Status Update
Comments
sj...@google.com <sj...@google.com> #2
Best Regards,
Josh Moyer
Google Cloud Platform Support
st...@sky.uk <st...@sky.uk> #3
[Deleted User] <[Deleted User]> #4
vg...@augury.com <vg...@augury.com> #5
cd...@worldia.com <cd...@worldia.com> #6
gh...@lum.ai <gh...@lum.ai> #7
gu...@gmail.com <gu...@gmail.com> #8
[Deleted User] <[Deleted User]> #9
t....@gmail.com <t....@gmail.com> #10
se...@gmail.com <se...@gmail.com> #11
[Deleted User] <[Deleted User]> #12
[Deleted User] <[Deleted User]> #13
th...@gmail.com <th...@gmail.com> #14
[Deleted User] <[Deleted User]> #15
ja...@intercom.io <ja...@intercom.io> #16
ar...@blablacar.com <ar...@blablacar.com> #17
[Deleted User] <[Deleted User]> #18
[Deleted User] <[Deleted User]> #19
ko...@gmail.com <ko...@gmail.com> #20
2018 =(
[Deleted User] <[Deleted User]> #21
ro...@gmail.com <ro...@gmail.com> #22
ea...@gmail.com <ea...@gmail.com> #23
[Deleted User] <[Deleted User]> #24
[Deleted User] <[Deleted User]> #25
ni...@noovle.com <ni...@noovle.com> #26
wa...@gmail.com <wa...@gmail.com> #27
am...@google.com <am...@google.com> #28
[Deleted User] <[Deleted User]> #29
[Deleted User] <[Deleted User]> #30
[Deleted User] <[Deleted User]> #31
ch...@google.com <ch...@google.com> #32
[Deleted User] <[Deleted User]> #33
[Deleted User] <[Deleted User]> #34
mi...@rewe-digital.com <mi...@rewe-digital.com> #35
pj...@gmail.com <pj...@gmail.com> #36
Definitely useful feature at least provide a way to alias this.
+1
la...@gmail.com <la...@gmail.com> #37
[Deleted User] <[Deleted User]> #38
gu...@gmail.com <gu...@gmail.com> #39
ma...@gmail.com <ma...@gmail.com> #40
shouldn't be a very difficult implementation but benefits lots of people
[Deleted User] <[Deleted User]> #41
jo...@themindlab.co.uk <jo...@themindlab.co.uk> #42
[Deleted User] <[Deleted User]> #43
[Deleted User] <[Deleted User]> #44
do...@gmail.com <do...@gmail.com> #45
ra...@bendingspoons.com <ra...@bendingspoons.com> #46
+1 here too. But the problem is also with disks. We currently use part of hostname in the name. Sometimes a machine has to be renamed and it's not possible.
[Deleted User] <[Deleted User]> #47
al...@gmail.com <al...@gmail.com> #48
+1
re...@gmail.com <re...@gmail.com> #49
[Deleted User] <[Deleted User]> #50
Whe the ETA for this simple important request?
[Deleted User] <[Deleted User]> #51
yi...@gmail.com <yi...@gmail.com> #52
gh...@gmail.com <gh...@gmail.com> #53
ke...@bright-interactive.co.uk <ke...@bright-interactive.co.uk> #54
Hello,
Thanks for reaching out to us!
The Feature Request has been created and the Product Engineering Team is working on this request. At this moment, there is no ETA to this request. Thank you for your trust and continued support to improve Google Cloud Platform products.
In case you want to report a new issue, please do not hesitate to create a new
[Deleted User] <[Deleted User]> #55
el...@springer.com <el...@springer.com> #56
[Deleted User] <[Deleted User]> #57
pi...@gmail.com <pi...@gmail.com> #58
an...@gmail.com <an...@gmail.com> #59
ma...@zoominfo.com <ma...@zoominfo.com> #60
_e...@partner.auchan.com <_e...@partner.auchan.com> #61
[Deleted User] <[Deleted User]> #62
[Deleted User] <[Deleted User]> #63
It is a catch-22:
We cannot use a wildcard catch-all OAuth credentials because the Google Cloud Console forbids wildcards in origins, e.g.: *.
