Enable IAP using a Google-managed OAuth client

This page describes how to enable Identity-Aware Proxy (IAP) for a Google Cloud resource, using a Google-managed OAuth client.

When enabling IAP on a resource using a Google-managed OAuth client, only users within the organization in which the resource is contained can access that resource. If you want to allow users outside of the organization access to an IAP-enabled resource, enable custom OAuth credentials .

Enable IAP for a new resource

New Google Cloud resources don't have IAP enabled. Complete the following steps to enable IAP on a new resource.

1. In the Google Cloud console, go to the IAP page.

   Go to the IAP page

2. Click the Applicationstab.

3. From the list of resources, select the resource for which you want to enable IAP.

4. In the IAPcolumn, click the toggle to the on position.

5. For the Turn on IAPoption, click Turn on.

Set up custom OAuth credentials for a resource

To allow users outside of the organization access to an IAP-enabled resource, complete the following steps.

1. In the Google Cloud console, go to the IAP page.

   Go to the IAP page

2. Click the Applicationstab.

3. In the list of resources, go to the settings of the resource for which you want to configure custom OAuth credentials.

4. Select the Enable custom OAuth credentials to allow users outside of this organization to access this applicationcheckbox.

5. In the OAuth configurationdialog, enter a client ID and secret.

6. Optional: To have a client ID and secret generated for you, click Auto generate credentials.

   You can download the client credentials to a CSV file, or delete the credentials. After you save your changes, custom client credentials cannot be retrieved, so we recommend that you save your credentials.

   If you delete the credentials, the auto-generated OAuth client is also deleted.

7. To save your changes, Click Save. Saving your changes does not change the IAP enabled state.

Change to a Google-managed OAuth client

You can change resources using a custom OAuth client to use a Google-managed OAuth client by completing the following steps.

1. In the Google Cloud console, go to the IAP page.

   Go to the IAP page

2. Click the Applicationstab.

3. In the list of resources, go to the settings of the resource for which you want to change to use a Google-managed OAuth client.

4. Deselect the Enable custom OAuth credentials to allow users outside of this organization to access this applicationcheckbox.

5. Click Save.