Behind Google Cloud Identity-Aware Proxy

[ghost]

Hello,

Our Gerrit server is running behind Google Cloud Identity-Aware Proxy and it works well.

But the only issue is that a user has to click Sign In in Gerrit home page in order to do an actual sign-in to Gerrit. People is usually confused because they think they already signed-in Gerrit when he/she signed in Google Cloud IAP.

Is there any way to sign-in (or sign-up) automatically?

Thanks,

[ghost]

And also web session seems to be expired after 1 hour, but I'm not sure whether Google IAP causes it.

[davido]

Can you try without IAP ro confirm that session expiration issue is related to IAP? Refresh access token is not implemented: [1].

[1] https://developers.google.com/identity/protocols/OAuth2WebServer#offline

[ghost]

Yes, I tried without IAP and it works fine. It looks like IAP causes this issue.
IAP session is valid only for one hour and it also seems to work when I tried 'refreshing': [1].

Currently I'm just using IAP in order to restrict access not just by domain, but also by a list of emails (via Google group).

[1] https://cloud.google.com/iap/docs/special-urls-howto#refreshing_user_sessions