Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google Identity-Aware Proxy

cloud.google.com

Post reply on HN
Print view View original

1–10 of 51 posts

Re: Google Identity-Aware Proxy

#2

Post by mcpherrinm »

I'm super happy to see this. Square uses something similar for employee access to our datacenter, and I hope more people follow this trend. It's one of the annoying parts of open-sourcing our infrastructure -- we can't generally assume folks have an authenticating proxy around. With a few examples in the wild, I'll be happy to start doing that.

We use mutually-authenticated TLS (ie, the proxy presents a client cert to your backend) so that you know the entire request is valid, including the username header. IAP only signs the header, which could be replayed because it's not bound to the session (eg, a debug page exposes request headers). But it's probably easier to grab a library that can validate JWT than worry about your TLS termination layer (eg, in a rails app behind nginx terminating TLS & serving asssets)

Re: Google Identity-Aware Proxy

#9

Post by kyrra »

As you can sort-of see from the linked site, this is a public version of what Google uses internally, which is called BeyondCorp[0].

It's really an amazing way to think about security for a company. If you deploy it universally across your company, VPNs become obsolete. This solves a popular attack vector where bad-actors just need to get onto a corporate network to do damage. If you can authenticate at every service your employees connect to, it closes down that vector.

[0] https://cloud.google.com/beyondcorp/

Post reply on HN