Cloud Run - Authenticated request doesn't work on custom (sub)domain

Question

I have a Cloud Run service running with authenticated requests turned on. I've created a domain mapping using Load Balancing to point a subdomain to the container.

I have been sending requests to the direct container url without any problems.

import os
from google.oauth2 import service_account
import google.auth.transport.requests
import google.oauth2.id_token
import requests

os.environ['GOOGLE_APPLICATION_CREDENTIALS'] = 'service-account.json'
audience = "https://app-id.a.run.app"

request = google.auth.transport.requests.Request()
id_token = google.oauth2.id_token.fetch_id_token(request, audience)

requests.post(
    audience + "/job",
    headers={'Authorization': f"Bearer {id_token}"},
)

My service account has the Cloud Run Invoker permission and requests get authenticated fine.

The domain mapping is configured to the right Cloud Run service & region.

Why is it that when I change audience to my subdomain and send the request, I'm not authenticated?

Edit: The subdomain is correctly pointing at the container and requests are being logged.

guillaume blaquiere · Accepted Answer · 2024-07-21 13:20:26Z

1

By default, Cloud Run accepts only the default Cloud Run URL (*.run.app) as audience.

When you use a custom domain, or a Load Balancer, it does not make sense for the client to add a strange audience instead of the real domain name.

That's why, the Cloud Run custom audience feature has been released!

answered Jul 21, 2024 at 13:20

guillaume blaquiere

76.7k3 gold badges65 silver badges102 bronze badges

Sign up to request clarification or add additional context in comments.

1 Comment

Victor Over a year ago

Thank you! I've updated my services :-)

Collectives™ on Stack Overflow

Cloud Run - Authenticated request doesn't work on custom (sub)domain

1 Answer 1

1 Comment

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

1 Comment

Related