Meta tags:
Headings (most frequently used words):
node, js, python, java, the, with, code, cloud, up, identity, platform, to, pricing, run, tutorial, and, set, integrate, side, server, delete, resources, subject, tier, end, user, authentication, for, stay, organized, collections, save, categorize, content, based, on, your, preferences, objectives, costs, before, you, begin, gcloud, cli, defaults, retrieve, sample, visualize, architecture, understand, core, deploy, service, finishing, touches, try, it, out, clean, what, next, required, roles, locations, client, connect, sql, handle, sensitive, configuration, secret, manager, project, products, support, engage,
Text of the page (most frequently used words):
the (272), cloud (142), and (90), run (78), #project (65), you (65), service (60), with (56), google (49), sql (45), your (45), for (44), from (44), identity (41), that (39), create (39), user (38), services (35), secret (35), using (34), roles (33), delete (29), deploy (29), token (27), overview (27), this (26), platform (23), region (23), server (23), tutorial (22), use (22), code (21), gcloud (21), build (21), instance (20), console (20), firebase (20), resources (19), sample (19), project_id (18), can (18), configure (18), database (18), java (17), manager (17), account (17), iam (17), client (17), samples (16), container (16), idp (16), admin (16), name (15), select (15), environment (15), python (15), low (15), sign (14), config (14), access (14), secrets (14), worker (14), com (13), configuration (13), click (13), end (13), credentials (13), repository (13), error (13), return (13), const (13), storage (13), europe (13), functions (13), other (12), vote (12), new (12), auth (12), node (12), spring (12), application (12), get (12), jobs (12), pools (12), page (11), add (11), function (11), gpu (11), vpc (11), need (10), users (10), created (10), url (10), role (10), string (10), returns (10), authorization (10), uid (10), view (10), asia (10), manage (9), following (9), then (9), data (9), provider (9), connection (9), docker (9), request (9), postgres (9), sdk (9), header (9), volumes (9), execute (9), about (8), all (8), requests (8), has (8), projects (8), when (8), authentication (8), try (8), https (8), note (8), cloudsql (8), cloud_sql_credentials_secret (8), cli (8), uses (8), grant (8), json (8), db_user (8), db_name (8), cloud_sql_connection_name (8), postgresql (8), window (8), enable (8), err (8), development (8), git (8), best (8), practices (8), trigger (8), triggers (8), thumb (7), more (7), artifact (7), registry (7), also (7), dialog (7), limits (7), custom (7), through (7), format (7), signed (7), instances (7), password (7), memory (7), set (7), required (7), jdbctemplate (7), pool (7), connect (7), headers (7), pub (7), sub (7), maximum (7), products (6), are (6), authenticate (6), learn (6), next (6), image (6), browser (6), provided (6), apis (6), variables (6), which (6), tools (6), file (6), db_password (6), not (6), app (6), parse (6), logger (6), catch (6), object (6), retrieve (6), engine (6), creds (6), credconfig (6), authheader (6), verify (6), response (6), alert (6), log (6), docs (6), how (6), security (6), migrate (6), agents (6), metrics (6), github (5), pricing (5), down (5), information (5), under (5), send (5), deployed (5), plan (5), might (5), used (5), existing (5), management (5), sensitive (5), complete (5), after (5), method (5), allow (5), jib (5), containers (5), datasource (5), values (5), web (5), throw (5), secure (5), local (5), extract (5), integrate (5), logging (5), selecting (5), cost (5), usage (5), resourcemanager (5), permission (5), based (5), networking (5), migration (5), gpus (5), network (5), traffic (5), source (5), job (5), eventarc (5), invoke (5), português (4), español (4), status (4), understand (4), content (4), its (4), developers (4), gserviceaccount (4), added (4), setup (4), costs (4), billing (4), deployment (4), copy (4), oauth (4), logs (4), providers (4), version (4), pkg (4), dev (4), credential (4), builds (4), location (4), policy (4), associated (4), gcp (4), cpu (4), infrastructure (4), static (4), make (4), sure (4), def (4), databases (4), private (4), unix (4), sqlalchemy (4), host (4), else (4), decodedtoken (4), properly (4), expired (4), req (4), www (4), their (4), script (4), clone (4), west1 (4), south1 (4), editor (4), selector (4), write (4), checks (4), inference (4), direct (4), scaling (4), health (4), optimize (4), dependencies (4), events (3), started (3), system (3), support (3), contact (3), see (3), otherwise (3), explore (3), tutorials (3), methods (3), into (3), default (3), replace (3), don (3), type (3), want (3), multiple (3), have (3), such (3), instead (3), tasks (3), document (3), any (3), keep (3), these (3), will (3), should (3), button (3), step (3), enter (3), domain (3), authorize (3), variable (3), cloud_sql_instance_name (3), process (3), push (3), images (3), must (3), password_secret (3), username (3), steps (3), supply (3), external (3), unable (3), formatted (3), hashmap (3), null (3), public (3), str (3), been (3), env (3), provides (3), db_config (3), db_socket_dir (3), db_pass (3), args (3), base (3), int (3), decoded (3), correct (3), split (3), func (3), res (3), require (3), side (3), text (3), await (3), team (3), adds (3), result (3), javascript (3), back (3), reference (3), shows (3), contains (3), alternatively (3), zip (3), download (3), googlecloudplatform (3), east1 (3), northamerica (3), specific (3), managed (3), permissions (3), test (3), serviceusage (3), free (3), guides (3), hosting (3), frameworks (3), monitoring (3), solutions (3), distributed (3), introduction (3), mcp (3), connectors (3), optimization (3), autoscale (3), labels (3), ephemeral (3), disk (3), cifs (3), smb (3), nfs (3), volume (3), mounts (3), entrypoint (3), retries (3), firestore (3), concurrent (3), product (3), 한국어 (2), 日本語 (2), עברית (2), brasil (2), italiano (2), indonesia (2), français (2), américa (2), latina (2), deutsch (2), english (2), our (2), terms (2), site (2), youtube (2), architecture (2), last (2), updated (2), 2026 (2), utc (2), except (2), licensed (2), details (2), license (2), feedback (2), connecting (2), unset (2), remove (2), during (2), they (2), list (2), deleting (2), avoid (2), work (2), without (2), additional (2), choose (2), flow (2), previous (2), out (2), firebaseapp (2), save (2), icon (2), edit (2), authorized (2), redirect (2), domains (2), requires (2), finishing (2), touches (2), latest (2), update (2), unauthenticated (2), load (2), begin (2), verifies (2), submit (2), tag (2), binding (2), member (2), serviceaccount (2), secretmanager (2), accounts (2), automatic (2), follow (2), described (2), initialize (2), authdomain (2), apikey (2), client_secret (2), client_id (2), email (2), one (2), api (2), manual (2), loads (2), dictionary (2), dict (2), get_cred_config (2), tostring (2), resource (2), runtime (2), handle (2), jdbc (2), bean (2), allows (2), none (2), pgsql (2), 5432 (2), unix_sock (2), pg8000 (2), socket (2), dbsocketpath (2), knex (2), async (2), httpstatus (2), responsestatusexception (2), idtoken (2), verifyidtoken (2), authenticatejwt (2), decorated_function (2), kwargs (2), decoded_token (2), 401 (2), 403 (2), exception (2), extracts (2), callable (2), sendstatus (2), fetch (2), currentuser (2), reporting (2), displayname (2), them (2), gstatic (2), firebasejs (2), src (2), first (2), core (2), sdks (2), authenticated (2), sends (2), own (2), control (2), redirected (2), votes (2), nodejs (2), already (2), west4 (2), west3 (2), west2 (2), southamerica (2), northeast2 (2), northeast1 (2), central2 (2), central1 (2), australia (2), southeast2 (2), southeast1 (2), india (2), south (2), subject (2), tier (2), available (2), regions (2), latency (2), but (2), across (2), locations (2), within (2), supported (2), defaults (2), basic (2), administrator (2), owner (2), enabled (2), procedure (2), finish (2), removing (2), creator (2), projectcreator (2), doesn (2), granted (2), perform (2), world (2), components (2), least (2), privilege (2), protect (2), processes (2), does (2), documentation (2), languages (2), observability (2), industry (2), hybrid (2), multicloud (2), analytics (2), pipelines (2), compute (2), troubleshoot (2), oci (2), assisted (2), llm (2), execution (2), remote (2), adk (2), a2a (2), prometheus (2), controls (2), shared (2), connector (2), automate (2), workflows (2), description (2), metadata (2), systems (2), capacity (2), rollbacks (2), revisions (2), continuous (2), tags (2), timeout (2), testing (2), workflow (2), runtimes (2), configurations (2), http (2), serving (2), serve (2), results (2), php (2), ruby (2), prepare (2), develop (2), cases (2), cross (2), technology (2), areas (2), close (2), subscribe, newsletter, third, decade, climate, action, join, cookies, privacy, tech, twitter, blog, engage, training, certification, center, getting, release, notes, community, forums, sales, marketplace, easy, easytounderstand, solved, problem, solvedmyproblem, otherup, hard, hardtounderstand, incorrect, incorrectinformationorsamplecode, missing, missingtheinformationsamplesineed, otherdown, tell, noted, registered, trademark, oracle, affiliates, policies, apache, creative, commons, attribution, demos, review, ways, managing, dive, deeper, what, command, incur, until, receive, shut, effects, architectures, quickstarts, reusing, help, exceeding, quota, future, preserve, urls, selected, inside, whole, appspot, ids, lost, done, everything, deleted, caution, easiest, way, eliminate, changes, charges, clean, continue, developing, remember, restricted, rest, given, many, authenticates, securely, manages, success, look, like, navigate, handler, field, paste, bottom, pencil, beside, uri, uris, describe, value, locate, find, anytime, right, panel, clicking, pen, allowed, resolved, startup, time, recommends, pin, particular, rather, than, flags, specify, respectively, manually, authenticating, mvn, compile, dimage, maven, plugin, helper, common, optimizes, dockerfile, having, installed, building, each, names, unique, artifacts, repositories, secretaccessor, replication, versioned, postgres_16, 