Up :)

Does anyone have any information? How do you usually connect to cloud run backends on google cloud form a vercel website?

hey @ant0198

It sounds like these environment variables might be missing from your Vercel project.

If you've checked that they exist within project settings and have confirmed that the credentials are correct we can pull these same variables into your local dev environment:

1
vercel pull
2

3
# or to pull prod env vars:
4
vercel pull --environment=production

View vercel pull docs

This should allow you to authenticate using the same credentials as your deployed app when testing locally instead of using gcloud auth login.

There's already a reference to GCP_PROJECT_ID so I'm assuming that some environment variables have been defined further up in the codebase. If not we might need to add variable definitions similar to the example in our docs:

1
const GCP_PROJECT_ID = process.env.GCP_PROJECT_ID;
2
const GCP_PROJECT_NUMBER = process.env.GCP_PROJECT_NUMBER;
3
const GCP_SERVICE_ACCOUNT_EMAIL = process.env.GCP_SERVICE_ACCOUNT_EMAIL;
4
const GCP_WORKLOAD_IDENTITY_POOL_ID = process.env.GCP_WORKLOAD_IDENTITY_POOL_ID;
5
const GCP_WORKLOAD_IDENTITY_POOL_PROVIDER_ID =
6
  process.env.GCP_WORKLOAD_IDENTITY_POOL_PROVIDER_ID;

This allows us to initialise ExternalAccountClient as outlined in the official docs

1
import { ExternalAccountClient } from 'google-auth-library';
2

3
// Initialize the External Account Client
4
const authClient = ExternalAccountClient.fromJSON({
5
  type: 'external_account',
6
  audience: `//iam.googleapis.com/projects/${GCP_PROJECT_NUMBER}/locations/global/workloadIdentityPools/${GCP_WORKLOAD_IDENTITY_POOL_ID}/providers/${GCP_WORKLOAD_IDENTITY_POOL_PROVIDER_ID}`,
7
  subject_token_type: 'urn:ietf:params:oauth:token-type:jwt',
8
  token_url: 'https://sts.googleapis.com/v1/token',
9
  service_account_impersonation_url: `https://iamcredentials.googleapis.com/v1/projects/-/serviceAccounts/${GCP_SERVICE_ACCOUNT_EMAIL}:generateAccessToken`,
10
  subject_token_supplier: {
11
    // Use the Vercel OIDC token as the subject token
12
    getSubjectToken: getVercelOidcToken,
13
  },
14
});

While I wasn't able to find a more specific example for your use case you might be able to take inspiration from the official google-auth-library samples such as credentials.js.

Hi,

Thanks a lot for your answer! :)

I did have the environment variables, and the ExternalAccountClient works properly - the problem is that I need to get a tokenID in order to connect to the cloud run backend, so I need something like getIdTokenClient. This method exists under GoogleAuth but not under ExternalAccountClient.

The code sample you linked to uses GoogleAuth, not the ExternalAccountClient class. I couldn't find any examples of ExternalAccountClient unfortunately.

Up

I would be grateful for any pointers to code or documentation. What I am trying to do should be relatively easy - connect from a vercel function to a Cloud run backend.

I now tried the following:

1
    const authClient = new GoogleAuth({
2
      scopes: "https://www.googleapis.com/auth/cloud-platform",
3
      // Pass the project ID explicitly to avoid the need to grant roles/browser
4
      // to the service account or enable Cloud Resource Manager API on the
5
      // project.
6
      projectId: GCP_PROJECT_ID,
7
      credentials: {
8
        type: "external_account",
9
        audience: //iam.googleapis.com/projects/${GCP_PROJECT_NUMBER}/locations/global/workloadIdentityPools/${GCP_WORKLOAD_IDENTITY_POOL_ID}/providers/${GCP_WORKLOAD_IDENTITY_POOL_PROVIDER_ID},
10
        subject_token_type: "urn:ietf:params:oauth:token-type:jwt",
11
        token_url: "https://sts.googleapis.com/v1/token",
12
        service_account_impersonation_url: https://iamcredentials.googleapis.com/v1/projects/-/serviceAccounts/${GCP_SERVICE_ACCOUNT_EMAIL}:generateAccessToken,
13
        subject_token_supplier: {
14
          // Use the Vercel OIDC token as the subject token.
15
          getSubjectToken: getVercelOidcToken,
16
        },
17
      },
18
    });
19
    const idTokenClientTest = await authtest.getIdTokenClient(backend_url);

