GCP API Gateway is confused about JWT by adding an external load-balancer in front

jldupont 0
Viewed 39

I had a running setup where a backend Cloud Run service was fronted by API Gateway. The security definition was straightforward:

 flow: "implicit"
 type: "oauth2"
 x-google-jwks_uri: "https://www.googleapis.com/oauth2/v3/certs"
 x-google-issuer: "https://accounts.google.com"
 x-google-audiences: "my-audience"

Now that I have added an external load-balancer (with a custom domain) by following the Google documentation (here), I get the following error log from API Gateway:

response_code_detail: "jwt_authn_access_denied{Audiences_in_Jwt_are_not_allowed}"
service_agent: "ESPv2/2.35.0"

Any help would be greatly appreciated.

google-cloud-load-balancer google-cloud-api-gateway google-cloud-platform
1 Answers

It turns out that the x-google-backend.address property must not be changed to the address based on the custom domain. It needs to be kept with the actual service URL of the Cloud Run backend.

jldupont0
Related