7680mb, root, cloud_sql_region, provisioning, yet, still, settings, top, obtain, agree, audience, displayed, emails, runtimeexception, jsonsyntaxexception, class, fromjson, gson, illegalstateexception, getenv, getconfig, environ, stored, utf8, secret_id, versions, passed, centralized, injects, integration, interact, libraries, mysql, auto, coupled, operations, querying, modifying, votecontroller, final, vars, uncomment, starter, initialized, info, description_encoding, dialect, query, drivername, socket_path, equivalent, create_engine, initializes, init_unix_connection_engine, establish, db_socket_path, connectwithunixsockets, param, sockets, connects, unauthorized, forbidden, firebaseauthexception, getuid, getinstance, firebaseauth, firebasetoken, map, verify_id_token, firebase_admin, wraps, jwt_authenticated, initializeapp, sent, something, went, wrong, please, again, submitting, reload, body, bearer, form, urlencoded, post, getidtoken, refresh, current, jwt, identify, successfully, signs, mint, capture, route, implementation, example, refer, stackdriver, library, failed, retry, check, message, welcome, logged, along, signinwithpopup, googleapis, userinfo, addscope, googleauthprovider, signin, handles, prompting, redirects, listed, always, api_key, order, holds, imports, necessary, implemented, receives, confirming, appropriately, fetches, login, welcomes, makes, diagram, being, visualize, change, directory, machine, dashboard, las, vegas, salt, lake, city, los, angeles, santiago, chile, sao, paulo, brazil, toronto, montreal, dammam, doha, zurich, switzerland, west6, frankfurt, germany, london, turin, west12, berlin, west10, warsaw, poland, melbourne, sydney, delhi, south2, jakarta, singapore, seoul, korea, northeast3, hong, kong, east2, johannesburg, africa, oregon, dallas, columbus, east5, northern, virginia, east4, carolina, iowa, mexico, tel, aviv, paris, west9, milan, west8, netherlands, belgium, madrid, southwest1, stockholm, north2, finland, north1, bangkok, southeast3, mumbai, osaka, tokyo, taiwan, meeting, availability, durability, requirements, primary, factors, where, generally, nearest, consider, together, affect, well, regional, means, runs, located, redundantly, zones, choice, chosen, contain, shouldn, production, able, predefined, granting, folders, organizations, serviceusageconsumer, consumer, serviceaccountuser, projectiamadmin, oauthconfig, identityplatform, serviceaccountcreator, cloudbuild, artifactregistry, repoadmin, ask, likely, serviceusageadmin, evaluate, real, scenarios, customers, 300, credits, workloads, before, generate, estimate, projected, eligible, trial, calculator, billable, minimal, backend, objectives, minimizes, risks, tool, term, refers, federated, workforce, federation, simplicity, acquire, however, stores, providing, valid, favorite, domestic, animal, voting, consisting, categorize, preferences, stay, organized, collections, home, known, issues, troubleshooting, errors, gke, kubernetes, vmware, tanzu, music, compliant, strategy, foundry, heroku, aws, lambda, 1st, gen, cookbook, vibe, coding, accelerated, video, transcoding, ffmpeg, batch, fine, tune, llms, hugging, face, transformers, opencv, acceleration, gemma, models, ollama, automation, servers, n8n, tracing, audit, opentelemetry, built, monitor, multi, tenant, platforms, running, untrusted, software, chain, insights, constraints, customer, encryption, keys, threat, detection, binary, armor, iap, audiences, design, mesh, restrict, endpoint, ingress, outbound, address, standard, dual, stack, ipv4, ipv6, register, ips, dns, pull, subscriptions, runners, kafka, autoscaler, scale, count, splits, background, checkpoints, stop, executions, task, parallelism, scheduled, completion, event, driven, zonal, redundancy, general, tips, grpc, routed, entries, processing, call, subscription, asynchronous, series, part, schedule, asynchronously, websocket, chat, stream, websockets, webhook, target, updates, language, minimum, autoscaling, sandboxes, port, recommender, per, performance, gradual, rollouts, frontend, proxying, nginx, session, affinity, failover, assets, cdn, mapping, compose, sources, codelabs, spanner, bigquery, net, compare, commands, install, package, containerize, shell, sveltekit, nuxt, angular, ssr, kotlin, agent, kit, streamlit, smolagents, langchain, gradio, fastapi, flask, hello, good, fit, contract, model, discover, start, skip, main,
Text of the page (random words):
