Identity-Aware Proxy (IAP) in Java

Introduction

Identity-Aware Proxy (IAP) is a security layer that provides centralized authentication and authorization for applications. In Java, IAP enables secure access control without modifying application code by leveraging context-aware security policies.

Architecture Overview

1. IAP Integration Architecture

User Request → IAP → Authentication → Authorization → Java Application ↓ ↓ ↓ ↓ ↓ Browser Google IAP OAuth/SSO Context Policies Business Logic ↓ ↓ ↓ ↓ ↓ HTTPS JWT Token User Identity Access Control @Secure

Setup and Dependencies

1. Maven Dependencies

<properties> <spring-boot.version>3.1.0</spring-boot.version> <google-cloud.version>2.28.0</google-cloud.version> <nimbus-jose.version>9.31</nimbus-jose.version> </properties> <dependencies> <!-- Spring Boot --> <dependency> <groupId>org.springframework.boot</groupId> <artifactId>spring-boot-starter-web</artifactId> <version>${spring-boot.version}</version> </dependency> <dependency> <groupId>org.springframework.boot</groupId> <artifactId>spring-boot-starter-security</artifactId> <version>${spring-boot.version}</version> </dependency> <!-- Google Cloud IAP --> <dependency> <groupId>com.google.cloud</groupId> <artifactId>google-cloud-iap</artifactId> <version>2.28.0</version> </dependency> <!-- JWT Libraries --> <dependency> <groupId>com.nimbusds</groupId> <artifactId>nimbus-jose-jwt</artifactId> <version>${nimbus-jose.version}</version> </dependency> <!-- OAuth2 Client --> <dependency> <groupId>org.springframework.boot</groupId> <artifactId>spring-boot-starter-oauth2-client</artifactId> <version>${spring-boot.version}</version> </dependency> <!-- Spring Security OAuth2 Resource Server --> <dependency> <groupId>org.springframework.boot</groupId> <artifactId>spring-boot-starter-oauth2-resource-server</artifactId> <version>${spring-boot.version}</version> </dependency> <!-- Servlet API for request wrappers --> <dependency> <groupId>jakarta.servlet</groupId> <artifactId>jakarta.servlet-api</artifactId> <version>6.0.0</version> <scope>provided</scope> </dependency> </dependencies>

Core IAP Implementation

1. IAP Configuration Properties

@Configuration @ConfigurationProperties(prefix = "iap") @Data @Validated public class IapProperties { @NotNull private GoogleCloudConfig googleCloud = new GoogleCloudConfig(); @NotNull private SecurityConfig security = new SecurityConfig(); @NotNull private JwtConfig jwt = new JwtConfig(); @Data public static class GoogleCloudConfig { private String projectNumber; private String projectId; private String backendServiceId; private String audience; } @Data public static class SecurityConfig { private boolean enabled = true; private boolean requireIap = true; private List<String> allowedDomains = new ArrayList<>(); private List<String> excludedPaths = List.of("/health", "/info", "/public/**"); private String redirectUrl = "/login"; } @Data public static class JwtConfig { private String issuer = "https://cloud.google.com/iap"; private String headerName = "x-goog-iap-jwt-assertion"; private String publicKeyUrl = "https://www.gstatic.com/iap/verify/public_key"; private long clockSkewSeconds = 300; } }

