Cloud Run Auth token not working on the tagged revision url

[Marius-I]

Hi team,

Recently we tried enabling "Required Authentication for an "Allow all traffic" CR service. As part of the Cloud Build deployment process we have a few calls through a cloud function that targets a the newly deployed tagged revision (with 0% traffic) for setting up DB before transferring traffic to it. All the calls are sent to the tagged url (<tag>---<base_url>) but Google Security denies access to it with the following response:

ERROR:root:HTTP Error 401: Unauthorized
ERROR:root:WWW-Authenticate: Bearer error="invalid_token" error_description="The access token could not be verified"
Date: Thu, 10 Mar 2022 10:34:16 GMT
Content-Type: text/html; charset=UTF-8
Server: Google Frontend
Content-Length: 330
Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
Connection: close

Requests sent to the default revision URL (without the tag) are successful.

The Cloud Function that is making the request is in python and uses the code suggested by the Google Docs here.

Is this a Cloud Run limitation? Is there any way we can solve this?

[Sima]

Hi Marius,

Could you elaborate more about the request structure and post a sample REDACTED request with the tagged URL (<tag>---<base_url>) that is not successful to better understand the issue?

Note that Google Groups are for asking general questions on GCP-end products and not for technical questions. For technical questions, I recommend to post your full detailed question on Stack Overflow and use relative tags since you can receive more visibility on your technical questions there.

[sijohnmathew]

Hey Marius,

Did you manage to solve this issue ?

I am also stuck with the same problem. Is this a known limitation of Cloud Run ?

Regards,

Sijohn Mathew

[sijohnmathew]

Ignore the above post. I think I got the solution. When we call the Cloud Run endpoint, we need to set the Audience field explicitly to the base address without the --tag version