owing checks to make sure that the end user has properly authenticated by providing a valid id token processes the end user s vote using its own credentials sends the vote on to cloud sql for storage a postgresql database that stores the votes for simplicity this tutorial uses google as a provider to acquire their id token users must authenticate using their user account however you can use other providers or authentication methods to sign in users when this document uses the term user account it refers to a google account or a user account managed by your identity provider and federated with workforce identity federation you use the credentials provided by your user account to sign in to the tool this service minimizes security risks by using secret manager to protect sensitive data used to connect to the cloud sql instance it also uses a least privilege service identity to secure access to the database objectives write build and deploy a service to cloud run that shows how to use identity platform to authenticate an end user to the cloud run service backend create a least privilege identity for the service to grant minimal access to google cloud resources use secret manager to handle sensitive data when connecting the cloud run service to a postgresql database costs in this document you use the following billable components of google cloud cloud build artifact registry secret manager cloud sql identity platform cloud run to generate a cost estimate based on your projected usage use the pricing calculator new google cloud users might be eligible for a free trial before you begin sign in to your google cloud account if you re new to google cloud create an account to evaluate how our products perform in real world scenarios new customers also get 300 in free credits to run test and deploy workloads in the google cloud console on the project selector page select or create a google cloud project roles required to select or create a project select a project selecting a project doesn t require a specific iam role you can select any project that you ve been granted a role on create a project to create a project you need the project creator role roles resourcemanager projectcreator which contains the resourcemanager projects create permission learn how to grant roles note if you don t plan to keep the resources that you create in this procedure create a project instead of selecting an existing project after you finish these steps you can delete the project removing all resources associated with the project go to project selector verify that billing is enabled for your google cloud project in the google cloud console on the project selector page select or create a google cloud project roles required to select or create a project select a project selecting a project doesn t require a specific iam role you can select any project that you ve been granted a role on create a project to create a project you need the project creator role roles resourcemanager projectcreator which contains the resourcemanager projects create permission learn how to grant roles note if you don t plan to keep the resources that you create in this procedure create a project instead of selecting an existing project after you finish these steps you can delete the project removing all resources associated with the project go to project selector verify that billing is enabled for your google cloud project enable the cloud run secret manager cloud sql artifact registry and cloud build apis roles required to enable apis to enable apis you need the serviceusage services enable permission if you created the project then you likely already have this permission through the owner role roles owner otherwise you can get this permission through the service usage admin role roles serviceusage serviceusageadmin learn how to grant roles enable the apis required roles to get the permissions that you need to complete the tutorial ask your administrator to grant you the following iam roles on your project artifact registry repository administrator roles artifactregistry repoadmin cloud build editor roles cloudbuild builds editor cloud run admin roles run admin cloud sql admin roles cloudsql admin create service accounts roles iam serviceaccountcreator identity platform admin roles identityplatform admin oauth config editor roles oauthconfig editor project iam admin roles resourcemanager projectiamadmin secret manager admin roles secretmanager admin service account user roles iam serviceaccountuser service usage consumer roles serviceusage serviceusageconsumer storage admin roles storage admin for more information about granting roles see manage access to projects folders and organizations you might also be able to get the required permissions through custom roles or other predefined roles note iam basic roles might also contain permissions to complete the tutorial you shouldn t grant basic roles in a production environment but you can grant them in a development or test environment set up gcloud cli defaults to configure google cloud cli with defaults for