Djangae AppEngine misbehaves with IAP

Question

Code that I have used to handle user login and admin login:

    # if not logged in, divert to login page
    if users.get_current_user() is None:
        return redirect('whoami')
    # if logged in, Check if user is an admin
    elif not users.is_current_user_admin():
        return render(request, 'template.html', {'heading': 'Bad Request (400)',
                                                 'message': ['You are not logged in as administrator'],
                                                 'user_email': users.get_current_user().email()})

Everything works fine when I use the Djangae appengine with Datastore (Django with datastore support) back-end but when I enable the Google Identity Aware Protocol (Google IAP) everything starts failing. When I checked the logs, It says that there was an IntegrityError in djangae_gaedatastoreuser on the field email_lower

IntegrityError: Unique constraint violation for kind djangae_gaedatastoreuser on fields: email_lower

The datastore kind has two empty entries in the email_lower field.

Even the google.appengine.api.users module starts misbehaving. On first attempt to login, I can login to the AppEngine normally but I cannot logout of the appengine as a google account user, I see that I have logged out of my Google account(that's great but). When I try logging in, I see that no authentication was required to login (Google Sign In).

When I login from another browser instance, It shows

DatabaseError: save with update_fields did not affect any rows.

Can someone please explain why this is happening and what I must do to avoid this.

score 0 · Answer 1 · answered Jan 19 '18 at 11:00

The issue was with the IAP login cookie, I did some research and found out that google provides us a url to clear that cookie. You just have to hit the URL once you logout from your google account:

The URL: your_appenine_url/_gcp_iap/clear_login_cookie

To sum it all up,

#Get current user
user = users.get_current_user()
# If user has logged in, send him to google logout URL
# redirect to clear IAP login cookie after google account logout
if user:
    logout_url = users.create_logout_url('/_gcp_iap/clear_login_cookie')
    request.session.clear()
    return redirect(logout_url)

Djangae AppEngine misbehaves with IAP

1 Answers1