iapgo

README

iapgo

iapgo is a Go library to help authenticating access to endpoints behind Google Cloud Identity-Aware Proxy.

This library is heavily using golang.org/x/oauth2/google to handle credentials parsing and authentication.

Usage

import (
    "log"
    "net/http"

    "github.com/bukalapak/iapgo"
)

func main() {
    // Initialize Transport to be used. Define iapClientID with the OAuth Client
    // ID of the IAP that protects the endpoint.
    iapClientID := "12345678901-abcdefghijklmnopqrstuvwxyz123456.apps.googleusercontent.com"

    // Upon Transport creation, the service account key will be searched using
    // Application Default Credentials (ADC) strategy described in
    // https://cloud.google.com/docs/authentication/production.
    transport, err := iapgo.NewTransport(iapClientID)
    if err != nil {
        log.Fatal(err)
    }

    // Pair Transport with an http.Client.
    client := &http.Client{
        Transport: transport,
    }

    // Access endpoints behind IAP.
    client.Get("...")
}

Documentation

Overview

Package iapgo helps authenticating access to endpoints behind Google Cloud Identity-Aware Proxy (IAP). It provides a Transport which implements http.RoundTripper.

Example

package main

import (
	"log"
	"net/http"

	"github.com/bukalapak/iapgo"
)

func main() {
	// Initialize Transport to be used. Define iapClientID with the OAuth Client
	// ID of the IAP that protects the endpoint.
	iapClientID := "12345678901-abcdefghijklmnopqrstuvwxyz123456.apps.googleusercontent.com"

	// Upon Transport creation, the service account key will be searched using
	// Application Default Credentials (ADC) strategy described in
	// https://cloud.google.com/docs/authentication/production.
	transport, err := iapgo.NewTransport(iapClientID)
	if err != nil {
		log.Fatal(err)
	}

	// Pair Transport with an http.Client.
	client := &http.Client{
		Transport: transport,
	}

	// Access endpoints behind IAP.
	client.Get("...")
}

Index

• type Transport
  • func NewTransport(iapClientID string) (*Transport, error)
  • func (t *Transport) RoundTrip(r *http.Request) (*http.Response, error)

Examples

• Package

Types

type Transport

type Transport struct {
	// contains filtered or unexported fields
}

Transport implements http.RoundTripper that can be used to access endpoints behind Google Cloud Identity-Aware Proxy.

func NewTransport

func NewTransport(iapClientID string) (*Transport, error)

NewTransport returns an initialized Transport. It requires OAuth Client ID of the IAP resource target of the Transport. It finds the service account key using Application Default Credentials (ADC) strategy described in https://cloud.google.com/docs/authentication/production.

func (*Transport) RoundTrip

func (t *Transport) RoundTrip(r *http.Request) (*http.Response, error)

RoundTrip authenticates an HTTP request using an ID token. This ID token is retrieved using two-legged authentication with a Google endpoint defined in the service account key.