Use Azure AD to secure a single-page google app engine webapp

user_13749157 0
Viewed 261

I am currently developing a single-page webapp using an angular forntend and a python backend. Both are deployed as a service inside a google app engine. The angular frontend uses the URL of the backend service to access the APIs of the backend while the URL of the frontend is used to acces the application.

I already restricted access by using the firewall provided by google app engine. I now want to authenticate and authorise users. I want to give access to a predefined group of users using Azure AD. Only these users should be able to open the Frontend. They should not be able to acces the Backend by its URL but of course be able to acces the data provided by the backend via the Frontend. There are no user specific functionalities. Every user sees the same frontend and has access to the same data.

It is hard for me to approach this task as I never done these things. Has anybody done this? What steps in general should I take? Do I have to change the angular frontend or is it possible to just register my app in Azure AD and configure everything there? Any thoughts or sources would be appreciated.

Cheers,

Tom

azure-active-directory angular google-cloud-platform google-app-engine authentication
1 Answers

If the Angular app is really an SPA, meaning it runs in the browser, you don't need App Engine for it. You can just put it in cloud storage and publish it as a website through a load balancer.

You can federate AD identities onto GCP IAM (https://cloud.google.com/architecture/identity/federating-gcp-with-active-directory-introduction), but this might not be the approach you want. It sounds like these people just need access to the app rather than GCP. You should perhaps consider using a 3rd party IDM solution such as Auth.0 or Okta. You would then leverage this solution to federate identities and for providing auth flows to your users. The IDM would generate JWT tokens that you can then validate on the server you are running on App Engine (on every request).

Limiting access to the client files might be an additional issue, that can be solved with network configurations, but you should ask yourself if it is worth it. All your business logic should just go on the server which means your client files can accessible from the internet.

EDIT:

Here is a good article that relates to Cloud Run, which I think you should maybe be using over App Engine anyways. https://cloud.google.com/run/docs/authenticating/end-users

So you can stick to all Google services as well, if that is your jam.

user_23096060
Related