FilesExpand file tree

 php72-scripts

/

validate_jwt.php

Copy path

Blame

More file actions

Blame

More file actions

Latest commit

 

History

History

History

95 lines (86 loc) · 3.33 KB

 php72-scripts

/

validate_jwt.php

Copy path

Top

File metadata and controls

• Code
• Blame

95 lines (86 loc) · 3.33 KB

Raw

Copy raw file

Download raw file

Open symbols panel

Edit and raw actions

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

39

40

41

42

43

44

45

46

47

48

49

50

51

52

53

54

55

56

57

58

59

60

61

62

63

64

65

66

67

68

69

70

71

72

73

74

75

76

77

78

79

80

81

82

83

84

85

86

87

88

89

90

91

92

93

94

95

<?php

/**

* Copyright 2017 Google Inc.

*

* Licensed under the Apache License, Version 2.0 (the "License");

* you may not use this file except in compliance with the License.

* You may obtain a copy of the License at

*

* http://www.apache.org/licenses/LICENSE-2.0

*

* Unless required by applicable law or agreed to in writing, software

* distributed under the License is distributed on an "AS IS" BASIS,

* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.

* See the License for the specific language governing permissions and

* limitations under the License.

*/

/**

* For instructions on how to run the full sample:

*

* @see https://github.com/GoogleCloudPlatform/php-docs-samples/tree/master/iap/README.md

*/

# [START iap_validate_jwt]

namespace Google\Cloud\Samples\Iap;

# Imports OAuth Guzzle HTTP libraries.

use Jose\Factory\JWKFactory;

use Jose\Loader;

/**

* Validate a JWT passed to your App Engine app by Identity-Aware Proxy.

*

* @param string $iap_jwt The contents of the X-Goog-IAP-JWT-Assertion header.

* @param string $cloud_project_number The project *number* for your Google

* Cloud project. This is returned by 'gcloud projects describe $PROJECT_ID',

* or in the Project Info card in Cloud Console.

* @param string $cloud_project Your Google Cloud Project ID.

*

* @return (user_id, user_email).

*/

function validate_jwt_from_app_engine($iap_jwt, $cloud_project_number, $cloud_project_id)

{

$expected_audience = sprintf(

'/projects/%s/apps/%s',

$cloud_project_number,

$cloud_project_id

);

return validate_jwt($iap_jwt, $expected_audience);

}

/**

* Validate a JWT passed to your Compute / Container Engine app by Identity-Aware Proxy.

*

* @param string $iap_jwt The contents of the X-Goog-IAP-JWT-Assertion header.

* @param string $cloud_project_number The project *number* for your Google

* Cloud project. This is returned by 'gcloud projects describe $PROJECT_ID',

* or in the Project Info card in Cloud Console.

* @param string $backend_service_id The ID of the backend service used to access the

* application. See https://cloud.google.com/iap/docs/signed-headers-howto

* for details on how to get this value.

*

* @return (user_id, user_email).

*/

function validate_jwt_from_compute_engine($iap_jwt, $cloud_project_number, $backend_service_id)

{

$expected_audience = sprintf(

'/projects/%s/global/backendServices/%s',

$cloud_project_number,

$backend_service_id

);

return validate_jwt($iap_jwt, $expected_audience);

}

function validate_jwt($iap_jwt, $expected_audience)

{

// Create a JWK Key Set from the gstatic URL

$jwk_set = JWKFactory::createFromJKU('https://www.gstatic.com/iap/verify/public_key-jwk');

// Validate the signature using the key set and ES256 algorithm.

$loader = new Loader();

$jws = $loader->loadAndVerifySignatureUsingKeySet(

$iap_jwt,

$jwk_set,

['ES256']

);

// Validate token by checking issuer and audience fields.

assert($jws->getClaim('iss') == 'https://cloud.google.com/iap');

assert($jws->getClaim('aud') == $expected_audience);

// Return the user identity (subject and user email) if JWT verification is successful.

return array('sub' => $jws->getClaim('sub'), 'email' => $jws->getClaim('email'));

}

# [END iap_validate_jwt]