Installing Remote Desktop Connection Manager as limited user

Installing the Remote Desktop Connection Manager requires administrator privileges. That can be a problem in a corporate environment where you might not have local administrator rights. Fortunately, there is an easy way to overcome this limitation by performing an administrative installation. Continue »

Dealing with credentials when using the Google Cloud client libraries (.NET edition)

Google APIs use OAuth 2.0 for authentication and authorization. To call an API, you first have to obtain an access token for the right scope and then pass it to the respective API by using the Authorization HTTP header. But the trouble with access tokens is that they are short-lived, and you somehow have to deal with expiring tokens… Continue »

Impact of GCP session length on OAuth clients

Once you’ve signed in on google.com, the Cloud Console, or any other Google site, your browser session remains valid for multiple days. Not being prompted to sign in over and over again is convenient and at least in typical consumer scenarios, the risk that comes along with keeping the session is limited.

Things can look different in a corporate scenario where users might have access to sensitive data. Keeping sessions alive for 14 days (which is the default) might seem a little risky and might not be in line with an enterprise’s idea of security. G Suite Business and Cloud Identity Premium therefore allow you to change the default session length to a different period such as 8 hours. This setting applies to all Google services, not only GCP.

Recently, Google introduced another way to control session lifetime by allowing you to control the session length for Cloud Console and gcloud sessions.

New version of the Cloud IAP plugin for Remote Desktop released

A few days ago, I released version 1.1.22 of the Cloud IAP plugin for Remote Desktop on Github.

The three main new features in this release are:

1. A managed implementation of Cloud IAP TCP tunneling
2. OAuth-based authorization.
3. Support for custom GCP session lengths.

Integrating with Cloud IAP

In the last post, we discussed that each request that Cloud IAP passes to a backend appliation contains a X-Goog-Iap-Jwt-Assertion header. This header contains an IAP JWT assertion that looks a bit like an IdToken, but is not an IdToken. Continue »

Cloud IAP architecture

Conceptually, you can think of Cloud IAP as a reverse proxy that is deployed in front of your corporate application that intercepts all requests to perform authentication and authorization. Continue »

Cloud IAP and its role in zero-trust

At Google Cloud, we run a series of Cloud Summits each year. A Cloud Summit is essentially a mini-version of Cloud NEXT – it lasts one day, features multiple tracks of technical sessions, and is usually held in a location where there is plenty of space for booths where customers can ask questions.

One question that we frequently get at the Ask an Architect or Ask the Expert booth is about Cloud Identity-Aware Proxy - what is it for, how does it work, and how to use it?

In this series of blog posts, I am going to address these questions, one at a time:

• Part 1: What is it for? – The role of Cloud IAP in zero-trust (this post)
• Part 2: How does it work? – Cloud IAP architecture
• Part 3: How to use it – Integrating with Cloud IAP

Articles I recently published on the Google Cloud website

A key part of my job as Solutions Architect at Google Cloud is to work with customers to identify and capture best practices and to turn these into public documentation.

Over the past six months, I have published the following guides.

Articles I recently published on the Google Cloud website

A key part of my job as Solutions Architect at Google Cloud is to work with customers to identify and capture best practices and to turn these into public documentation.

Over the past six months, I have published the following guides