cloud console to enable IAP for App Engine.

• Enabling IAP for Compute Engine

  Use the Google Cloud console or gcloud command-line tool to enable IAP for Compute Engine.

• Enabling IAP for GKE

  Use the Google Cloud console or gcloud command-line tool to enable IAP for GKE.

• Enabling IAP for on-premises apps

  Secure an HTTP-based, on-premises app outside of Google Cloud with IAP.

• Getting the user's identity

  Get a user's identity with IAP.

• Managing user access

  Authorize users and groups to access resources protected by IAP.

• Managing IAP sessions

  Set up session refresh for your AJAX applications.

• Authenticating from a service account or mobile app

  Authenticate a service account or mobile app to access resources secured by IAP.

• Programmatically create OAuth clients

  Create OAuth clients in IAP programmatically via an API.

• Setting up context-aware access

  Set up IAP to grant conditional access based on request context.

• Using IAP for TCP forwarding

  Use IAP to control who can access administrative services like SSH and RDP on your backends from the public internet.

• Securing IAP for TCP forwarding with VPC Service Controls

  Use VPC Service Controls to protect IAP for TCP forwarding and use IAP for TCP forwarding within a VPC Service Controls perimeter.

Using external identities

• Enabling external identities

  Enable Identity-Aware Proxy for use with external identities.

• Creating a sign-in page with FirebaseUI

  Build an authentication page using FirebaseUI.

• Creating a custom sign-in page

  Create a fully customized authentication UI.

• Accessing non-Google resources programmatically

  Access external resources from code.

• Managing external identity sessions

  Refresh expired user credentials from an external provider.

• Using service accounts with external identities

  Authenticate using service accounts with external identities.

Other how-to guides

• Customizing IAP

  Customize the behavior of IAP.

• Enabling Cloud Audit Logs

  Enable logging of resources secured by IAP.

• Setting up an external HTTPS load balancer

  Set up IAP-compatible load balancing and firewall rules for Compute Engine instances.

• Configure SAML attribute propagation

  You can use this feature to propagate SAML attributes from an identity provider to applications protected by IAP.

• Securing your app with signed headers

  Secure your app with signed headers to provide extra assurance that a request to IAP is authorized.

• Restrict resource access to specific domains

  Restrict resource access to specific domains by configuring allowed domains.

• Using query parameters and headers

  Use IAP query parameters and headers to enhance and personalize your app.

• Integrating IAP with Cloud Service Mesh

  Deploy a simple application on Cloud Service Mesh with a load balancer, and integrate with IAP.