2. IAP JWT Token Verifier

@Service @Slf4j public class IapTokenVerifier { private final IapProperties iapProperties; private final JwtDecoder jwtDecoder; private final ObjectMapper objectMapper; public IapTokenVerifier(IapProperties iapProperties, ObjectMapper objectMapper) { this.iapProperties = iapProperties; this.objectMapper = objectMapper; this.jwtDecoder = createJwtDecoder(); } /** * Verify IAP JWT token and extract user identity */ public IapUserIdentity verifyToken(String jwtToken) { try { Jwt jwt = jwtDecoder.decode(jwtToken); // Validate token claims validateTokenClaims(jwt); // Extract user identity return extractUserIdentity(jwt); } catch (Exception e) { log.error("IAP token verification failed", e); throw new IapAuthenticationException("Token verification failed", e); } } /** * Verify token from HTTP request headers */ public IapUserIdentity verifyRequest(HttpServletRequest request) { String jwtToken = extractTokenFromRequest(request); if (jwtToken == null) { throw new IapAuthenticationException("IAP JWT token not found in request"); } return verifyToken(jwtToken); } /** * Validate token without throwing exception */ public boolean isValidToken(String jwtToken) { try { verifyToken(jwtToken); return true; } catch (IapAuthenticationException e) { return false; } } private JwtDecoder createJwtDecoder() { return NimbusJwtDecoder.withJwkSetUri(iapProperties.getJwt().getPublicKeyUrl()).build(); } private void validateTokenClaims(Jwt jwt) { String issuer = jwt.getIssuer().toString(); String audience = getAudienceClaim(jwt); String expectedAudience = iapProperties.getGoogleCloud().getAudience(); // Validate issuer if (!iapProperties.getJwt().getIssuer().equals(issuer)) { throw new IapAuthenticationException("Invalid token issuer: " + issuer); } // Validate audience if (expectedAudience != null && !expectedAudience.equals(audience)) { throw new IapAuthenticationException("Invalid token audience: " + audience); } // Validate expiration Instant expiration = jwt.getExpiresAt(); if (expiration != null && expiration.isBefore(Instant.now())) { throw new IapAuthenticationException("Token has expired"); } log.debug("IAP token validation successful for user: {}", getEmailClaim(jwt)); } private IapUserIdentity extractUserIdentity(Jwt jwt) { return IapUserIdentity.builder() .id(getSubjectClaim(jwt)) .email(getEmailClaim(jwt)) .name(getClaimAsString(jwt, "name")) .picture(getClaimAsString(jwt, "picture")) .hd(getClaimAsString(jwt, "hd")) // hosted domain .issuer(jwt.getIssuer().toString()) .audience(getAudienceClaim(jwt)) .issuedAt(jwt.getIssuedAt()) .expiresAt(jwt.getExpiresAt()) .claims(jwt.getClaims()) .build(); } private String extractTokenFromRequest(HttpServletRequest request) { // Check IAP-specific header first String token = request.getHeader(iapProperties.getJwt().getHeaderName()); // Fallback to Authorization header if (token == null) { String authHeader = request.getHeader("Authorization"); if (authHeader != null && authHeader.startsWith("Bearer ")) { token = authHeader.substring(7); } } return token; } // Helper methods to extract claims private String getSubjectClaim(Jwt jwt) { return jwt.getSubject(); } private String getEmailClaim(Jwt jwt) { return getClaimAsString(jwt, "email"); } private String getAudienceClaim(Jwt jwt) { Object audience = jwt.getClaims().get("aud"); if (audience instanceof String) { return (String) audience; } else if (audience instanceof List) { @SuppressWarnings("unchecked") List<String> audiences = (List<String>) audience; return audiences.get(0); // Return first audience } return null; } private String getClaimAsString(Jwt jwt, String claimName) { Object claimValue = jwt.getClaims().get(claimName); return claimValue != null ? claimValue.toString() : null; } } @Data @Builder @NoArgsConstructor @AllArgsConstructor public class IapUserIdentity { private String id; private String email; private String name; private String picture; private String hd; // hosted domain private String issuer; private String audience; private Instant issuedAt; private Instant expiresAt; private Map<String, Object> claims; public String getDomain() { if (email != null && email.contains("@")) { return email.substring(email.indexOf('@') + 1); } return null; } public boolean isFromDomain(String domain) { return domain != null && domain.equals(getDomain()); } }

