从具有访问限制的 GCS 服务 static 页面
[英]Serving static page from GCS with access restrictions
问题描述
I'm serving a static page on google cloud storage.
我在谷歌云存储上提供一个 static 页面。 It works perfectly well, as long as it is public.只要它是公开的，它就可以很好地工作。 Now i setted up acl so that only users of one group can read the storage and unauthenticated users get redirected to google authentication.现在我设置了 acl，这样只有一组用户才能读取存储，而未经身份验证的用户将被重定向到谷歌身份验证。 The Problem is now, that the static content of the website, like javascript and css can't be found anymore and i get 404 Errors there.现在的问题是，网站的 static 内容，如 javascript 和 css 再也找不到了，我在那里收到 404 错误。 The static content is as well in the storage bucket and it works fine with public urls. static 内容也在存储桶中，并且可以与公共 URL 一起正常工作。 When using authenticated urls, it does not work anymore.使用经过身份验证的网址时，它不再起作用。
Is my attempt of serving an access controlled page right?我提供访问控制页面的尝试是否正确？ I guess so, because it works, except for the static content.我猜是这样，因为它有效，除了 static 内容。 So do you have any ideas what i am missing here?那么你知道我在这里缺少什么吗？
2 个解决方案
解决方案1
3 2020-11-15 12:58:56
Try to deploy on App Engine you file.尝试在您提交的 App Engine 上部署。 For this为了这
- In the same root directory of your static file, create a
app.yamlfile with this content在 static 文件的同一根目录中，使用此内容创建一个app.yaml文件
runtime: nodejs10
env: standard
instance_class: F1
handlers:
- url: /
static_files: index.html
require_matching_file: false
upload: index.html
- url: /(.*)
static_files: /\1
require_matching_file: false
upload: /.*
- url: .*
script: auto
- Deploy on App Engine
gcloud app deploy在 App Engine 上gcloud app deploy - Check if it works on the provided URL.检查它是否适用于提供的 URL。
If so:如果是这样：
- Go to Security -> Identity Aware Proxy (IAP) Go 到安全 -> 身份感知代理 (IAP)
- Activate IAP for App Engine;为 App Engine 激活 IAP； It's possible that the OAuth consent screen have to be configured at this step is you don't do it before可能必须在此步骤配置 OAuth 同意屏幕，如果您之前没有这样做
- Select the checkbox on the left of your root service, and go the the info panel on the right of the page Select 根服务左侧的复选框，go 页面右侧的信息面板
- Add members, groups or domain with the role
IAP-secured Web app user添加角色为IAP-secured Web app user的成员、组或域
Test and enjoy!测试并享受！
解决方案2
2 2020-11-23 17:26:38
You can use the following workaround to add user authentication to your GCS static pages based on buckets.您可以使用以下解决方法将用户身份验证添加到基于存储桶的 GCS static 页面。
First you need to create a public file called redirect.html this file will be the entry point of your static webpage, and you need to add the following content首先你需要创建一个名为redirect.html的public文件，这个文件将作为你static网页的入口，你需要添加以下内容
<html>
<head>
<meta http-equiv="Refresh" content="0; url=https://storage.cloud.google.com/[yourbucketname]/index.html">
</head>
Redirecting to your site..
index.html and other files must be private files with read permissions granted to selected users index.html和其他文件必须是私有文件，并授予选定用户读取权限
The magic behind this is that your browser will prompt to choose a google account, in case that your browser doesn't have any active google account.这背后的神奇之处在于，如果您的浏览器没有任何活动的谷歌帐户，您的浏览器会提示选择一个谷歌帐户。
And only the users with Reader permission (or with other roles with read access) will access to your static website.并且只有具有读者权限（或具有读取权限的其他角色）的用户才能访问您的 static 网站。
Just a friendly reminder, this will take the main Google account in the browser if your browser have more than 1 Google account this can cause authentication issues, if this happens use an incognito window.友情提醒，如果您的浏览器有超过 1 个 Google 帐户，这将使用浏览器中的主要 Google 帐户，这可能会导致身份验证问题，如果发生这种情况，请使用隐身 window。
you can find more information on this Medium article您可以在这篇Medium 文章中找到更多信息
Extra step额外的步骤
If you have enabled Data access logs this workaround will thrown some authentication issues, you need to add exceptions to the users that will use the authenticated site如果您启用了数据访问日志，此解决方法将引发一些身份验证问题，您需要为将使用经过身份验证的站点的用户添加例外
To do this, in Cloud Console, navigate to IAM & Admin > Audit Logs .为此，请在 Cloud Console 中导航至IAM & Admin > Audit Logs 。 Look through the list or filter for Google Cloud Storage .查看列表或过滤器以查找Google Cloud Storage 。 Click on the row.单击该行。
In the info panel on the right side, on the Exempted Users tab , click Add Exempted User.在右侧信息面板的免除用户选项卡上，单击添加免除用户。
声明:本站的技术帖子网页，遵循CC BY-SA 4.0协议，如果您需要转载，请注明本站网址或者原文地址。任何问题请咨询:yoyou2525@163.com.