<p>I have the a use case where I need to integrate two different service using a fanout ingress (different path). I decide to do so because both services is actually related so I don't want to separate the domain. Another reason is I don't want to use another ingress. However, this problem arises, I understand that once I activate Google IAP, a new clientId and secretId will be created. And the redirect javascript url should be a domain (doesn't include any path or in it's wildcard form). </p>

<p>I'm tring to access https://{my-domain}/{some-path}. It turns out I got the following error.</p>

<ol start="400">
<li>That’s an error.</li>
</ol>

<p>Error: redirect_uri_mismatch</p>

<blockquote>
  <p>The redirect URI in the request,
  https://{my-domain}/_gcp_gatekeeper/authenticate, does not match the
  ones authorized for the OAuth client. To update the authorized
  redirect URIs, visit:
  <a href="https://console.developers.google.com/apis/credentials/oauthclient/" rel="nofollow noreferrer">https://console.developers.google.com/apis/credentials/oauthclient/</a></p>
</blockquote>

<p>This is my ingress config:</p>

<pre><code>apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  annotations:
    kubernetes.io/ingress.allow-http: "false"
    kubernetes.io/ingress.global-static-ip-name: &lt;some-static-ip&gt;
  name: &lt;name&gt;
  namespace: &lt;namespace&gt;
spec:
  backend:
    serviceName: &lt;service-1&gt;
    servicePort: &lt;port-of-service-1&gt;
  rules:
  - http:
      paths:
      - backend:
          serviceName: &lt;service-2&gt;
          servicePort: &lt;port-of-service-2&gt;
        path: /&lt;some-path&gt;/*
  tls:
  - secretName: &lt;secret-name&gt;
</code></pre>

<p>However when I tried to access my 1st service it just fine and works as expected.</p>

<p>Just wondering if it's possible to create IAP for two different backend services using the same ingress. I don't manage to find more about this tho. Thanks!</p>

<p>Best,</p>

<p>After I read this:</p>

<ol>
<li><a href="https://cloud.google.com/iap/docs/reference/compute-engine-apis#set_iap_properties_by_updating" rel="nofollow noreferrer">https://cloud.google.com/iap/docs/reference/compute-engine-apis#set_iap_properties_by_updating</a></li>
<li><a href="https://cloud.google.com/kubernetes-engine/docs/concepts/backendconfig" rel="nofollow noreferrer">https://cloud.google.com/kubernetes-engine/docs/concepts/backendconfig</a></li>
<li><a href="https://cloud.google.com/iap/docs/enabling-kubernetes-howto" rel="nofollow noreferrer">https://cloud.google.com/iap/docs/enabling-kubernetes-howto</a></li>
</ol>

<p>I realize that I just need to enable IAP for my second service and then override the value of clientId and secretId of my 2nd service by the value provided by IAP config for my 1st service. Go to your IAP console:</p>

<pre><code>kubectl create secret generic backend-config-secret --namespace {namespace}  \
--from-literal=client_id=client_id_key  \
    --from-literal=client_secret=client_secret_key
</code></pre>

<p>Create your BackendConfig:</p>

<pre><code>apiVersion: cloud.google.com/v1beta1
kind: BackendConfig
metadata:
  name: {name}
  namespace: {namespace}
spec:
  iap:
    enabled: true
    oauthclientCredentials:
      secretName: backend-config-secret
</code></pre>

<p>Add this to your service:</p>

<pre><code>beta.cloud.google.com/backend-config: '{"default": "{name}"}'
</code></pre>
