Using nested authentication with Google IAP

Question

I deployed a 3rd party webapp which uses basic authentication for access on Google Cloud Run. I additionally wanted to protect the endpoint by allowing only Google-authenticated users of the organization access. Both these methods use the Authorization header of the request and I cannot get it to work.

I tried following this post, providing both credentials in one field. My reasoning was, that GCP should select the strongest credential mechanism it supports - bearer - and leave the basic credentials for the webap. I have no idea if the webapp could have dealt with it because Google's reverse proxy already barred my access.

curl "-HAuthorization: bearer ${bearer_token}, basic ${base64_userpw}" https://my-google-endpoint.com

-> 401 Unauthorized

I also tried Proxy-Authorization with no different result. curl "-HProxy-Authorization: bearer ${bearer_token}" "-HAuthorization: basic ${base64_userpw}" https://my-google-endpoint.com

Is there a way to get nested authentication to work with Google's reverse proxy? I was able to get past the reversed proxy by only supplying the bearer but naturally hit the wall at the service. With deactivated authentication on proxy side I was able to authenticate with the service using the basic credentials.

P.S.: I am not using a browser to access the webapp but command line tools.

I might be mistaken in the terminology. I configured Cloud Run to allow only authenticated access and assumed that it is the same principle as IAP. — user3206815, Dec 27 '19 at 08:09

score 1 · Answer 1 · answered Dec 12 '19 at 04:45

1

You cannot mix Authorization mechanisms with IAP. Everything after the bearer keyword is considered the token string.

One solution is to change your Basic Authorization HTTP header from using Authorization to a custom HTTP header. Something like X-MyApp-Authorization. Then your app processes the custom header to handle the Basic Authorization mechanism.

answered Dec 12 '19 at 04:45

John Hanley

44,336
6
35
81

Thanks for your suggestion. I took the Dockerfile of the service and just deployed it. I therefore did not delve deep into re-configuring the uwsgi service. – user3206815 Dec 27 '19 at 08:06

score 0 · Answer 2 · answered Dec 12 '19 at 05:19

0

Does it happen to work if you send two Authorization headers, like curl -H "Authorization: bearer foo" -H "Authorization: basic bar" ?

--Matthew, Google Cloud IAP engineering

answered Dec 12 '19 at 05:19

Matthew Sachs

1,450
4
9

A lot of frameworks/libraries use dictionaries for storing headers. Plus, you cannot have two HTTP headers with the same name. – John Hanley Dec 12 '19 at 15:37
Better to add this as a comment as it is not an answer. – AhmetB - Google Dec 12 '19 at 17:29

Using nested authentication with Google IAP

2 Answers2

Linked