your cloud run service set your default project gcloud config set project project_id replace project_id with the name of the project you created for this tutorial configure google cloud cli for your chosen region gcloud config set run region region replace region with the supported cloud run region of your choice cloud run locations cloud run is regional which means the infrastructure that runs your cloud run services is located in a specific region and is managed by google to be redundantly available across all the zones within that region meeting your latency availability or durability requirements are primary factors for selecting the region where your cloud run services are run you can generally select the region nearest to your users but you should consider the location of the other google cloud products that are used by your cloud run service using google cloud products together across multiple locations can affect your service s latency as well as cost cloud run is available in the following regions subject to tier 1 pricing asia east1 taiwan asia northeast1 tokyo asia northeast2 osaka asia south1 mumbai india asia southeast3 bangkok europe north1 finland low co 2 europe north2 stockholm low co 2 europe southwest1 madrid low co 2 europe west1 belgium low co 2 europe west4 netherlands low co 2 europe west8 milan europe west9 paris low co 2 me west1 tel aviv northamerica south1 mexico us central1 iowa low co 2 us east1 south carolina us east4 northern virginia us east5 columbus us south1 dallas low co 2 us west1 oregon low co 2 subject to tier 2 pricing africa south1 johannesburg asia east2 hong kong asia northeast3 seoul south korea asia southeast1 singapore asia southeast2 jakarta asia south2 delhi india australia southeast1 sydney australia southeast2 melbourne europe central2 warsaw poland europe west10 berlin europe west12 turin europe west2 london uk low co 2 europe west3 frankfurt germany europe west6 zurich switzerland low co 2 me central1 doha me central2 dammam northamerica northeast1 montreal low co 2 northamerica northeast2 toronto low co 2 southamerica east1 sao paulo brazil low co 2 southamerica west1 santiago chile low co 2 us west2 los angeles us west3 salt lake city us west4 las vegas if you already created a cloud run service you can view the region in the cloud run dashboard in the google cloud console ok retrieve the code sample to retrieve the code sample for use clone the sample app repository to your local machine node js git clone https github com googlecloudplatform nodejs docs samples git alternatively you can download the sample as a zip file and extract it python git clone https github com googlecloudplatform python docs samples git alternatively you can download the sample as a zip file and extract it java git clone https github com googlecloudplatform java docs samples git alternatively you can download the sample as a zip file and extract it change to the directory that contains the cloud run sample code node js cd nodejs docs samples run idp sql python cd python docs samples run idp sql java cd java docs samples run idp sql visualize the architecture diagram shows an end user logging in through a google sign in dialog provided by identity platform and then being redirected back to cloud run with the user s identity an end user makes the first request to the cloud run server the client loads in the browser the user provides login credentials through the google sign in dialog from identity platform an alert welcomes the signed in user control is redirected back to the server the end user votes using the client which fetches an id token from identity platform and adds it to the vote request header when the server receives the request it verifies the identity platform id token confirming that the end user is appropriately authenticated then server sends the vote to cloud sql using its own credentials understand the core code the sample is implemented as client and server as described next integrate with identity platform client side code this sample uses firebase sdks to integrate with identity platform in order to sign in and manage users to connect to identity platform the client side javascript holds the reference to the project s credentials as a config object and imports the necessary firebase javascript sdks const config apikey api_key authdomain project_id firebaseapp com firebase app the core firebase sdk is always required and must be listed first script src https www gstatic com firebasejs 7 18 firebase app js script add firebase auth service script src https www gstatic com firebasejs 7 18 firebase auth js script the firebase javascript sdk handles the sign in flow by prompting the end user to sign in to their google account using a dialog window it then redirects them back to the service function signin const provider new firebase auth googleauthprovider provider addscope https www googleapis com auth userinfo email