We are troubleshooting Google Cloud Run direct Identity-Aware Proxy (IAP) authentication using a custom OAuth Web client in a standalone Google Cloud project without an Organization.
Expected behavior:
The authorized Google account completes OAuth authentication and reaches the Cloud Run application login page. Other users remain denied.
Actual behavior:
After successful Google account selection and OAuth consent, IAP returns:
Error Code 11 — There was a problem with your request.
The request never reaches the Cloud Run application.
Configuration:
-
Region: asia-southeast1 (Singapore)
-
Cloud Run revision: Ready
-
Direct Cloud Run IAP: Enabled
-
Public unauthenticated access: Disabled
-
IAP authorization: One approved Google identity
-
OAuth audience: External / Testing
-
OAuth test users: Authorized account included
-
OAuth client: Web application
-
Redirect URI: Verified against the required IAP callback
-
Service-level custom OAuth credentials: Configured
-
No conflicting project-level OAuth settings identified
Troubleshooting completed:
-
Confirmed Cloud Run revision is ready.
-
Verified IAP redirects to Google OAuth rather than the original HTTP 502.
-
Verified the configured OAuth client ID and redirect URI.
-
Added the approved Google account as the OAuth test user.
-
Completed OAuth consent successfully.
-
Tested using a fresh private browser session.
-
Rotated the OAuth client secret once and securely rebound it to IAP.
-
Verified effective IAP settings and secret fingerprint.
-
Confirmed the same Error 11 persists after rotation.
-
Confirmed that the existing direct Cloud Run Console interface does not expose Auto Generate Credentials without a configuration change/redeployment.
Questions:
-
What additional diagnostics can identify why IAP rejects the OAuth client configuration after successful consent?
-
Is there a supported method to repair the service-level OAuth binding without disabling IAP, exposing the service publicly or redeploying Cloud Run?
-
Are there any known restrictions or configuration requirements for External custom OAuth clients used with direct Cloud Run IAP in standalone projects?
We would appreciate guidance on the minimum secure remediation. We can provide sanitized configuration and error evidence if required.
No client secrets, authentication tokens or private employee data are included in this report.
