Enabling Okta-Authenticated User Access to Authenticated Cloud Run Service

[Nikita_G]

We have deployed an authenticated Cloud Run service for a Streamlit application. The application already includes Okta authentication for user sign-in, and we wants to use only Okta for authentication.

we does not want to use Google Sign-In or any other external authentication mechanisms for accessing the Cloud Run service.

We tried using Identity-Aware Proxy (IAP) for securing the service, but it also requires Google Sign-In, which the we does not want.

Requirement:
We want only Okta-authenticated users to access the deployed authenticated Cloud Run service.

Are there any other approaches or configurations we can implement to achieve this?

[ronnelg · Accepted solution]

Hi @Nikita_G, 

Have you tried to use the Cloud Endpoints for Cloud Run? To authenticate a user, a client application must send a JSON Web Token (JWT) in the authorization header of the HTTP request to your backend API. The Extensible Service Proxy (ESP) validates the token on behalf of your API, so you don't have to add any code in your API to process the authentication. However, you do need to configure your OpenAPI document to support your chosen authentication methods. 

Have a look at this documentation for more details on how to authenticate users using Okta with ESP.

Was this helpful? If so, please accept this answer as “Solution”. If you need additional assistance, reply here within 2 business days and I’ll be happy to help.