But it fails with the following error: "Error: Cannot fetch ID token in this environment, use GCE or set the GOOGLE_APPLICATION_CREDENTIALS environment variable to a service account credentials JSON file. at C.getIdTokenClient (/var/task/.../app/api/backend/route.js:13:33960)"

And I am not sure what's going on.

Note that I am able to get an access token (await getAccessToken() works), but how to get an id token now which is required to connect to cloud run?

Thank you! :)

Can you initialize the IdTokenClient in another way?

It seems that the constructor accepts the credentials property, which happens to be the interface as ExternalAccountClient credentials method. I'm not sure about the rest of the properties though.

1
new IdTokenClient({
2
  credentials: auth.credentials,
3
  targetAudience: '',
4
  idTokenProvider: {
5
    fetchIdToken: async (aud: string) => ''
6
  }
7
})

Actually, can I ask what service you're trying to access? I think most services in GCP will work using the access tokens that are minted from the external account client.

Thank you!

Let me try to use new IdTokenClient and I will report back :)

Actually, can I ask what service you’re trying to access? I think most services in GCP will work using the access tokens that are minted from the external account client.

I am trying to access a Cloud Run server which is running my code. IIUC one needs a token ID to connect to it.

Hey @ant0198,

I took a quick look at Cloud Run and I suspect you can actually configure it to directly recognize and trust Vercel OIDC Tokens.

In other words you might not need to connect to GCP STS to exchange the Vercel token for credentials, you can simply authenticate with your Cloud Run HTTPS endpoint with authorization: Bearer ${await getVercelOidcToken()} header.

I haven't tried this myself, but I suspect you can grant the Vercel service account access to Cloud Run Invoker.

Hi,

I am still not sure about the intended workflow (everything is very confusing), but I managed to authenticate using the following:

1. Create the External client as shown above
2. Use the impersonated class to impersonate a service account
3. Use this impersonated class to collect a token ID
4. Manually use this token id in the header request

1
const client = ExternalAccountClient.fromJSON({
2
    type: "external_account",
3
    audience: `//iam.googleapis.com/projects/${GCP_PROJECT_NUMBER}/locations/global/workloadIdentityPools/${GCP_WORKLOAD_IDENTITY_POOL_ID}/providers/${GCP_WORKLOAD_IDENTITY_POOL_PROVIDER_ID}`,
4
    subject_token_type: "urn:ietf:params:oauth:token-type:jwt",
5
    token_url: "https://sts.googleapis.com/v1/token",
6
    service_account_impersonation_url: `https://iamcredentials.googleapis.com/v1/projects/-/serviceAccounts/${GCP_SERVICE_ACCOUNT_EMAIL}:generateAccessToken`,
7
    subject_token_supplier: {
8
      // Use the Vercel OIDC token as the subject token.
9
      getSubjectToken: getVercelOidcToken,
10
    },
11
  });
12
  const targetClient = new Impersonated({
13
      sourceClient: externalClient,
14
      targetPrincipal: GCP_SERVICE_ACCOUNT_EMAIL,
15
      lifetime: 30,
16
      delegates: [],
17
      targetScopes: ["https://www.googleapis.com/auth/cloud-platform"],
18
    });
19
const idToken = await targetClient.fetchIdToken(backend_url);
20
const response = await fetch(backend_url, {
21
      method: "GET",
22
      headers: {
23
        Authorization: `Bearer ${idToken}`,
24
      },
25
    });
26
console.log(await response.json());

This seems to work correctly!

Awesome @ant0198, that is great to know. Thanks for posting the solution.