Aembit now offers a Google Cloud Identity-Aware Proxy (IAP) JWT Trust Provider.
It validates the signed x-goog-iap-jwt-assertion token that IAP forwards to your workloads on Google Kubernetes
Engine (GKE), Cloud Run, and App Engine after IAP authenticates a user.
Use this Trust Provider instead of the OIDC ID Token Trust Provider when IAP authenticates users in front of your
workloads.
IAP issues signed JWTs, but they aren’t standard OpenID Connect (OIDC) ID tokens.
Google publishes the IAP signing keys at a static JWKS endpoint with no discovery document, and the audience
identifies a Google Cloud resource rather than an OIDC client ID.
Aembit resolves Google’s signing key at validation time rather than from a preconfigured key set.
It reads the key ID from the token, then retrieves the matching public key from Google’s IAP key endpoint.
Aembit caches that key in memory, so your workload only forwards the token.
What’s new:
- GCP IAP JWT Trust Provider type: Supply the IAP audience that identifies the Google Cloud resource IAP protects.
Aembit pins the issuer and resolves the signing keys, so you don’t upload a key or enter a discovery URL.
- Match rules on IAP token claims: Authorize on
aud, iss, sub, and email, or on any additional claim IAP
signs using custom_claim.
The aud attribute supports wildcards, so one rule can cover more than one backend service in the same project.
- Terraform support: Manage the Trust Provider through the Aembit Terraform provider with the
aembit_trust_provider resource.
This Trust Provider validates the user identity that IAP asserts.
To validate the identity of a workload running in Google Cloud, use the GCP Identity Token Trust
Provider instead.
For the audience formats, match rule attributes, and configuration steps, see Google Cloud Identity-Aware Proxy (IAP)
JWT Trust Provider.