We cannot use per-review-app OAuth credentials because we cannot programmatically create them during a deployment job, to inject the ID and secret into the frontend and backend respectively.
an...@gmail.com <an...@gmail.com> #64
mb...@google.com <mb...@google.com> #65
ni...@platform.sh <ni...@platform.sh> #66
ta...@ujet.cx <ta...@ujet.cx> #67
ha...@gmail.com <ha...@gmail.com> #68
rl...@travix.com <rl...@travix.com> #69
ib...@gmail.com <ib...@gmail.com> #70
sh...@forallsecure.com <sh...@forallsecure.com> #71
al...@gmail.com <al...@gmail.com> #72
very frustrating.
ka...@kralnet.us <ka...@kralnet.us> #73
It sort of doesn't even really make sense - all the other APIs are automated and usable via Terraform. We have several repositories at this point where the readme has a "Manual deployment steps" that consists entirely of messing with OAuth client IDs in the cloud console, while literally everything else is smoothly automated. It's big enough of a wrench thrown into the automation pipeline though that a fair amount of special care needs to be taken to restructure the automation around this lack of automation.
It would make sense for some esoteric GCP functionality to not be automated, but this seems fundamental enough that it's a strange anomaly to not have the API in place.
It's sorta like having an assembly line that manufactures automobiles where the vehicles come out fully assembled but with no pistons in the engines. Sure, they can be added in later, but you basically have to backtrack into the automation process and account for the fact that someone has to take the whole thing apart and reassemble it so that it has all of the critical components in place.
But who knows - maybe there's some security concern, where Google doesn't want bots programmatically making nefarious OAuth client IDs, if there is such a thing. (shrug)
Anyways, this is my +1 vote for providing an OAuth client credential management API.
me...@stuartwakefield.co.uk <me...@stuartwakefield.co.uk> #74
el...@google.com <el...@google.com> #75
The API enables programmatic creation & management of OAuth clients for IAP applications that will be used by users within your domain.
ms...@google.com <ms...@google.com>
pr...@hawkfish.us <pr...@hawkfish.us> #76
sa...@gmail.com <sa...@gmail.com> #77
This is not fixed.
It's still not possible to manage API OAuth client credentials programmatically - the literal title of that issue.
aj...@archive.zumepizza.com <aj...@archive.zumepizza.com> #78
sw...@bainbridgehealth.com <sw...@bainbridgehealth.com> #79
It probably makes sense to open a new ticket with more specific details with what you need to accomplish.
pi...@google.com <pi...@google.com> #80
la...@brut.media <la...@brut.media> #81
Automate all the things!
ad...@google.com <ad...@google.com>
gl...@gmail.com <gl...@gmail.com> #82
cm...@gmail.com <cm...@gmail.com> #83
ke...@gmail.com <ke...@gmail.com> #84
da...@gmail.com <da...@gmail.com> #85
ts...@gmail.com <ts...@gmail.com> #86
We need it to periodically rotate the secret for security reasons. Common google, 2 years for small feature....
do...@gmail.com <do...@gmail.com> #87
I would appreciate to have an API which allows to manage OAuth 2.0 client credentials just like in the GCP console.
li...@google.com <li...@google.com> #88
recently, the only manual process is the OAuth 2.0 client credentials setup
through console. I would appreciate if we have an API
On Mon, Jan 25, 2021 at 6:34 PM <buganizer-system@google.com> wrote:
--
Chenggang Liu
liuchenggang@google.com
Customer Engineer
Raycom Tower B,No.2 Kexueyuan South Road, Haidian District, Beijing, 100022
mb...@google.com <mb...@google.com> #89
+1 Any updates on this?
[Deleted User] <[Deleted User]> #90
di...@gmail.com <di...@gmail.com> #91
el...@sada.com <el...@sada.com> #93
For many Google Cloud customers using Google Oauth as their primary identity provider for logging in to environments, it’s impossible to fully automate the environment creation today. The reason is that it’s not possible to create a Webapp Oauth Client ID + secret from Terraform (as you would do here), because there is no external API for creating those resources. Google appears to consider .
