Cloud Run user auth for internal apps

In this video, Martin demonstrates how to host an application on Cloud Run using Google's Identity-Aware Proxy and ensure only a list of approved users can access it. Developers can use Identity-Aware Proxy with applications hosted on Compute Engine, App Engine, and Kubernetes Engine, so it can be a single control panel for granting users access to all your internal applications.

[KevinBoutin]

IAP is a game changer. I wish other cloud providers would take note and do something similar! Well done Google!

[savislin]

IAP is very powerful. We used to utilize a custom VPN for this kind of access.

[jwxu]

Everything worked out great. Only problem is, my users usually on their personal google account. After enable internal only, they will be blocked and see org_internal error screen (which is expected), but they don't have option to switch accounts. Is there a way to include a button in the consent screen to allow user to switch accounts?

[kernellpanic]

I have multiple App Engine Services.... It looks like I can turn on IAP for the whole app engine but not for individual services.

[rcarias]

This was nice explained. I love GCR. Anyone know of video on how to use their sidecar feature? Multiple containers in one service

[dherbs]

Very nice explanation!
One Q: Around the 9:00 mark when creating the oauth config you mentioned not needing any additional scopes. Can you point to the docs or an example of if you wanted to have an application using IAP and access GCS or other google cloud resources on behalf of the user (say to prompt a user for a source of data and let them browse their gcs buckets ) - how does the app take its authenticated user and parlay that into a google user id token to access downstream services?

[milan]

Can't change OAuth screen to internal once it's been created. I had an old OAuth consent screen and cannot edit it or remove it.

[anilmm]

Nice one Martin. Please look at making future videos with infra automation along with Console based set up as real world use cases are mostly using these

[John]

Does this setup facilitate IAP validating a user, then based off that users credentials the Load Balancer routes them to their specific Cloud Run app?

[AndreyBushmakin-nvob]

Hello, I did everything the same as was mentioned in this video. But getting error from origin has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource. After refresh it's gone but after clearing cookies still exist. Could some one help with it?

[rickmcgeer]

I would like to verify my users on my website, hosted outside of Google, and then simply send a bearer token with them to my Cloud run service (in other words, google would not be involved in authenticating my users). is there a setting on Cloud run which permits access with only a bearer token?

[MartinTesson]

Hi, I followed everything mentionned in this tutorial but when I want to access my Web App, I only get the "Forbidden" response... Which is normal since I'm never invited to authenticate, is there something I am missing ? :/

[nicolas]

Advertising a Global Load Balancer for each internal service. This is insane ! Is google paying for the bill?

[AbhishekKumar-bty]

I am not able to see my cloud run apps under IAP

[JC-yynf]

I cannot stand these "fun kid friendly" coding tutorials. Just get to the point and leave the fluff away

[ChrisPearson-cs]

This is very cool, however I found the video to be very patronising

[AbhishekSingh-ggdj]

@googlecloudruntech I cannot see cloud run in the IAP section