How to curl to an Identity Aware Proxy protected service

06 Dec, 2021
Xebia Background Header Wave

When you have a web service behind an Identity Aware Proxy (IAP) it is pretty hard to access it via curl on the command line. In this tiny blog I will show you how you can do it. To curl to a web service behind an Identity Aware Proxy use the following command:

   gcloud auth print-identity-token \
   --audiences  $OAUTH_CLIENT_ID \
   --include-email \
   --impersonate-service-account $AUTHORIZED_SA
curl --header "Proxy-Authorization: Bearer $ID_TOKEN"  $URL

That is all there is to it.

It is clear that you need the role service account token creator on the service account. In turn, this service account is granted the role of https resource accessor on the back-end service.


Through service account impersonation, you can create an id token to access an Identity Aware Proxy protected service. It would be nice, if users could directly generate the required Id token, but you cannot.

Mark van Holsteijn
Mark van Holsteijn is a senior software systems architect at Xebia Cloud-native solutions. He is passionate about removing waste in the software delivery process and keeping things clear and simple.

Get in touch with us to learn more about the subject and related solutions

Explore related posts