Home / server / Questions / 1079480
In Process
MariusPontmercy
Asked: 2021-10-05 02:41:19 +0800 CST

IAP with Google Identity Platform throws "Failed to fetch the discovery document from issuer"

  • 772

I have activated Identity Aware Proxy on a GCP Load Balancer and configured it to authenticate the users against my OIDC Identity Provider (Auth0) through Google Identity Platform with a default login page hosted on Cloud Run.

When I browse my application I got redirected to the login page but then this happens:

Failed to fetch the discovery document from issuer

although the document is available and publicly reachable at that URL:

Auth0 discovery document

I followed GCP documentation step by step and cannot find any troubleshooting guide. Any thoughts?

Thanks

google-cloud-platform cloud openid google-iam

1 Answers

  1. Ok, solved.

    The problem was I had configured my Google Identity Platform OIDC Provider with the full metadata document URL

    wrong URL

    while only the issuer base URL was expected

    right URL

    Newbie mistake, I know, but the error message is misleading, IMO, because it reports the URL where the document actually is. If the returned message had been

    Failed to fetch the discovery document from issuer: https://REDACTED.eu.auth0.com/.well-known/openid-configuration/.well-known/openid-configuration

    the misconfiguration would have been immediately apparent.

    • 0