Package: requests-iap2
requests-iap2Auth class forrequestsused to authenticate HTTP requests to
Google CloudIdentity-Aware Proxyusingusercredentials.This is in contrast to most other IAP authentication libraries which useservice accountcredentials.Original inspiration came fromhttps://github.com/kiwicom/requests-iapInstallationTypical installation via pip:pipinstallrequests-iap2Alternatively you can install from source:gitclonehttps://github.com/climateengine/requests-iap2.gitcdrequests-iap2
pipinstall.SetupYou will need to have a Google Cloud project with IAP enabled and a user account withIAP Webapp Userrole.Additionally, you will need to create 2 OAuth 2.0 client IDs in the Google Cloud Console:
one for the IAP server (created as a Web application) and one for the client application (created as a Desktop application).
You will need the client ID and secret for the "desktop" client application.In most cases, IAP will have already creates a "Web application" client ID for you, and you do not need to create a new one.UsageExampleimportrequestsfromrequests_iap2importIAPAuth# This is the URL of the IAP-protected resourceurl="https://stac-staging.climateengine.net/"# Create a requests Session object and set the authentication handlersession=requests.Session()session.auth=IAPAuth(client_oauth_client_id="something_else.apps.googleusercontent.com",# "Desktop" clientclient_oauth_client_secret="client_secret_key",# "Desktop" client secretserver_oauth_client_id="something.apps.googleusercontent.com",# optional, "Web" client created by IAPuse_adc=False,# optional, set to True to use ADC instead of user credentialsoob=False,# optional, set to True if running in a headless environment or cannot run a webserver (e.g. on Vertex AI))# Use the session to make requestsr=session.get(url)# Alternatively, you can use the IAPAuth without a Session objectr=requests.get(url,auth=IAPAuth(server_oauth_client_id="something.apps.googleusercontent.com",# optionalclient_oauth_client_id="something_else.apps.googleusercontent.com",client_oauth_client_secret="client_secret_key"),)On Vertex AI or Cloud AI Platform NotebooksIf you are running on Vertex AI or Cloud AI Platform Notebooks, you will need to setoob=Truewhen creating theIAPAuthobject.Cross-Project ADC CredentialsADC credentials only work within the same project as the IAP resource.If you are running in Vertex AI, you can change the project that ADC uses, but the process can be a bit cumbersome.In the Vertex AI notebook (Python), run the following, replacingclient_oauth_client_idandclient_oauth_client_secretwith the values from the "Desktop" OAuth2 client.fromrequests_iap2.create_client_id_fileimportcreate_client_id_filecreate_client_id_file(client_id,client_secret)This will create a file calledclient_id.jsonin the current directory.Then in the Vertex AI notebook, create aTerminaland run the following (this wii not work in the Python notebook):gcloudauthapplication-defaultlogin--no-browser--client-id-file=client_id.jsonYou will be given a very long command to copy.You will need to run this command in a Terminal outside of the Vertex AI notebook.Copy and paste the command into a terminal runningon your local machine. You will be required to go through multiple
prompts to authenticate.You may receive an error message in a browser that says "Google hasn't verified this app".
To continue, click "Advanced" and then "Go to  (unsafe)".Check the boxes to allow the app to access your Google account and then click "Continue".After allowing access, your local terminal will display a code that you will need to copy and paste into the
terminal running in Vertex AI notebook.  Note: this code may look like a url starting withhttps://localhost:8085/...Your Vertex AI notebook should now be able to authenticate to an IAP resource in a different project.
You may need to restart the notebook kernel to pick up the new credentials.DevelopmentFuture workAdd testsAdd support for service account credentialsAdd support for ADC (Application Default Credentials)Code formattingblackPackage versioningVersioning of this package is done throughsetuptools-scm,
which auto-generates the version number based on git tags and commits. setuptools-scm generates a
unique version number for each commit in the repository according tothis scheme.The version of the package is read fromrequests_iap2/_version.py(which is generated by setuptools_scm during the package build) when running as a package, and derived
from git when running from source.Updating requirements.txt and test-requirements.txtSeescripts/gen_requirements.sh.ReleasingThis project usessemantic versioning.For a new minor version release (X.X.0), create avX.X.0tag in main branch,
and create avX.Xbranch from the same commit for future patches to the minor version.For patch versions, commit to and createvX.X.Ytags in the respective minor version branch.
(e.gv1.1.1,v1.1.2.. tags in thev1.1branch)For building the package and publishing it on PyPI, seescripts/build_package.shandscripts/publish_package.sh.