What is Google Cloud Functions?
Cloud Functions is the go-to tool for FaaS (functions as a service) on Google Cloud. It has a very intuitive interface for creating functions in few minutes!
Cloud Functions supports IAM authentication but can I authenticate the service using an OAuth2 provider?
How does it work?
In the first step we retrieve the token from an OAuth2 provider (I used Keycloak but you could use another one), then we call the function through the Google API Gateway. The API Gateway supports OpenAPI2 configuration, where we need to setup the authentication. In the final step the API Gateway calls, using a service account, the Cloud Function.
Create the Cloud Function
Here we can see how to create a cloud function using gcloud command line, but the same can be achieved using the Google Cloud web interface.
git clone https://github.com/GoogleCloudPlatform/nodejs-docs-samples.git
cd nodejs-docs-samples/functions/helloworld/
# CREATE FUNCTION
gcloud functions deploy helloGET --runtime nodejs16 --trigger-http
The last command asks if we want to allow unauthenticated invocations for the new function, which we don’t, so we say no.
This creates a cloud function with IAM authentication and with an http trigger.
We need to create a GCP Service Account with the Cloud Function Invoker role, we use it later.
# CREATE SERVICE ACCOUNT
gcloud iam service-accounts create function-invoker --display-name="function-invoker"
# BINDING ROLES
gcloud projects add-iam-policy-binding my-project --member="serviceAccount:function-invoker@my-project.iam.gserviceaccount.com" --role="roles/cloudfunctions.invoker"
API Gateway setup
Enable APIs
To use API Gateway we need to enable services.
gcloud services enable apigateway.googleapis.com
gcloud services enable servicemanagement.googleapis.com
gcloud services enable servicecontrol.googleapis.com
Create the API Config
API Gateway supports the OpenAPI spec. Here we need to define the right security configuration! In order to fill the correct information in this file we need to have the cloud function http trigger (x-google-backend) and the right security information (openapi-extensions).
An example below:
# openapi2-functions.yaml
swagger: '2.0'
info:
title: hello
description: Sample API on API Gateway with a Google Cloud Functions backend
version: 1.0.0
schemes:
- https
produces:
- application/json
paths:
/hello:
get:
summary: Greet a user
operationId: hello
x-google-backend:
address: -> cloud function address!
security:
- keycloak: []
responses:
'200':
description: A successful response
schema:
type: string
securityDefinitions:
# keycloak auth
keycloak:
type: oauth2
flow: implicit
authorizationUrl: https://KEYCLOA_INSTANCE/auth/realms/test/protocol/openid-connect/auth
x-google-issuer: https://KEYCLOA_INSTANCE/auth/realms/test
x-google-jwks_uri: https://KEYCLOA_INSTANCE/auth/realms/test/protocol/openid-connect/certs
x-google-audiences: test-auth-function-gcp
Create your Gateway
Now we can create our API and Gateway.
# CREATE API
gcloud api-gateway apis create my-api --project=my-project
# CREATE CONFIG
gcloud api-gateway api-configs create my-config \
--api=my-api --openapi-spec=openapi2-functions.yaml \
--project=my-project --backend-auth-service-account=0000000000000-compute@developer.gserviceaccount.com
# CREATE GW
gcloud api-gateway gateways create my-gateway \
--api=my-api --api-config=my-config \
--location=us-central1 --project=my-project
Test!
Retrieve the gateway address
gcloud api-gateway gateways describe my-gateway \
--location=us-central1 --project=my-project
We get the address from the response of the above command. Check for the defaultHostname field.
Get the JWT Token
I used Keycloak for this demo, so we need to insert our token url and a valid client and user credentials.
curl --request POST \
--url https://KEYCLOAK/auth/realms/test/protocol/openid-connect/token \
--header 'Content-Type: application/x-www-form-urlencoded' \
--data client_id=myclient \
--data username=myuser \
--data password=mypassword \
--data grant_type=password \
You will get a response like this:
{
"access_token": "XXXXXX",
"expires_in": 36000,
"refresh_expires_in": 1800,
"refresh_token": "XXXXXX",
"token_type": "Bearer",
"not-before-policy": 0,
"scope": "email profile"
}
We save the access token, it is needed for the next call.
Call the API
curl --request GET \
--url https://hello-gw-xxxxxxx.gateway.dev/hello \
--header 'Authorization: Bearer XXXXXX'
We get the "Hello World!" response :)
If we try to make the same call without the authentication bearer token we receive this message:
{
"message": "Jwt is missing",
"code": 401
}
Deep Dive
If you want to learn more check out these links:
Top comments (0)