Forbidden with Application Default Credentials

[iamacarpet]

Forbidden with Application Default Credentials

[iamacarpet]

My mistake, looks like it does work on a newly created demo service in GCR....

Our existing had this set:

But this begs the question, how does it work if the audience is wrong?

Is Cloud Run not verifying the audience?

[iamacarpet]

So creating an id_token with IamCredentials.GenerateIdToken and setting the audience to "demo", it does fail with 401.

This means it must be verifying the audience value somehow, but then why is the ADC token allowed through?

Checking against https://www.googleapis.com/oauth2/v1/tokeninfo?id_token=... for sanity and I get:

{
  "issued_to": "764086051850-6qr4p6gpi6hn506pt8ejuq83di341hur.apps.googleusercontent.com",
  "audience": "764086051850-6qr4p6gpi6hn506pt8ejuq83di341hur.apps.googleusercontent.com",
  "user_id": "...",
  "expires_in": 1743,
  "email": "[email protected]",
  "email_verified": true,
  "issuer": "https://accounts.google.com",
  "issued_at": 1645198558
}

So, I'm confused.... Am I fundamentally misunderstanding something about how the tokens work, or is an audience of 764086051850-6qr4p6gpi6hn506pt8ejuq83di341hur.apps.googleusercontent.com whitelisted somehow, allowing you to use the the token returned from the ADC creds as basically unscoped (can access any Cloud Run service)?

[iamacarpet]

I can only assume the latter point about it being whitelisted somewhere is true, as using this method with IAP protected services fails with:

Invalid IAP credentials: JWT audience doesn't match this application ('aud' claim (764086051850-6qr4p6gpi6hn506pt8ejuq83di341hur.apps.googleusercontent.com) doesn't match expected value (....-....apps.googleusercontent.com))

[sethvargo]

Hey @iamacarpet - I responded to your query on the alpha testers list, so I'm going to go ahead and close this out.