This page provides guidance for managing Identity-Aware Proxy (IAP) with Workforce Identity Federation sessions.
When you set up a workforce pool, you can specify the session duration between Google Cloud and an IdP. You can specify the session duration to be between 15 minutes and 12 hours. This setting is also the length of the IAP session cookie. The default session duration time is one hour.
When a session expires, the end user is redirected to third-party IdP to sign in. If the third-party IdP session is still active, sign-in is silent.
For more information about setting the session duration time, see Manage workforce identity pool providers.
Establish a session using an AJAX request
When working with Workforce Identity Federation, you can also make AJAX requests to establish a session.
IAP relies on cookies to manage user sessions and a sequence of redirects to establish a session during sign-in. If your application uses Cross-Origin Resource Sharing (CORS) to make AJAX requests from a source domain to a target domain that hosts an IAP-secured application, you must first establish an IAP session on the target domain out of band. Cookies can't be shared between the source domain and the target domain.
After a session is established on the target domain, configure your requests to include credentials because JavaScript methods don't attach cookies by default:
- For
XMLHttpRequestobjects, set thewithCredentialsproperty totrue. - For the
Fetch API, set thecredentialsoption toincludeorsame-origin.
For expired or unauthenticated AJAX requests, IAP returns an HTTP
401: Unauthorized status code. If your AJAX requests receive a 302 status
code instead of 401, add an X-Requested-With header with a value of
"XMLHttpRequest" to indicate that the request originates from JavaScript. To
establish or refresh the session after receiving an HTTP 401 response, open a
new window for the target domain URL with ?gcp-iap-mode=DO_SESSION_REFRESH
appended.