Google appears to consider this done because they allowed automation of client creation for IAP resources, but that’s useless for resources hosted anywhere other than behind IAP.
This is a huge blocker for many Google customers because it prevents full automation for creating their environments. The only workaround we can find is shifting workflows to use Azure AD or AWS Cognito as primary identity provider.
Let me know if you have any question.
Best,
Elena
ko...@koma.be <ko...@koma.be> #94
Create your OAUTH credentials manually in a separate project and define them as data sources in your Terraform setup.
Is it ideal ? No. Is this the end of the world ? Neither.
ve...@quantexa.com <ve...@quantexa.com> #95
We have a use case where we need to create OAuth Desktop Clients programmatically but that is not available through the
The Console UI does call some sort of API at
authType: "SHARED_SECRET"
brandId: "XXXXXXXX"
displayName: "test-ventsi"
projectNumber: "XXXXXXXX"
type: "NATIVE_DESKTOP"
This is exactly what we need. Currently we are stuck creating a Web Application type and having users authenticate to it by using redirect URI of itself and users having to grab the Auth Token from the URL parameters.
If we can get update from google, that would be great!
da...@crunchydata.com <da...@crunchydata.com> #96
ar...@ravelin.com <ar...@ravelin.com> #98
ph...@xpoli.eu <ph...@xpoli.eu> #99
vi...@ekahaa.com <vi...@ekahaa.com> #100
bj...@subsplash.com <bj...@subsplash.com> #101
[Deleted User] <[Deleted User]> #102
[Deleted User] <[Deleted User]> #103
[Deleted User] <[Deleted User]> #104
ja...@crispthinking.com <ja...@crispthinking.com> #105
ch...@otbc.se <ch...@otbc.se> #106
an...@qyberion.com <an...@qyberion.com> #107
Please refrain from submitting "+1" comments that spam everyone subscribed to issues here on Google (or for that matter in almost all modern issue trackers). It isn't the Apache board in 1998. Vote and subscribe to issues. Or at least add some meaningful information to your comments. Thank you for your understanding.
an...@loreal.com <an...@loreal.com> #108
ro...@gmail.com <ro...@gmail.com> #109
sa...@gmail.com <sa...@gmail.com> #110
This was opened in 2018 and it's 2022 and WE all want this feature so bad.
I recently started using Google Cloud and I am facing this issue in almost all of the deployments I am doing.
We need the APIs to create OAuth Client IDs programmatically!
This should be a TOP priority in 2022, PLEASE.
kb...@gmail.com <kb...@gmail.com> #111
st...@google.com <st...@google.com> #112
wy...@gmail.com <wy...@gmail.com> #113
fe...@gmail.com <fe...@gmail.com> #114
This blocks:
sr...@manh.com <sr...@manh.com> #115
sp...@google.com <sp...@google.com>
ka...@kralnet.us <ka...@kralnet.us> #116
For example, `gcloud alpha iap oauth-clients`, as described here:
In Terraform there's a corresponding `google_iap_client` resource. Similar is true for IDP.
So that's encouraging! It's overall pre-GA, but it's a step in the right direction.
ia...@gmail.com <ia...@gmail.com> #117
[Deleted User] <[Deleted User]> #118
ri...@doit.com <ri...@doit.com> #119
ch...@biotics.ai <ch...@biotics.ai> #120
sh...@gmail.com <sh...@gmail.com> #121
lo...@pgs.com <lo...@pgs.com> #122
ha...@google.com <ha...@google.com> #123
ry...@gmail.com <ry...@gmail.com> #124
But it is not to be, because one cannot manage even internal oauth2 clients via the API and terraform. Sad!
ck...@google.com <ck...@google.com> #125
My assigned has same trouble and they would like to solve this issue,
They have created a mechanism to automatically build multiple development environments. Although the creation of other services can be automated, only the OAuth2.0 client settings have to be handled manually. Please be able to do the following to improve the development cycle:
- Capability to add, remove, and edit oAuth approved redirect URIs from the command line
- Partial wildcard support for oAuth approved redirect URIs.
