User Authentication: Identity-Aware Proxy

GSP499 — User Authentication: Identity-Aware Proxy

Estimated time: 30 minutes

# 🔐 User Authentication with Identity-Aware Proxy > ⚠️ **Disclaimer:** This is an independent, community-made walkthrough created to help you understand why each step works. Attempt the challenge yourself first. This guide is provided for educational purposes and is not intended to replace the official lab instructions or your own hands-on learning. It is not affiliated with or endorsed by Google Cloud or Google Cloud Skills Boost. Always follow the official Google Cloud and Qwiklabs terms of

GREEN='\e[1;32m'
CYAN='\e[1;36m'
YELLOW='\e[1;33m'
BLUE='\e[1;34m'
MAGENTA='\e[1;35m'
WHITE='\e[1;37m'
RESET='\e[0m'
BOLD='\e[1m'

clear
echo -e "${CYAN}${BOLD}"
cat << "EOF"
  ____       _     _ _            __    ___            
 / __ \     | |   (_) |          / _|  / _ \           
| |  | |_ __| |__  _| |_   ___  | |_  | | | |_ __  ___ 
| |  | | '__| '_ \| | __| / _ \ |  _| | | | | '_ \/ __|
| |__| | |  | |_) | | |_ | (_) || |   | |_| | |_) \__ \
 \____/|_|  |_.__/|_|\__| \___/ |_|    \___/| .__/|___/
                                            | |        
                                            |_|        
EOF
echo -e "${RESET}"

echo -e "${BLUE}${BOLD}╔════════════════════════════════════════════════════════════╗${RESET}"
echo -e "${BLUE}${BOLD}║   🌊 WELCOME TO Orbit Of Ops                               ║${RESET}"
echo -e "${BLUE}${BOLD}║   🚀 TARGET: GSP499 IAP USER AUTHENTICATION LAB            ║${RESET}"
echo -e "${BLUE}${BOLD}╚════════════════════════════════════════════════════════════╝${RESET}\n"

echo -e "${BOLD}${YELLOW}[Orbit of Ops] Auto-fetching configurations...${RESET}"
export PROJECT_ID=$(gcloud config get-value project 2>/dev/null)
export STUDENT_EMAIL=$(gcloud config get-value account 2>/dev/null)
export ZONE=$(gcloud compute project-info describe --format="value(commonInstanceMetadata.items[google-compute-default-zone])" 2>/dev/null | tail -n 1)

if [[ -z "$ZONE" ]]; then
    read -p "$(echo -e ${BOLD}${CYAN}"Please enter the lab Zone (e.g., us-east1-c): "${RESET})" ZONE
    export ZONE
fi

export REGION=${ZONE%-*}
gcloud config set run/region $REGION 2>/dev/null

echo -e "✅ Project ID: ${GREEN}$PROJECT_ID${RESET}"
echo -e "✅ Region:     ${GREEN}$REGION${RESET}"
echo -e "✅ User Email: ${GREEN}$STUDENT_EMAIL${RESET}\n"

# ==============================================================================
# TASK 1: DEPLOY HELLO WORLD
# ==============================================================================
echo -e "${GREEN}${BOLD}▬▬▬▬▬▬ TASK 1: DEPLOY HELLO WORLD TO CLOUD RUN ▬▬▬▬▬▬${RESET}"
echo -e "${YELLOW}[*] Enabling required APIs (Run, IAP, Build, Artifact Registry)...${RESET}"
gcloud services enable run.googleapis.com iap.googleapis.com cloudbuild.googleapis.com artifactregistry.googleapis.com --quiet

echo -e "${YELLOW}[*] Downloading application source code...${RESET}"
cd ~/
gsutil cp gs://spls/gsp499/user-authentication-with-iap.zip . >/dev/null 2>&1
unzip -q user-authentication-with-iap.zip

echo -e "${YELLOW}[*] Deploying 1-HelloWorld to Cloud Run...${RESET}"
cd user-authentication-with-iap/1-HelloWorld
gcloud run deploy user-auth-lab --source . --allow-unauthenticated --region=$REGION --quiet

echo -e "\n${CYAN}${BOLD}✓ Deployment Complete!${RESET}"
echo -e "${MAGENTA}${BOLD}⚠️ STOP! YOU MUST COMPLETE THE MANUAL IAP STEPS IN THE CONSOLE NOW. ⚠️${RESET}"
echo -e "Your Student Email for the IAM policy is: ${WHITE}${BOLD}$STUDENT_EMAIL${RESET}\n"

