This sample demonstrates how to use the [Identity-Aware Proxy][iap-docs] on [Google App

Engine][ae-docs].

[iap-docs]: https://cloud.google.com/iap/docs/

[ae-docs]: https://cloud.google.com/appengine/docs/java/

This application depends on being enabled behind an IAP, so this program should not be run locally.

- Update [appengine-web.xml](src/main/test/app/src/main/webapp/WEB-INF/appengine-web.xml) with your project-id

- Deploy the application to the project

```

<project>

<modelVersion>4.0.0</modelVersion>

<packaging>war</packaging>

<version>1.0-SNAPSHOT</version>

<groupId>com.example.appengine</groupId>

<artifactId>iap-demo</artifactId>

<!-- Parent POM defines ${appengine.sdk.version} (updates frequently). -->

<parent>

<groupId>com.google.cloud</groupId>

<artifactId>appengine-doc-samples</artifactId>

<version>1.0.0</version>

<relativePath>..</relativePath>

</parent>

<dependencies>

<dependency>

<groupId>javax.servlet</groupId>

<artifactId>servlet-api</artifactId>

<version>2.5</version>

<scope>provided</scope>

</dependency>

</dependencies>

<build>

<!-- for hot reload of the web application -->

<outputDirectory>${project.build.directory}/${project.build.finalName}/WEB-INF/classes</outputDirectory>

<plugins>

<plugin>

<groupId>org.apache.maven.plugins</groupId>

<version>3.3</version>

<artifactId>maven-compiler-plugin</artifactId>

<configuration>

<source>1.7</source>

<target>1.7</target>

</configuration>

</plugin>

<plugin>

<groupId>com.google.appengine</groupId>

<artifactId>appengine-maven-plugin</artifactId>

<version>${appengine.sdk.version}</version>

</plugin>

</plugins>

</build>

</project>

package com.example.appengine.iap;

import java.io.IOException;

import javax.servlet.http.HttpServlet;

import javax.servlet.http.HttpServletRequest;

import javax.servlet.http.HttpServletResponse;

@SuppressWarnings("serial")

public class JwtServlet extends HttpServlet {

private static final String IAP_JWT_HEADER = "x-goog-authenticated-user-jwt";

@Override

public void doGet(HttpServletRequest req, HttpServletResponse resp) throws IOException {

resp.getWriter().print(IAP_JWT_HEADER + ":" + req.getHeader(IAP_JWT_HEADER));

}

}

<?xml version="1.0" encoding="utf-8"?>

<appengine-web-app xmlns="http://appengine.google.com/ns/1.0">

<application>ja-test-iap-2</application>

<version>alpha-001</version>

<threadsafe>true</threadsafe>

</appengine-web-app>

<?xml version="1.0" encoding="utf-8"?>

<web-app xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="http://java.sun.com/xml/ns/javaee"

xmlns:web="http://java.sun.com/xml/ns/javaee/web-app_2_5.xsd"

xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-app_2_5.xsd"

version="2.5">

<servlet>

<servlet-name>hello</servlet-name>

<servlet-class>com.example.appengine.iap.JwtServlet</servlet-class>

</servlet>

<servlet-mapping>

<servlet-name>hello</servlet-name>

<url-pattern>/</url-pattern>

</servlet-mapping>

</web-app>

Cloud Identity-Aware Proxy (Cloud IAP) lets you manage access to applications running in Compute Engine, App Engine standard environment, and Container Engine. Cloud IAP establishes a central authorization layer for applications accessed by HTTPS, enabling you to adopt an application-level access control model instead of relying on network-level firewalls. When you enable Cloud IAP, you must also use signed headers or the App Engine standard environment Users API to secure your app.

- A Google Cloud project with billing enabled

- [Create an App engine service account](https://cloud.google.com/docs/authentication#getting_credentials_for_server-centric_flow) and download the credentials file as JSON.

- Install the [Google Cloud SDK](https://cloud.google.com/sdk/) and run:

- [BuildIapRequest.java](src/main/java/com/example/iap/BuildIapRequest.java) demonstrates how to set the

`Authorization : Bearer` header to authorize access to an IAP protected URL.

- [VerifyIapRequestHeader.java](src/main/java/com/example/iap/VerifyIapRequestHeader.java) demonstrates how to

verify the JWT token in an incoming request to an IAP protected resource.

- Deploy the [demo app engine application](../appengine/iap/README.md). This application will return the JWT token to an authorized incoming request.

It will be used to test both the authorization of an incoming request to an IAP protected resource and the JWT token returned from IAP.

- Update [appengine-web.xml](../appengine/src/main/webapp/WEB-INF/appengine-web.xml)

with your project-id

- Deploy the application to the project

```

mvn clean appengine:update

```

- [Enable](https://cloud.google.com/iap/docs/app-engine-quickstart) Identity-Aware Proxy on the App Engine app.

- Set the environment variable `GOOGLE_APPLICATION_CREDENTIALS` to point to the service account credentials file

- Add the service account email you'll be running the test as to the Identity-Aware Proxy access list for the project.

- Set the environment variable `IAP_PROTECTED_URL` to point to `https://your-project-id.appspot.com`

- Run the integration test:

[JWT library for Java](https://github.com/auth0/java-jwt)

[Cloud IAP docs](https://cloud.google.com/iap/docs/)

<?xml version="1.0" encoding="UTF-8"?>

<project> <!-- REQUIRED -->

<modelVersion>4.0.0</modelVersion> <!-- REQUIRED -->

<packaging>jar</packaging> <!-- REQUIRED -->

<groupId>com.example</groupId>

<artifactId>iap-samples</artifactId> <!-- Name of your project -->

<version>1.0-SNAPSHOT</version> <!-- xx.xx.xx -SNAPSHOT means development -->

<properties>

<maven.compiler.source>1.8</maven.compiler.source> <!-- REQUIRED -->

<maven.compiler.target>1.8</maven.compiler.target> <!-- REQUIRED -->

<project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>

<jetty.maven.plugin>9.4.3.v20170317</jetty.maven.plugin>

</properties>

<dependencyManagement>

<dependencies>

<dependency>

<groupId>com.fasterxml.jackson.core</groupId>

<artifactId>jackson-core</artifactId>

<version>2.8.6</version>

</dependency>

</dependencies>

</dependencyManagement>

<dependencies>

<dependency> <!-- REQUIRED -->

<groupId>javax.servlet</groupId> <!-- Java Servlet API -->

<artifactId>javax.servlet-api</artifactId>

<version>3.1.0</version>

</dependency>

<!-- [START dependencies] -->

<dependency>

<groupId>com.google.auth</groupId>

<artifactId>google-auth-library-oauth2-http</artifactId>

<version>0.6.0</version>

</dependency>

<dependency>

<groupId>com.auth0</groupId>

<artifactId>java-jwt</artifactId>

<version>3.2.0</version>

</dependency>

<!-- [END dependencies] -->

<!-- Test dependencies -->

<dependency>

<groupId>junit</groupId>

<artifactId>junit</artifactId>

<version>4.12</version>

</dependency>

</dependencies>

</project>