接下来，IAP 会检查用户的浏览器凭据。如果凭据不存在，则用户会被重定向到 OAuth 2.0 Google 账号登录流程，以便将令牌存储在浏览器 Cookie 中，供日后登录使用。如果您需要为现有用户创建 Google 账号，则可以使用 Google Cloud Directory Sync 与 Active Directory 或 LDAP 服务器同步。
如果请求凭据有效，则身份验证服务器会使用这些凭据来获取用户的身份（电子邮件地址和用户 ID）。然后，身份验证服务器会使用该身份检查用户的 IAM 角色，并检查用户是否有权访问资源。
直接在 Cloud Run 服务中。这样，IAP 便可保护 Cloud Run 的所有入站路径，包括自动分配的网址和任何配置的负载平衡器网址。如果您只有一个要为其启用 IAP 的 Cloud Run 服务，此配置非常有用。
通过具有 Cloud Run 后端的负载平衡器。如果您在单个全局负载平衡器后面有多个位于不同区域的 Cloud Run 服务，此配置非常有用。在这种配置中，自动分配的网址不受 IAP 保护，并且可能可以直接访问。详细了解您的职责以确保安全。
如果 Cloud Run 服务位于负载平衡器后面，请勿同时在负载平衡器和 Cloud Run 服务上启用 IAP。
授权
身份验证完成后，IAP 会应用相关的 IAM 政策来检查用户是否有权访问所请求的资源。如果用户对资源所属的Google Cloud 控制台项目拥有 IAP-secured Web App User 角色，即有权访问相应应用。如需管理 IAP-secured Web App User 角色列表，请使用 Google Cloud 控制台上的 IAP 面板。
为资源启用 IAP 后，IAP 会自动创建 OAuth 2.0 客户端 ID 和密钥。如果您删除自动生成的 OAuth 2.0 凭据，IAP 将无法正常运行。您可以在 Google Cloud 控制台 API 和服务中查看和管理 OAuth 2.0 凭据。
[[["易于理解","easyToUnderstand","thumb-up"],["解决了我的问题","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["很难理解","hardToUnderstand","thumb-down"],["信息或示例代码不正确","incorrectInformationOrSampleCode","thumb-down"],["没有我需要的信息/示例","missingTheInformationSamplesINeed","thumb-down"],["翻译问题","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["最后更新时间 (UTC)：2025-09-04。"],[[["\u003cp\u003eIdentity-Aware Proxy (IAP) is a Google Cloud service that establishes a centralized authorization layer for HTTPS applications, enabling application-level access control instead of relying on network firewalls.\u003c/p\u003e\n"],["\u003cp\u003eIAP enforces access control policies for applications and resources by authenticating users and verifying their Identity and Access Management (IAM) roles before allowing access, utilizing signed headers or the App Engine Users API for securing applications.\u003c/p\u003e\n"],["\u003cp\u003eWhen enabled, IAP performs authentication and authorization checks on user requests, first by checking user credentials and then the user's IAM role, automatically creating OAuth 2.0 client credentials for this purpose.\u003c/p\u003e\n"],["\u003cp\u003eIAP allows for context-aware access, extending secure access to Google Cloud console, APIs, virtual machines, and web applications, providing enhanced control over resource access.\u003c/p\u003e\n"],["\u003cp\u003eWhile IAP manages external access, users must configure firewalls, load balancers, or Cloud Run ingress controls to prevent internal traffic within the project from bypassing IAP authentication, and to use signed headers or the App Engine Users API.\u003c/p\u003e\n"]]],[],null,["# Identity-Aware Proxy overview\n\nThis page describes the basic concepts of Identity-Aware Proxy\n(IAP), a Google Cloud global service.\n\nIAP lets you establish a central authorization\nlayer for applications accessed by HTTPS, so you can use an application-level\naccess control model instead of relying on network-level firewalls.\n\nIAP policies scale across your organization. You can define\naccess policies centrally and apply them to all of your applications and\nresources. When you assign a dedicated team to create and enforce policies, you\nprotect your project from incorrect policy definition or implementation in any\napplication.\n\nWhen to use IAP\n---------------\n\nUse IAP when you want to enforce access control policies\nfor applications and resources. IAP works with\n[signed headers](/iap/docs/signed-headers-howto) or the App Engine\nstandard environment [Users API](/appengine/docs/standard/services/users)\nto secure your app. With IAP, you can set up group-based\napplication access: a resource could be accessible for employees and\ninaccessible for contractors, or only accessible to a specific department.\n\nHow IAP works\n-------------\n\nWhen an application or resource is protected by IAP, it can\nonly be accessed through the proxy by\n[principals](/iam/docs/overview#concepts_related_identity), also known as users,\nwho have the correct\n[Identity and Access Management (IAM) role](/iam/docs/understanding-roles).\nWhen you grant a user access to an application or resource by\nIAP, they're subject to the fine-grained access controls\nimplemented by the product in use without requiring a VPN. When a user tries\nto access an IAP-secured resource, IAP\nperforms authentication and authorization checks.\nApp Engine Cloud Run Compute Engine GKE On-premises\n\n### Authentication\n\nRequests to your Google Cloud resources come through Cloud Run,\nApp Engine, and Cloud Load Balancing (External and Internal HTTP(S)\nLoad Balancing). The serving infrastructure code for these products checks if\nIAP is enabled for the app or backend service. If\nIAP is enabled, information about the protected resource is\nsent to the IAP authentication server. This includes\ninformation like the Google Cloud project number, the request URL, and any\nIAP credentials in the request headers or cookies.\n\nNext, IAP checks the user's browser credentials. If none\nexist, the user is redirected to an OAuth 2.0 Google Account sign-in flow that\nstores a token in a browser cookie for future sign-ins. If you need to create\nGoogle Accounts for your existing users, you can use\n[Google Cloud Directory Sync](https://support.google.com/a/answer/106368)\nto synchronize with your Active Directory or LDAP server.