<p>I have an application that has react in the front-end and a node service in the back-end. The app is deployed in the GKE cluster. Both the apps are exposed as a NodePort Service, and the fan out ingress path is done as follows :</p>
<pre><code>- host: example.com
   http:
     paths:
     - backend:
         serviceName: frontend-service
         servicePort: 3000
       path: /*
     - backend:
         serviceName: backend-service
         servicePort: 5000
       path: /api/*
</code></pre>
<p>I have enabled authentication using IAP for both services. When enabling IAP for both the kubernetes services, new Client Id and Client Secret is created individually. But I need to provide authentication for the back-end API from the front-end, since they have 2 different accounts, its not possible, i.e when I call the back-end API service from the front-end the authentication fails because the cookies provided from the FE does not match in the back-end service.</p>
<p>What is the best way to handle this scenario. Is there a way to use the same client credentials for both these services and if so, Is that the right way to do it or Is there a way to authenticate the Rest API using IAP directly.</p>

<p>If IAP is setup using BackendConfig, then you can have two separate BackendConfig objects for frontend and backend applications but both of them use the same secrete (secretName) for oauthclientCredentials.</p>
<p><em><strong>For frontend app</strong></em></p>
<pre><code>apiVersion: cloud.google.com/v1beta1
kind: BackendConfig
metadata:
  name:  frontend-iap-config
  namespace: namespace-1
spec:
  iap:
    enabled: true
    oauthclientCredentials:
      secretName: common-iap-oauth-credentials
</code></pre>
<p><em><strong>For backend app</strong></em></p>
<pre><code>apiVersion: cloud.google.com/v1beta1
kind: BackendConfig
metadata:
  name:  backend-iap-config
  namespace: namespace-1
spec:
  iap:
    enabled: true
    oauthclientCredentials:
      secretName: common-iap-oauth-credentials
</code></pre>
<p>Then refer these BackendConfigs from respective kubernetes service objects</p>
