We correctly configured a beforeSignIn cloud function thanks to https://medium.com/google-cloud/adding-custom-roles-to-jwt-on-login-with-google-identity-platform-476cd15301d9 (which is referenced in a lot of SO questions about this topic, hats off to the author)
However, we cannot find a way to restrict the cloud function invocation only to GCP Identity platform (so we used a allAuthenticatedUsers which is not exactly very restrictive)
We know this is something to do with IAM / service account, but we cannot find what is used by Identity platform
Any pointers ?
EDIT : to be more precise, we need to find which principal in this dialog
