identify user on Wordpress behind IAP

[jameslast]

Hello All,

I've successfully set up Wordpress behind https load balancer behind Identity-aware-proxy.

So users added as "principals" in IAP can reach the Wordpress site. But they are not identified by/in Wordpress.

Can anyone advise on what's the best way to achieve this?

On a Wordpress that"s not behind LB/IAP I get this done by enabling two plugins:

"Force Login" and "Login with Google"

Behind IAP I cannot login with " Force Login" enabled, I get EM: The server encountered a temporary error and could not complete your request.

Any pointers would be greatly appreciated.

Greetings, j.

[RonEtch]

Hi @jameslast 

Welcome to Google Cloud Community!

In this case, you need to verify if the IAP is correctly configured to do a pass through of user's identity to the WordPress. To do this, you can follow this guide. Currently the error you have, tells you that there is incompatibility with "Force Login" plugin and IAP. For official documentation you can always view this guide.

For additional guides, you can check this article on how gcp users can authenticate with IAP.

I hope this information is helpful.

If you need further assistance, you can always file a ticket on our support team.

[jameslast]

Ron,

thank you very much for your reply, I really appreciate it.

What I noticed by now is that the load balancer's health check gives a warning.

This morning the health check was green and it worked, with "force login" and "Login with Google".

So I am now troubleshooting the health check warning.

Greetings, j.

[jameslast]

Hello,

I must confess I did not get this to work.

This article : https://galinay.wordpress.com/2019/08/19/gcp-user-authentication-identity-aware-proxy/ is mainly a theoretical guide and mostly talks about App Engine.

This article https://cloud.google.com/iap/docs/enabling-compute-howto

is what I used to set up the load balancer and iap. I followed it almost to the letter, only using an unmanaged instance group instead of a managed one, as I only have on Wordpress.

I do wonder if I need to switch that, but that would make it all much more complex.

Following this guide: https://cloud.google.com/iap/docs/identity-howto#getting_the_users_identity_with_signed_headers

I configured the iap consent screen and found that I should set up a custom request path in the health check. But I cannot find how to do that. SImply changing it from / to /health or /login does not work.

So the situation is that a get a health check warning if I enable the Wordpress plugins "Force login" or "restricted site access". This occurs with or without IAP enabled.

The log warning associated with the health check warning is:

      "targetPort": 80,
      "probeRequest": "/",
      "probeSourceIp": "130.211.2.96",
      "probeResultText": "HTTP response error: Found [Code: 302]",
      "previousDetailedHealthState": "HEALTHY",
      "probeCompletionTimestamp": "2023-10-18T07:39:42.851597504Z",
      "healthCheckProtocol": "HTTP",
      "connectLatency": "0.001503s"

The EM also stays the same with or without IAP enabled.

The failure of the setup is undoubtedly because of my incompetence BUT it's a shame this is nowhere really documented. Wordpress is used by so many I am told and I see enormous security benefits in deploying it behand IAP.

Further pointers are greatly appreciated.

Greetings, j.

[jameslast · Accepted solution]

Hello All,

by now I was able to test this on a few setups, and the answer seems to be to switch the health check from http port 80 to ssl port 443.

The rest of the setup follows this manual: https://cloud.google.com/iap/docs/load-balancer-howto

except I used an unmanaged instance group. The above mentioned Workspace plugins are still needed.

Greetings, J.