th...@otto.de <th...@otto.de> #126
co...@otto.de <co...@otto.de> #127
va...@gmail.com <va...@gmail.com> #128
jp...@gmail.com <jp...@gmail.com> #129
[Deleted User] <[Deleted User]> #130
ph...@battelleecology.org <ph...@battelleecology.org> #131
ba...@google.com <ba...@google.com>
gh...@google.com <gh...@google.com>
ja...@onda.ai <ja...@onda.ai> #132
ed...@kognic.com <ed...@kognic.com> #133
So tiered of all the limitations GCP have when it comes to oauth. Just like most people here, I need to be able to define Redirect URIs.
I really don't want to host my own oauth solution, but with all the limitations that GCP has around it, I'm starting to lean towards hosting our own keycloak or similar tool is the only long term solution. How are we supposed to scale with these kinds of limitations?
rp...@activecampaign.com <rp...@activecampaign.com> #134
va...@google.com <va...@google.com>
gh...@google.com <gh...@google.com>
mi...@roller.de <mi...@roller.de> #135
ar...@gmail.com <ar...@gmail.com> #136
"The OAuth clients created by the API are locked for IAP usage only, and therefore the API does not allow any updates to the redirect URI or other attributes."
Why!
It is not acceptable in 2023 to have to modify production infrastructure manually.
ja...@google.com <ja...@google.com> #137
I'm not from the Terraform or OAuth Teams, But I just tried this and it is working for me:
This is Ideal if you have not already enabled Identity Platform on your Google Cloud Project as it will enable it for you as if you pressed the big blue "Enable Identity Platform" button on the GCP console for a new project.
If you already have an Identity Platform enabled on your GCP Project, then you can try and import with terraform import google_identity_platform_config.default "my-gcp-project"
once you have added the below to your terraform config:
resource "google_identity_platform_config" "default" {
project = var.project_id
autodelete_anonymous_users = true
authorized_domains = [
"localhost",
"my-gcp-project.firebaseapp.com",
"my-gcp-project.web.app",
"${var.dns_domain}",
"api.${var.dns_domain}",
]
}
vm...@gmail.com <vm...@gmail.com> #138
vm...@gmail.com <vm...@gmail.com> #139
mi...@clipido.com <mi...@clipido.com> #140
ma...@bright-interactive.co.uk <ma...@bright-interactive.co.uk> #141
be...@precisionsoftware.us <be...@precisionsoftware.us> #142
Heck, I'd be ecstatic to just get an API to map from the human readable name to the set of strings needed to run an OIDC authentication:
- client_id
- client_secret
- a few global (presumably, at least when limited to google) URLs
That would be enough that I could at least use a Terraform data
resource to fill in blanks on other resources.
ja...@talkspace.com <ja...@talkspace.com> #143
ra...@quorbit.co.uk <ra...@quorbit.co.uk> #144
sh...@agencyanalytics.com <sh...@agencyanalytics.com> #145
gr...@trmlabs.com <gr...@trmlabs.com> #146
[Deleted User] <[Deleted User]> #147
ru...@gmail.com <ru...@gmail.com> #148
as...@bt.com <as...@bt.com> #149
We need this as well.
ad...@mystrobe.net <ad...@mystrobe.net> #150
av...@gmail.com <av...@gmail.com> #151
va...@google.com <va...@google.com>
va...@google.com <va...@google.com>
[Deleted User] <[Deleted User]> #152
al...@nitrado.net <al...@nitrado.net> #153
mi...@ruhl.in <mi...@ruhl.in> #154
ci...@gmail.com <ci...@gmail.com> #155
ja...@crispthinking.com <ja...@crispthinking.com> #156
py...@scorewarrior.com <py...@scorewarrior.com> #157
What do you think about the idea of ​​implementing changing Authorized JavaScript Origins and Authorized Redirect URIs programmatically instead of manually in the GCP console?
Identity Platfrom includes a lot of functionality and requires support for it on clients. I would like to stay on simple and convenient OAuth clients that can be fully managed via API.
Description
This will be used for example on Terraform Google Provider :