\n\nIf the request credentials are valid, the authentication server uses those\ncredentials to get the user's identity (email address and user ID). The\nauthentication server then uses the identity to check the user's\nIAM role and check if the user is authorized to access the\nresource.\n\nIf you're using Compute Engine or Google Kubernetes Engine,\nusers who can access the application-serving port of the Virtual Machine (VM)\ncan bypass IAP authentication. Compute Engine and GKE\nfirewall rules can't protect against access from code running on the same VM as\nthe IAP-secured application. Firewall rules can protect\nagainst access from another VM, but only if properly configured. Learn\nabout [your responsibilities](#your_responsibilities) to ensure security.\n\nIf you're using Cloud Run, you can [enable\nIAP](/run/docs/securing/identity-aware-proxy-cloud-run) in the\nfollowing ways:\n\n- Directly on your Cloud Run services. This enables IAP to protect all ingress paths to Cloud Run, including the [auto-assigned URL](/run/docs/triggering/https-request) and any configured load balancer URL. This configuration is useful when you have a single Cloud Run service to enable IAP for.\n- Through a load balancer with a Cloud Run backend. This configuration is useful when you have multiple Cloud Run services in different regions behind a single global load balancer. In this configuration, the auto-assigned URL is unprotected by IAP and might be directly accessible. Learn more about [your\n responsibilities](#your_responsibilities) to ensure security.\n\nIf a Cloud Run service is behind a load balancer, don't enable\nIAP on both the load balancer and the Cloud Run\nservice.\n\n### Authorization\n\nAfter authentication, IAP applies the relevant\nIAM policy to check if the user is authorized to access the\nrequested resource. If the user has the **IAP-secured Web App User** role on the\nGoogle Cloud console project where the resource exists, they're authorized to\naccess the application. To manage the **IAP-secured Web App User** role list,\nuse the\n[IAP panel on the Google Cloud console](https://console.cloud.google.com/security/iap/).\n\nWhen you turn on IAP for a resource, it automatically\ncreates an OAuth 2.0 client ID and secret. If you delete the automatically\ngenerated OAuth 2.0 credentials, IAP won't function\ncorrectly. You can view and manage OAuth 2.0 credentials in the\n[Google Cloud console APIs \\& services](https://console.cloud.google.com/apis/dashboard).\n\n#### Context-aware access\n\nAs part of the [authorization](#iap-auth) step, you can use context-aware access to provide\nsecure access to the following types of resources:\n\n##### Google Cloud console and APIs\n\n- First layer of defense in protecting infrastructure access to Google Cloud.\n- Advanced context-aware Google Cloud access to users.\n\n##### Virtual Machines (VMs)\n\n- Enables administrative SSH/RDP access to VMs in Google Cloud and in other clouds.\n- Lets you implement robust context-aware controls to restrict access to only designated administrators.\n\n##### Web applications\n\n- Provides authorization and authentication for web applications hosted in Google Cloud and other clouds.\n- Provides continuous authorization to prevent unauthorized access and data loss.\n\nYour responsibilities\n---------------------\n\nIAP secures authentication and authorization of all requests\nto Cloud Run, App Engine, Cloud Load Balancing (HTTPS),\nand internal HTTP load balancing.\n\nTo ensure security, you must take the following precautions:\n\n- If you're enabling IAP on a load balancer, verify whether the backend resources can be accessed directly.\n - If the backend resource is a VM, configure your firewall rules to protect against traffic that doesn't come through the load balancer. IAP doesn't protect against activity within a project, such as another VM inside the project.\n - If the backend resource is a Cloud Run service, you can disable the run.app URL to ensure that all ingress comes in through the load balancer. If you choose to leave the run.app URL enabled, you should use [ingress controls](/run/docs/securing/ingress) to block traffic from outside your network.\n- Update your app to use [signed headers](/iap/docs/signed-headers-howto) or use the App Engine standard environment [Users API](/appengine/docs/standard/services/users).\n\nWhat's next\n-----------\n\n- Get started with IAP by completing one of the following tasks:\n - Enable IAP [directly on your\n Cloud Run](/run/docs/securing/identity-aware-proxy-cloud-run) services or on a [load balancer with a\n Cloud Run backend](/iap/docs/enabling-cloud-run).\n - Complete the App Engine quickstart to [Manage Access with Google\n Accounts](/iap/docs/app-engine-quickstart).\n - Enable [IAP for Compute Engine](/iap/docs/enabling-compute-howto).\n - Enable [IAP for GKE](/iap/docs/enabling-kubernetes-howto).\n - Enable [IAP for on-premises apps](/iap/docs/enabling-on-prem-howto).\n- Learn more:\n - [Authenticating to Compute Engine](/compute/docs/authentication)\n - [App Engine user authentication options](/appengine/docs/python/oauth)\n - [Using OAuth 2.0 to access Google APIs](https://developers.google.com/identity/protocols/OAuth2)\n - [Google Cloud auth guide](/docs/authentication)\n - [Setting up a load balancer](/iap/docs/load-balancer-howto)\n - [Setting up a load balancer with Cloud Run (fully managed)](/load-balancing/docs/https/setting-up-https-serverless)\n - [Restricting ingress for Cloud Run](/run/docs/securing/ingress)"]]
