Sample App: L7 External LB + IAP + Identity Platform + Okta

Sample Cloud Run application serving both /public (public-backend-service) and /customer-login (customer-login-backend-service).

Current HTTP Request Path: /
Go to /public (No Auth Backend Service) Go to /customer-login (IAP Backend Service)
No X-Goog-IAP-JWT-Assertion Header Present (Routed via Unauthenticated Backend Service or Direct Cloud Run URL)

Optional: Direct Identity Platform Login (Without IAP)

If testing via the Load Balancer, click "Go to /customer-login (IAP Backend Service)" above so IAP intercepts the request. Or click below to test Direct Cloud Run login:

Authentication & Routing Summary

HTTP Path Received:
/
IAP Header Present:
NO (Unauthenticated Backend Service / No IAP)
Auth Mode:
No Identity Platform Token Detected Yet
Signature Verification:
No IAP token on this route
Logged in User Email:
Not signed in
GCIP Provider ID:
None
GCIP Tenant ID:
None
JSON Attribute Path:
N/A

1. Okta Propagated Attributes (sign_in_attributes)

When routed through IAP + Identity Platform (GCIP) on /customer-login, IAP wraps the Identity Platform token inside a gcip claim. All custom Okta OIDC ID Token claims and SAML Attribute Statements are automatically available at decoded_jwt["gcip"]["firebase"]["sign_in_attributes"]: 

{}

2. Full Decoded JWT Payload

Complete raw token payload received by Cloud Run:

{
    "request_path": "/",
    "iap_header_present": false,
    "status": "No X-Goog-IAP-JWT-Assertion header on this request. If visiting /public, this confirms the Load Balancer routed through the Unauthenticated Backend Service. Navigate to /customer-login to trigger IAP + Identity Platform + Okta authentication."
}