[[["容易理解","easyToUnderstand","thumb-up"],["確實解決了我的問題","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["難以理解","hardToUnderstand","thumb-down"],["資訊或程式碼範例有誤","incorrectInformationOrSampleCode","thumb-down"],["缺少我需要的資訊/範例","missingTheInformationSamplesINeed","thumb-down"],["翻譯問題","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["上次更新時間：2025-09-04 (世界標準時間)。"],[[["\u003cp\u003eIdentity-Aware Proxy (IAP) allows applications to verify that requests are coming through IAP, requiring validation to ensure proper security.\u003c/p\u003e\n"],["\u003cp\u003eApplications can validate requests via the \u003ccode\u003ex-goog-iap-jwt-assertion\u003c/code\u003e HTTP header, which is the recommended security mechanism for retrieving the user's identity.\u003c/p\u003e\n"],["\u003cp\u003eIAP provides user identity information in the \u003ccode\u003eX-Goog-Authenticated-User-Email\u003c/code\u003e and \u003ccode\u003eX-Goog-Authenticated-User-Id\u003c/code\u003e HTTP headers, but these should only be used for compatibility and must be checked against the JWT header.\u003c/p\u003e\n"],["\u003cp\u003eApp Engine standard environment apps can use the Users API to get the IAP-verified user identity, and enabling IAP changes the user ID values obtained through this API.\u003c/p\u003e\n"],["\u003cp\u003eWhen IAP is enabled, a consent screen will appear for users to confirm sharing their identity, which can be suppressed within a Google Workspace domain by configuring API client access in the Google Admin console.\u003c/p\u003e\n"]]],[],null,["# Getting the user's identity\n\nThis page describes how to get a user's identity with Identity-Aware Proxy\n(IAP). Getting the user's identity enables your application\nto verify that a request came through IAP. To properly\nsecure your app, you must always use one of the mechanisms below to get the\nIAP-authenticated user identity.\n\nGetting the user's identity with signed headers\n-----------------------------------------------\n\nTo make sure a request to your Compute Engine, GKE,\nCloud Run, App Engine standard environment,\nor App Engine flexible environment app was authorized by\nIAP, your app must validate every request by checking the\n`x-goog-iap-jwt-assertion` HTTP request header.\nLearn about [securing your app with signed headers](/iap/docs/signed-headers-howto).\n\nIAP also passes the user's identity to your backend service\nin the following HTTP headers. These headers should have the namespace prefix\n`accounts.google.com`. These headers are available for compatibility,\nbut you shouldn't rely on them as a security mechanism. If you use these\nheaders, you must compare them against the identity information from the\nauthenticated JWT header listed above.\n\nGetting the user's identity with the App Engine standard environment Users API\n------------------------------------------------------------------------------\n\nAlternatively, if you have an App Engine standard environment app, the\n[Users API](/appengine/docs/standard/python/users) can be used to get the\nuser's identity in your app code.\n\nIf your application already uses this API, you don't need to change anything.\nIAP provides the user's identity, but the value for each\nuser's Users API user ID will change when IAP is turned on.\n\nTo get the IAP-verified user identity for a request, call\nthe Users API to return the current\nuser. If the function returns a user, such as `req.getUserPrincipal() != null`\nin Java, the user was authenticated by IAP.\n\nConsent screen\n--------------\n\nWhen IAP is enabled, the first time a user accesses your\napp, they're redirected to a consent screen to confirm that they want to share\ntheir identity with your app. This occurs even if the user granted consent to\nthis app before you enabled IAP, and will occur again if\nyou disable IAP and then re-enable it.\n\nIf you're using the Users API, it normally suppresses the consent screen for\napps and users that are within the same Google Workspace domain. When you enable\nIAP, the consent screen isn't automatically suppressed. To\nsuppress the consent screen with IAP enabled, follow the\nsteps below:\n\n1. Go to your [Google Admin console](http://admin.google.com/). \n [Go to the Admin console](http://admin.google.com/)\n2. On the list of controls, select **Security** .\n 1. If you don't see **Security** listed, select **More controls** from the gray bar at the bottom of the page, then select **Security** from the list of controls.\n 2. If you can't see the controls, make sure you're signed in as an administrator for the domain.\n3. On the list of options, select **Show more** and then **Advanced settings**.\n4. In the **Authentication** section, select **Manage API client access**.\n5. In the **Client Name** field, enter the IAP OAuth 2.0 client ID. You can find the IAP client ID on the [Credentials page](https://console.cloud.google.com/apis/credentials). \n [Go to the IAP credentials page](https://console.cloud.google.com/apis/credentials)\n6. In the **One or More API Scopes** field, enter `email, openid`.\n7. Click **Authorize**.\n\nTo simplify this process, you can use an\n[API call](/iap/docs/reference/compute-engine-apis) to use a single IAP\nOAuth 2.0 client ID for all apps. You can't use the Google Cloud console to\nspecify the client ID to use with IAP.\n\nWhat's next\n-----------\n\n- Learn more about [Identity and Access Management](/iam/docs/overview)."]]
