Google Cloud Identity-Aware Proxy (IAP) JWT Trust Provider now available
Aembit now offers a Google Cloud Identity-Aware Proxy (IAP) JWT Trust Provider.
It validates the signed x-goog-iap-jwt-assertion token that IAP forwards to your workloads on Google Kubernetes
Engine (GKE), Cloud Run, and App Engine after IAP authenticates a user.
Use this Trust Provider instead of the OIDC ID Token Trust Provider when IAP authenticates users in front of your workloads. IAP issues signed JWTs, but they aren’t standard OpenID Connect (OIDC) ID tokens. Google publishes the IAP signing keys at a static JWKS endpoint with no discovery document, and the audience identifies a Google Cloud resource rather than an OIDC client ID.
Aembit resolves Google’s signing key at validation time rather than from a preconfigured key set. It reads the key ID from the token, then retrieves the matching public key from Google’s IAP key endpoint. Aembit caches that key in memory, so your workload only forwards the token.
What’s new:
- GCP IAP JWT Trust Provider type: Supply the IAP audience that identifies the Google Cloud resource IAP protects. Aembit pins the issuer and resolves the signing keys, so you don’t upload a key or enter a discovery URL.
- Match rules on IAP token claims: Authorize on
aud,iss,sub, andemail, or on any additional claim IAP signs usingcustom_claim. Theaudattribute supports wildcards, so one rule can cover more than one backend service in the same project. - Terraform support: Manage the Trust Provider through the Aembit Terraform provider with the
aembit_trust_providerresource.
This Trust Provider validates the user identity that IAP asserts. To validate the identity of a workload running in Google Cloud, use the GCP Identity Token Trust Provider instead.
For the audience formats, match rule attributes, and configuration steps, see Google Cloud Identity-Aware Proxy (IAP) JWT Trust Provider.