To improve overall security, IAP by default denies access to requests that do not have a matching Server Name Indication (SNI). IAP also checks the SNI of the load balancer certificate. This allows IAP to restrict URL redirect to malicious domains. The IAP allowed domains feature provides an additional security layer for your IAP-protected resources. As a resource owner or IAP administrator, you can restrict access to IAP-protected resources to specific domains by configuring the allowed domains feature.
You can also configure IAP allowed domains in the following scenarios:
- Your browser or an intermediate proxy is forcing connection pooling: In this scenario, you receive HTTP response 429 and error code
51
. To resolve the issue, an IAP admin can update the list of allowed domains to include your host name. - The host name provided does not match the SSL certificate on the server: In this scenario, you receive error code
52
. To resolve the issue, an IAP admin can update the list of allowed domains to include your host name.
Configure allowed domains
You can use gcloud or the API to configure allowed domains settings. To configure allowed domains, use the following fields:
enable
: Boolean. Turns the allowed domains feature on or off.Domains
: String. The list of allowed domains. The domains can contain wildcard prefixes, such as*.example.com.
Domain names cannot contain a wildcard directly on a public suffix or on a top level domain. Example:*.com
,*.co.in
.
For more information, see IapSettings.
To configure IAP allowed domains, complete the following steps:
Console
- Go to the IAP page.
Go to Identity-Aware Proxy. - Select a project, and then select the resource on which you want to enable the allowed domains feature.
- Open Settings for the resource. Under Allowed domains, select Enable Allowed Domains.
- Specify the list of allowed domains, and then click Save.
gcloud
Following are some example commands for specifying allowed domains.
For more information, see gcloud iap settings set
.
Run the following command:
gcloud iap settings set SETTING_FILE --folder=FOLDER --organization=ORGANIZATION --project=PROJECT --resource-type=RESOURCE_TYPE --service=SERVICE --version=VERSION
Where SETTING_FILE
is:
accessSettings:
allowed_domains_settings:
enable: true
domains: ["*.example.com", "*.example.net"]
Replace the following:
- FOLDER: The folder ID.
- ORGANIZATION: The organization ID.
- PROJECT: The project ID.
- RESOURCE_TYPE: The IAP resource type. Must be
app-engine
,iap_web
,compute
,organization
, orfolder
. - SERVICE: The service name. This is optional when
resource-type
iscompute
orapp-engine
. - VERSION: The version name. This is not applicable for
compute
, and is optional whenresource-type
isapp-engine
.
API
To configure allowed domains, complete the following steps. For more information about using the API to configure allowed domains, see IapSettings.
- Run the following command to prepare an
iap_settings.json
file. Update the values as needed.
{ "access_settings":{ "allowed_domains_settings":{ "enable": true "domains": [ "*.example.com", "*.exampe.net" ] } } }
- Get the resource name by running the
gcloud iap settings get
command. Copy the name field from the output. You will need the name in the following step.
gcloud iap settings get --organization=ORGANIZATION --folder=FOLDER --project=PROJECT --resource-type=RESOURCE_TYPE --service=SERVICE --version=VERSION
- Replace
RESOURCE_NAME
in the following command with the name from the previous step. TheIapSettings
will be updated.
curl -X PATCH \ -H "Authorization: Bearer $(gcloud auth print-access-token)" \ -H "Accept: application/json" \ -H "Content-Type: application/json" \ -d @iap_settings.json \ "https://iap.googleapis.com/v1/RESOURCE_NAME:iapSettings?updateMask=iapSettings.accessSettings.allowedDomainsSettings.enable,iapSettings.accessSettings.allowedDomainsSettings.domains"
Troubleshooting
Allowed domains access issue
If you receive Error code 53, ask an IAP administrator to add your host name to the list of allowed domains.