firebase auth signinwithpopup provider then result returns the signed in user along with the provider s credential console log result user displayname logged in window alert welcome result user displayname catch err console log error during sign in err message window alert sign in failed retry or check your browser logs note to capture browser logging you might want to route logs to cloud logging for an implementation example refer to stackdriver error reporting library when a user successfully signs in the client uses firebase methods to mint an id token the client adds the id token to the authorization header of its request to the server async function vote team if firebase auth currentuser retrieve jwt to identify the user to the identity platform service returns the current token if it has not expired otherwise this will refresh the token and return a new one try const token await firebase auth currentuser getidtoken const response await fetch method post headers content type application x www form urlencoded authorization bearer token body team team send application data vote if response ok const text await response text window alert text window location reload catch err console log error when submitting vote err window alert something went wrong please try again else window alert user not signed in integrate with identity platform server side code the server uses the firebase admin sdk to verify the user id token sent from the client if the provided id token has the correct format is not expired and is properly signed the method returns the decoded id token the server extracts the identity platform uid for that user node js const firebase require firebase admin initialize firebase admin sdk firebase initializeapp extract and verify id token from header const authenticatejwt req res next const authheader req headers authorization if authheader const token authheader split 1 if the provided id token has the correct format is not expired and is properly signed the method returns the decoded id token firebase auth verifyidtoken token then decodedtoken const uid decodedtoken uid req uid uid next catch err req logger error error with authentication err return res sendstatus 403 else return res sendstatus 401 python def jwt_authenticated func callable int callable int use the firebase admin sdk to parse authorization header to verify the user id token the server extracts the identity platform uid for that user wraps func def decorated_function args a kwargs a a header request headers get authorization none if header token header split 1 try decoded_token firebase_admin auth verify_id_token token except exception as e logger exception e return response status 403 response f error with authentication e else return response status 401 request uid decoded_token uid return func args kwargs return decorated_function java extract and verify id token from header private string authenticatejwt map string string headers string authheader headers get authorization null headers get authorization headers get authorization if authheader null string idtoken authheader split 1 if the provided id token has the correct format is not expired and is properly signed the method returns the decoded id token try firebasetoken decodedtoken firebaseauth getinstance verifyidtoken idtoken string uid decodedtoken getuid return uid catch firebaseauthexception e logger error error with authentication e tostring throw new responsestatusexception httpstatus forbidden e else logger error error no authorization header throw new responsestatusexception httpstatus unauthorized connect the server to cloud sql the server connects to the cloud sql instance unix domain socket using the format cloudsql cloud_sql_connection_name node js connect to the cloud sql instance through unix sockets param object credconfig the cloud sql connection configuration from secret manager returns object knex s postgresql client const connectwithunixsockets async credconfig const dbsocketpath process env db_socket_path cloudsql establish a connection to the database return knex client pg connection user credconfig db_user e g my user password credconfig db_password e g my user password database credconfig db_name e g my database host dbsocketpath credconfig cloud_sql_connection_name config python def init_unix_connection_engine db_config dict str int sqlalchemy engine base engine initializes a unix socket connection pool for a cloud sql instance of postgresql args db_config a dictionary with connection pool config returns a sqlalchemy engine instance creds credentials get_cred_config db_user creds db_user db_pass creds db_password db_name creds db_name db_socket_dir creds get db_socket_dir cloudsql cloud_sql_connection_name creds cloud_sql_connection_name pool sqlalchemy create_engine equivalent url postgres pg8000 db_user db_pass db_name unix_sock socket_path cloud_sql_instance_name s pgsql 5432 sqlalchemy engine url u...
|