GREEN='\e[1;32m'
CYAN='\e[1;36m'
YELLOW='\e[1;33m'
RESET='\e[0m'
BOLD='\e[1m'

export REGION=$(gcloud config get-value run/region 2>/dev/null)

# ==============================================================================
# TASK 2: DEPLOY HELLO USER
# ==============================================================================
echo -e "\n${GREEN}${BOLD}▬▬▬▬▬▬ TASK 2: ACCESS USER IDENTITY INFORMATION ▬▬▬▬▬▬${RESET}"
echo -e "${YELLOW}[*] Deploying 2-HelloUser to Cloud Run...${RESET}"

cd ~/user-authentication-with-iap/2-HelloUser
gcloud run deploy user-auth-lab --source . --region=$REGION --quiet

echo -e "\n${CYAN}${BOLD}✓ Part 2 Complete! Check your progress for Task 2.${RESET}"
echo -e "${MAGENTA}${BOLD}⚠️ NEXT MANUAL STEP: Disable IAP, then get your JWT Audience Code! ⚠️${RESET}\n"

GREEN='\e[1;32m'
CYAN='\e[1;36m'
YELLOW='\e[1;33m'
MAGENTA='\e[1;35m'
RESET='\e[0m'
BOLD='\e[1m'

export PROJECT_ID=$(gcloud config get-value project 2>/dev/null)
export PROJECT_NUMBER=$(gcloud projects describe $PROJECT_ID --format='value(projectNumber)' 2>/dev/null)
export REGION=$(gcloud config get-value run/region 2>/dev/null)

echo -e "\n${GREEN}${BOLD}▬▬▬▬▬▬ TASK 3: CRYPTOGRAPHIC VERIFICATION ▬▬▬▬▬▬${RESET}"
read -p "$(echo -e ${BOLD}${CYAN}"🔹 Paste your JWT Audience Code (Client ID) here: "${RESET})" IAP_AUDIENCE

echo -e "${YELLOW}[*] Deploying 3-HelloVerifiedUser to Cloud Run with JWT validation...${RESET}"
cd ~/user-authentication-with-iap/3-HelloVerifiedUser
gcloud run deploy user-auth-lab \
    --source . \
    --set-env-vars IAP_AUDIENCE="$IAP_AUDIENCE" \
    --region=$REGION \
    --quiet

echo -e "${YELLOW}[*] Binding IAP Service Agent to Cloud Run Invoker...${RESET}"
gcloud run services add-iam-policy-binding user-auth-lab \
    --member="serviceAccount:service-${PROJECT_NUMBER}@gcp-sa-iap.iam.gserviceaccount.com" \
    --role="roles/run.invoker" \
    --region=$REGION \
    --quiet

echo -e "\n${CYAN}${BOLD}✓ Final Deployment Complete!${RESET}"
echo -e "${MAGENTA}${BOLD}⚠️ LAST MANUAL STEP: Turn IAP back ON in the console to verify! ⚠️${RESET}"
echo -e "\n${MAGENTA}${BOLD}╔════════════════════════════════════════════════════════════╗${RESET}"
echo -e "${MAGENTA}${BOLD}║           🎉 AUTOMATION COMPLETED SUCCESSFULLY 🎉          ║${RESET}"
echo -e "${MAGENTA}${BOLD}╚════════════════════════════════════════════════════════════╝${RESET}"