Configuration for GCP

When deploying the Cloud API on GCP, ensure that JWT authentication is properly configured by setting the following parameters:

Cloud Function Parameters (Can be set in terraform template or by GCP UI):

1. Set authorization to jwt:

   • This specifies that JWT authentication will be used to secure the API.

2. Set jwt_verify to 1:

   • Enables verification of the JWT token during API requests.

3. Set jwt_secret_base64 to the Public Key (PEM Base64 Encoded):

   • Use the jwt_signing_key public key obtained from Retrieve JWT Public Signing Key .

4. Set jwt_user_claim to upn or email:

   • Choose the claim used to identify the user. Typically, User Principal Name (upn) or email is selected based on your organization’s Entra ID configuration.

Configure GCP cloud protect function Authentication security setting:

By default, GCP cloud function might enforce IAM authentication for API methods. Since authentication is already handled within the Cloud API protect function, we can change the authentication setting to “allow for public access” as below:

1. Navigate to the GCP cloud protect function
2. On the service details screen, select the security tab
3. In the Authentication section - ensure “allow public access” is selected.

Obtain the Gateway URL:

After deploying the Cloud API using terraform, retrieve the API endpoint URL for the service:

From Google Cloud Management console,

1. Navigate to API Gateway.
2. Select the deployed API Gateway instance.
3. Under the “Gateway Details” section, copy the “Gateway URL” or “Managed Service URL”.
4. Record the displayed URL for use in the Browser Protector configuration.
   • protector_endpoint_url: <>

example: https://{gateway-id}-{hash}.{region}.gateway.dev/api