-1

I have a simple Flask application on a Google App Engine, protected by Identity-Aware Proxy. The authentication works well but I only recover the GCP_IAP_UID cookie, when I want to recover the JWT found in GCP_IAAP_AUTH_TOKEN_XXXXX. I have tried

  • google.auht jwt
  • Flask request cookies
  • Requests

None of this module retrieve the token. The browser shows the cookies I need (show image linked below), but Flask can't catch them. Any idea is welcome

  • I try with the google.auth jwt, but it's empty
  • I try with Flask request.cookies but I get only on cookie, the UID (see code)
  • I try with requests.cookies.RequestsCookieJar (last try) but there is no cookie

My apps run with python 37 and here are the requirements:

Flask==1.1.2
Flask-SSLify==0.1.5
Werkzeug==1.0.1
google-api-python-client==1.6.0
google-cloud-storage==1.6.0
gunicorn==19.10.0
oauth2client==4.1.3
six==1.14.0
requests_toolbelt==0.9.1
google-auth-httplib2==0.0.3
ez-setup==0.9

Below the code of the init.py where I want to validate the jwt.

import logging

from flask import Flask, redirect, url_for, request
from google.auth import jwt
import requests

user_email = ""
nickname = ""
jwtr = ""
try:
    import googleclouddebugger
    googleclouddebugger.enable()
except ImportError:
    pass


def create_app(config, debug=False, testing=True, config_overrides=None):
    app = Flask(__name__)
    app.config.from_object(config)
app.debug = debug
app.testing = testing

if config_overrides:
    app.config.update(config_overrides)

# Configure logging
# if not app.testing:
logging.basicConfig(level=logging.INFO)

# Register the Bookshelf CRUD blueprint.
from .crud import crud
app.register_blueprint(crud, url_prefix='/app')

# Add a default root route.
@app.route("/")
def index():
    jwtr = ""
    # Goto see the log below
    logging.info("1 nb cookies={}".format(len(request.cookies)))
    logging.info("GCP_IAP_UID={}".format(request.cookies.get('GCP_IAP_UID')))
    jar = requests.cookies.RequestsCookieJar()
    logging.info("2 nb cookies={}".format(len(jar)))
    for cle in jar.keys():
        if cle.startswith('GCP_IAAP_AUTH_TOKEN_'):
            jwtr = jar.get(cle)
            logging.info("jwtr={}".format(jwtr))

    try:
        user_id, user_email, error_str = validate_iap_jwt_from_app_engine(jwtr,
                '123456789012', 'xxxxx-yyyy')
        if user_email is not None:
            nickname = user_email.split('@')[0]
            logging.info("nickmane="+nickname + " user_id="+user_id + " user_email=" +
                    user_email)
            return redirect(url_for('crud.index'))
        else:
            return ""
    except (ValueError, requests.exceptions.RequestException) as e:
        logging.error("C'est moche !!{}!!".format(e))
        return ""

Last but least a log file:

INFO:root:1 nb cookies=1
INFO:root:GCP_IAP_UID=10944565464656564
INFO:root:2 nb cookies=0
ERROR:root:**ERROR: JWT validation error Wrong number of segments in token: b''**

Cookies at browser level

spopoff
  • 1
  • 3

1 Answers1

0

in fact the jwt token can be found in the header like this:

AUTHORIZATION_HEADER = 'X-Goog-Iap-Jwt-Assertion'
if request.headers.get(AUTHORIZATION_HEADER):
    jwtr = request.headers.get(AUTHORIZATION_HEADER)
    logging.info("header authz={}".format(jwtr))

You can found all you need in https://cloud.google.com/iap/docs/signed-headers-howto

spopoff
  • 1
  • 3