如何用.NET(F#)访问受IAP保护的GCloud AppEngine URL？

I ran into a similar issue a while back—your core problem is that you're requesting an access token for the wrong audience. Let's break down how to fix this step by step:

1. Use the Correct Audience for IAP #

When authenticating to IAP, the access token needs to have an aud (audience) claim that matches your app's IAP OAuth 2.0 Client ID—not the generic Google API token endpoint you're using now.

To get this Client ID:

• Head to the GCloud Console → Security → Identity-Aware Proxy
• Find your AppEngine app in the list, and copy the OAuth 2.0 Client ID (it looks like 1234567890-abcdefghijklmnopqrstuvwxyz.apps.googleusercontent.com)

2. Adjust Your F# Code #

The key fix is updating the GetAccessTokenForRequestAsync parameter to use this Client ID instead of the Google API endpoint. Also, using a dedicated HttpClient instead of reusing the credential's internal client avoids potential header conflicts. Here's the revised code:

open Google.Apis.Auth.OAuth2
open System.IO
open System
open System.Threading.Tasks
open System.Net.Http.Headers

let test() = 
    printfn "Initializing service account credentials from json"
    use jsonStream = new StreamReader("c:/<path to json credentials>.json")
    let credential = ServiceAccountCredential.FromServiceAccountData(jsonStream.BaseStream)
    let t = task {
        printfn "Fetching access token for IAP"
        // Replace this with your actual IAP OAuth 2.0 Client ID
        let iapClientId = "1234567890-abcdefghijklmnopqrstuvwxyz.apps.googleusercontent.com"
        let! token = credential.GetAccessTokenForRequestAsync(iapClientId)
        
        // Use a standalone HttpClient to prevent conflicts with the credential's internal HTTP client
        use httpClient = new HttpClient()
        httpClient.DefaultRequestHeaders.Authorization <- AuthenticationHeaderValue("Bearer", token)
        
        let! homePage = httpClient.GetStringAsync("https://<myapp>.appspot.com")
        printfn "%s" homePage
    }
    t.Wait()
    ()

3. Double-Check Critical Configurations #

Before testing again, confirm these boxes are checked:

• Your service account is added to the IAP Authorized Users/Groups list with the IAP-secured Web App User role (you mentioned this, but it's worth verifying once more)
• The service account JSON credential file you're using is valid and belongs to the correct account
• Your AppEngine app is fully protected by IAP (no bypass rules that might be causing unexpected behavior)

4. Debugging Steps if You Still Get 401 #

If the fix above doesn't work, try these to narrow down the issue:

• Decode the JWT: Use jwt.io to inspect the token you're getting. Make sure the aud field exactly matches your IAP Client ID, and the exp timestamp is still valid.
• Test with CLI: Use gcloud to generate a token and test the endpoint via curl—this will rule out code-specific issues:

  curl -H "Authorization: Bearer $(gcloud auth print-access-token --impersonate-service-account=your-service-account@your-project.iam.gserviceaccount.com --audience=your-iap-client-id)" https://<myapp>.appspot.com
  

  If this works, the problem is in your F# code; if not, check your IAP configuration or service account permissions.
• Check IAP Logs: In the GCloud Console, go to Logging → Log Explorer and filter for resource.type="gae_app" and logName="projects/your-project-id/logs/requests". The logs will show detailed reasons for authorization failures (e.g., invalid audience, missing permissions).

内容的提问来源于stack exchange，提问作者Darren