Context:
I have two projects that are secured with IAP, and they need to communicate through rest API. I am using AppEngine standard in both side, with python27 as a runtime.
Problem:
Even though I authorized the service account in the destination project and used that same service account to programmatically authenticate to IAP using the given code in the documentation (make_iap_request). I am still getting a 401 Unauthorized response status code.
Link for make_iap_request: https://github.com/GoogleCloudPlatform/python-docs-samples/blob/master/iap/make_iap_request.py
PS: I tried giving the service account an Owner Role on the project and also a Service Account Token Creator role but in vain.
Here's the full error code, thanks in advance for your help:
Traceback (most recent call last):
File "/google-cloud-sdk/platform/google_appengine/lib/webapp2-2.5.2/webapp2.py", line 1535, in __call__
rv = self.handle_exception(request, response, e)
File "/google-cloud-sdk/platform/google_appengine/lib/webapp2-2.5.2/webapp2.py", line 1529, in __call__
rv = self.router.dispatch(request, response)
File "/google-cloud-sdk/platform/google_appengine/lib/webapp2-2.5.2/webapp2.py", line 1278, in default_dispatcher
return route.handler_adapter(request, response)
File "/google-cloud-sdk/platform/google_appengine/lib/webapp2-2.5.2/webapp2.py", line 1102, in __call__
return handler.dispatch()
File "/google-cloud-sdk/platform/google_appengine/lib/webapp2-2.5.2/webapp2.py", line 572, in dispatch
return self.handle_exception(e, self.app.debug)
File "/google-cloud-sdk/platform/google_appengine/lib/webapp2-2.5.2/webapp2.py", line 570, in dispatch
return method(*args, **kwargs)
File "/handlers.py", line 25, in get
req = make_iap_request(API_URL, CLIENT_ID)
File "/make_iap_request.py", line 79, in make_iap_request
resp.status_code, resp.headers, resp.text
Exception: Bad response from application: 401L / {'expires': 'Fri, 25 Jan 2019 16:35:30 GMT', 'x-xss-protection': '1; mode=block', 'x-content-type-options': 'nosniff', 'alt-svc': 'quic=":443"; ma=2592000; v="44,43,39"', 'date': 'Fri, 25 Jan 2019 16:35:30 GMT', 'server': 'GSE', 'content-length': '52', 'cache-control': 'private, max-age=0', 'x-goog-iap-generated-response': 'true', 'x-frame-options': 'SAMEORIGIN', 'content-type': 'text/html; charset=UTF-8'} / u'There was a problem with your request. Error code 13'
TLDR;
When using a project to project authentication, the client id is the target project's one not the project that is trying to authenticate
Well, after one week of turning in a circle, I have found the problem !!!!
It was so confusing for me: A client is that thing that connects to the target, but while both the terms were present in that IAP authentication, so I tried to test them both (the client ids), and it worked ! Happy coding :-)