向受 IAP 保护的应用发送服务帐号请求会导致'Invalid GCIP ID token: JWT signature is invalid'

Question

我正试图通过Python从GCP环境外部以编程方式访问受iap保护的应用程序引擎标准应用程序。我尝试了各种方法，包括这里的文档中显示的方法:https://cloud.google.com/iap/docs/authentication-howto#iap-make-request-python。下面是我的代码:

from google.auth.transport.requests import Request
from google.oauth2 import id_token
import requests
def make_iap_request(url, client_id, method='GET', **kwargs):
"""Makes a request to an application protected by Identity-Aware Proxy.
Args:
url: The Identity-Aware Proxy-protected URL to fetch.
client_id: The client ID used by Identity-Aware Proxy.
method: The request method to use
('GET', 'OPTIONS', 'HEAD', 'POST', 'PUT', 'PATCH', 'DELETE')
**kwargs: Any of the parameters defined for the request function:
https://github.com/requests/requests/blob/master/requests/api.py
If no timeout is provided, it is set to 90 by default.
Returns:
The page body, or raises an exception if the page couldn't be retrieved.
"""
# Set the default timeout, if missing
if 'timeout' not in kwargs:
kwargs['timeout'] = 90
# Obtain an OpenID Connect (OIDC) token from metadata server or using service
# account.
open_id_connect_token = id_token.fetch_id_token(Request(), client_id)
print(f'{open_id_connect_token=}')
# Fetch the Identity-Aware Proxy-protected URL, including an
# Authorization header containing "Bearer " followed by a
# Google-issued OpenID Connect token for the service account.
resp = requests.request(
method, url,
headers={'Authorization': 'Bearer {}'.format(
open_id_connect_token)}, **kwargs)
print(f'{resp=}')
if resp.status_code == 403:
raise Exception('Service account does not have permission to '
'access the IAP-protected application.')
elif resp.status_code != 200:
raise Exception(
'Bad response from application: {!r} / {!r} / {!r}'.format(
resp.status_code, resp.headers, resp.text))
else:
return resp.text
if __name__ == '__main__':
res = make_iap_request(
'https://MYAPP.ue.r.appspot.com/',
'Client ID from IAP>App Engine app>Edit OAuth Client>Client ID'
)
print(res)

当我在本地运行它时，我将GOOGLE_APPLICATION_CREDENTIALS环境变量设置为包含我想要使用的服务帐户的密钥的本地JSON凭证文件。我也试过在Cloud Functions中运行这个，所以它可能会使用元数据服务来获取App Engine默认的服务帐户(我认为?)。

在这两种情况下，我都能够生成一个看起来有效的令牌。使用jwt。我看到它包含预期的数据，并且签名是有效的。然而，当我使用令牌向应用程序发出请求时，我总是得到这个异常:

来自应用程序的错误响应:401/{' x - Google - app - generated - response ': 'true'， 'Date': 'Tue, 09 Feb 2021 19:25:43 GMT'， 'Content-Type': 'text/html'， 'Server': 'Google Frontend'， 'Content-Length': '47'， 'Alt-Svc': 'h3-29=";马= 2592000,h3-T051 =":443";;马= 2592000,h3-Q050 =":443";;马= 2592000,h3-Q046 =":443";;马= 2592000,h3-Q043 =":443";;马= 2592000,quic =":443";;马= 2592000;v="46,43"'}/'无效的GCIP ID令牌:JWT签名无效'

我做错了什么?

Answer 1

这个问题的解决方案是将Google身份令牌交换为身份平台身份令牌。

错误Invalid GCIP ID token: JWT signature is invalid的原因是使用由Google RSA私钥签名的Google身份令牌，而不是由Google Identity Platform RSA私钥签名的。我忽略了错误消息中的GCIP，一旦我们验证令牌在使用中没有损坏，它就会告诉我解决方案。

在问题中，这行代码获取Google Identity Token:

open_id_connect_token = id_token.fetch_id_token(Request(), client_id)

上面的代码行需要设置Google Cloud Application默认凭据。示例:set GOOGLE_APPLICATION_CREDENTIALS=c:configservice-account.json

下一步是将此令牌交换为身份平台令牌:

def exchange_google_id_token_for_gcip_id_token(google_open_id_connect_token):
SIGN_IN_WITH_IDP_API = 'https://identitytoolkit.googleapis.com/v1/accounts:signInWithIdp'
API_KEY = '';
url = SIGN_IN_WITH_IDP_API + '?key=' + API_KEY;
data={
'requestUri': 'http://localhost',
'returnSecureToken': True,
'postBody':'id_token=' + google_open_id_connect_token + '&providerId=google.com'}
try:
resp = requests.post(url, data)
res = resp.json()
if 'error' in res:
print("Error: {}".format(res['error']['message']))
exit(1)
# print(res)
return res['idToken']
except Exception as ex:
print("Exception: {}".format(ex))
exit(1)

API Key可以在Google Cloud Console ->身份的平台。右上方"应用程序设置详细信息"。这将显示apiKey和authDomain。

更多信息可在此链接找到:

用Google令牌交换身份平台令牌