[[["易于理解","easyToUnderstand","thumb-up"],["解决了我的问题","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["很难理解","hardToUnderstand","thumb-down"],["信息或示例代码不正确","incorrectInformationOrSampleCode","thumb-down"],["没有我需要的信息/示例","missingTheInformationSamplesINeed","thumb-down"],["翻译问题","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["最后更新时间 (UTC)：2025-08-18。"],[[["\u003cp\u003eIdentity-Aware Proxy (IAP) enables access management for HTTP-based applications outside of Google Cloud, including on-premises apps in your data centers.\u003c/p\u003e\n"],["\u003cp\u003eThe IAP On-Prem Connector uses a Cloud Deployment Manager template to establish the necessary resources for hosting and deploying the connector within a Google Cloud project.\u003c/p\u003e\n"],["\u003cp\u003eIAP On-Prem Connector creates a Cloud Service Mesh deployment acting as a proxy, an external Application Load Balancer serving as the ingress controller, and routing rules to forward authenticated requests.\u003c/p\u003e\n"],["\u003cp\u003eIAP secures on-premises apps using identity and context-based IAM access policies, allowing for different access controls for multiple on-premises apps within a single Google Cloud project.\u003c/p\u003e\n"],["\u003cp\u003eRouting rules in the IAP connector deployment define how authenticated web requests are routed from your DNS hostname ingress point to the destination DNS hostname of the on-premises application.\u003c/p\u003e\n"]]],[],null,["# Overview of IAP for on-premises apps\n\n[Identity-Aware Proxy (IAP)](/iap/docs/concepts-overview) allows\nyou to manage access to HTTP-based apps outside of\nGoogle Cloud. This includes apps on-premises in your enterprise's data centers.\n\nTo learn how to secure\non-premises apps with IAP, see\n[Setting up IAP for on-premises apps](/iap/docs/enabling-on-prem-howto).\n\nIntroduction\n------------\n\nIAP targets on-premises apps with the [IAP\nOn-Prem Connector](https://cloud.google.com/iap/docs/enabling-on-prem-howto). The On-Prem Connector uses a [Cloud Deployment Manager](/deployment-manager/docs)\ntemplate to create the resources needed to host and deploy the\nIAP On-Prem Connector into an IAP-enabled\nGoogle Cloud project,\nforwarding authenticated and authorized requests to on-premises\napps.\n\nThe On-Prem Connector\ncreates the following resources:\n\n- A [Cloud Service Mesh](https://cloud.google.com/traffic-director/docs/overview) deployment that acts as a proxy for the on-premises app.\n- An [external Application Load Balancer](https://cloud.google.com/load-balancing/docs/https/) that acts as the ingress controller for requests.\n- Routing rules.\n\nA deployment can have multiple Cloud Service Mesh\nbackend services that run behind one external Application Load Balancer. Each backend service\nmaps to an individual on-premises app.\n\nWhen the IAP on-prem connector is deployed and IAP is enabled for the newly created on-prem connector backend service, IAP\nsecures your app with identity\nand [context based](/iap/docs/cloud-iap-context-aware-access-howto)\nIdentity and Access Management (IAM) access policies. Because an IAM\naccess policy is configured on the backend service\nresource level, you're able to have different access control lists for each of\nyour on-premises apps. This means only one Google Cloud\nproject is needed to manage access to multiple on-premises apps.\n\nHow IAP for on-premises apps works\n----------------------------------\n\nWhen a request is sent to an app hosted on Google Cloud,\nIAP authenticates and authorizes the user requests.\nIt then grants the user access to the Google Cloud app.\n\nWhen a request is sent to an on-premises app, IAP\nauthenticates and authorizes the user request. It then routes the request to\nthe IAP on-prem connector. The IAP on-prem connector\nforwards the request through a [Hybrid Connectivity Network Endpoint Group](https://cloud.google.com/load-balancing/docs/negs#hybrid-neg)\nfrom Google Cloud to the on-premises network.\n\nThe following diagram shows the high-level traffic flow of a web request for a\nGoogle Cloud app (**app1** ) and an on-premises app (**app2**).\n\nRouting rules\n-------------\n\nWhen configuring a IAP connector deployment,\nyou configure the routing rules. These rules route authenticated and authorized\nweb requests coming to your DNS hostname ingress point to the DNS hostname\nthat's the destination.\n\nThe following is an example of `routing` parameters defined for a\nIAP connector Deployment Manager\ntemplate. \n\n```yaml\n routing:\n - name: hr\n mapping:\n - name: host\n source: www.hr-domain.com\n destination: hr-internal.domain.com\n - name: sub\n source: sheets.hr-domain.com\n destination: sheets.hr-internal.domain.com\n - name: finance\n mapping:\n - name: host\n source: www.finance-domain.com\n destination: finance-internal.domain.com\n```\n\n- Each `routing` name corresponds to a new, Ambassador-created Compute Engine backend service resource.\n- The `mapping` parameter specifies a list of Ambassador routing rules for a backend service.\n- The `source` of a routing rule is mapped to a `destination`, where `source` is the URL of requests coming to Google Cloud, and `destination` is the URL for your on-premises app that IAP routes traffic to after a user has been authorized and authenticated.\n\nThe following table demonstrates example rules to route incoming requests from\n`www.hr-domain.com` to `hr-internal.domain.com`:\n\nWhat's next\n-----------\n\n- Learn how to [secure on-premises apps with IAP](/iap/docs/enabling-on-prem-howto).\n- Learn more about [how IAP works](/iap/docs/concepts-overview)."]]