Spring Security Integration

1. IAP Security Configuration

@Configuration @EnableWebSecurity @EnableMethodSecurity(prePostEnabled = true) @Slf4j public class IapSecurityConfig { private final IapProperties iapProperties; private final IapTokenVerifier iapTokenVerifier; public IapSecurityConfig(IapProperties iapProperties, IapTokenVerifier iapTokenVerifier) { this.iapProperties = iapProperties; this.iapTokenVerifier = iapTokenVerifier; } @Bean public SecurityFilterChain filterChain(HttpSecurity http) throws Exception { http .csrf(csrf -> csrf.disable()) .sessionManagement(session -> session.sessionCreationPolicy(SessionCreationPolicy.STATELESS)) .authorizeHttpRequests(authz -> authz .requestMatchers(getExcludedPaths()).permitAll() .anyRequest().authenticated() ) .oauth2ResourceServer(oauth2 -> oauth2 .jwt(jwt -> jwt.jwtAuthenticationConverter(iapJwtAuthenticationConverter())) ) .addFilterBefore(iapAuthenticationFilter(), BasicAuthenticationFilter.class) .exceptionHandling(exceptions -> exceptions .authenticationEntryPoint(iapAuthenticationEntryPoint()) ); return http.build(); } @Bean public IapAuthenticationFilter iapAuthenticationFilter() { return new IapAuthenticationFilter(iapTokenVerifier, iapProperties); } @Bean public IapAuthenticationEntryPoint iapAuthenticationEntryPoint() { return new IapAuthenticationEntryPoint(); } @Bean public Converter<Jwt, AbstractAuthenticationToken> iapJwtAuthenticationConverter() { return new IapJwtAuthenticationConverter(); } @Bean public IapSecurityContextRepository iapSecurityContextRepository() { return new IapSecurityContextRepository(iapTokenVerifier); } private String[] getExcludedPaths() { List<String> excludedPaths = iapProperties.getSecurity().getExcludedPaths(); return excludedPaths.toArray(new String[0]); } } @Component @Slf4j public class IapAuthenticationFilter extends OncePerRequestFilter { private final IapTokenVerifier iapTokenVerifier; private final IapProperties iapProperties; public IapAuthenticationFilter(IapTokenVerifier iapTokenVerifier, IapProperties iapProperties) { this.iapTokenVerifier = iapTokenVerifier; this.iapProperties = iapProperties; } @Override protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain filterChain) throws ServletException, IOException { // Skip IAP authentication for excluded paths if (isExcludedPath(request)) { filterChain.doFilter(request, response); return; } try { // Verify IAP token and extract user identity IapUserIdentity userIdentity = iapTokenVerifier.verifyRequest(request); // Create authentication token IapAuthenticationToken authentication = new IapAuthenticationToken(userIdentity); // Set security context SecurityContextHolder.getContext().setAuthentication(authentication); log.debug("IAP authentication successful for user: {}", userIdentity.getEmail()); } catch (IapAuthenticationException e) { log.warn("IAP authentication failed: {}", e.getMessage()); if (iapProperties.getSecurity().isRequireIap()) { SecurityContextHolder.clearContext(); throw e; } // If IAP is not required, continue without authentication } filterChain.doFilter(request, response); } private boolean isExcludedPath(HttpServletRequest request) { String path = request.getServletPath(); return iapProperties.getSecurity().getExcludedPaths().stream() .anyMatch(excludedPath -> { if (excludedPath.endsWith("/**")) { String basePath = excludedPath.substring(0, excludedPath.length() - 3); return path.startsWith(basePath); } return path.equals(excludedPath); }); } } @Component public class IapJwtAuthenticationConverter implements Converter<Jwt, AbstractAuthenticationToken> { @Override public AbstractAuthenticationToken convert(Jwt jwt) { IapUserIdentity userIdentity = extractUserIdentity(jwt); return new IapAuthenticationToken(userIdentity); } private IapUserIdentity extractUserIdentity(Jwt jwt) { return IapUserIdentity.builder() .id(jwt.getSubject()) .email(jwt.getClaimAsString("email")) .name(jwt.getClaimAsString("name")) .picture(jwt.getClaimAsString("picture")) .hd(jwt.getClaimAsString("hd")) .issuer(jwt.getIssuer().toString()) .audience(jwt.getClaimAsString("aud")) .issuedAt(jwt.getIssuedAt()) .expiresAt(jwt.getExpiresAt()) .claims(jwt.getClaims()) .build(); } } @Component @Slf4j public class IapAuthenticationEntryPoint implements AuthenticationEntryPoint { @Override public void commence(HttpServletRequest request, HttpServletResponse response, AuthenticationException authException) throws IOException { log.warn("Authentication required for: {} - {}", request.getRequestURI(), authException.getMessage()); response.setStatus(HttpServletResponse.SC_UNAUTHORIZED); response.setContentType("application/json"); Map<String, Object> errorResponse = new HashMap<>(); errorResponse.put("timestamp", Instant.now().toString()); errorResponse.put("status", HttpServletResponse.SC_UNAUTHORIZED); errorResponse.put("error", "Unauthorized"); errorResponse.put("message", "IAP authentication required"); errorResponse.put("path", request.getRequestURI()); if (authException instanceof IapAuthenticationException iapException) { errorResponse.put("details", iapException.getMessage()); } ObjectMapper objectMapper = new ObjectMapper(); response.getWriter().write(objectMapper.writeValueAsString(errorResponse)); } } public class IapAuthenticationToken extends AbstractAuthenticationToken { private final IapUserIdentity userIdentity; public IapAuthenticationToken(IapUserIdentity userIdentity) { super(Collections.emptyList()); this.userIdentity = userIdentity; setAuthenticated(true); } @Override public Object getCredentials() { return null; // Credentials are handled by IAP } @Override public Object getPrincipal() { return userIdentity; } public IapUserIdentity getUserIdentity() { return userIdentity; } } @Component @Slf4j public class IapSecurityContextRepository implements SecurityContextRepository { private final IapTokenVerifier iapTokenVerifier; public IapSecurityContextRepository(IapTokenVerifier iapTokenVerifier) { this.iapTokenVerifier = iapTokenVerifier; } @Override public SecurityContext loadContext(HttpRequestResponseHolder requestResponseHolder) { return SecurityContextHolder.createEmptyContext(); } @Override public void saveContext(SecurityContext context, HttpServletRequest request, HttpServletResponse response) { // Stateless - no context saving needed } @Override public boolean containsContext(HttpServletRequest request) { try { iapTokenVerifier.verifyRequest(request); return true; } catch (IapAuthenticationException e) { return false; } } }

Authorization and Access Control

1. Context-Aware Authorization Service

@Service @Slf4j public class IapAuthorizationService { private final IapProperties iapProperties; private final AccessPolicyRepository accessPolicyRepository; public IapAuthorizationService(IapProperties iapProperties, AccessPolicyRepository accessPolicyRepository) { this.iapProperties = iapProperties; this.accessPolicyRepository = accessPolicyRepository; } /** * Check if user has access to the resource */ public boolean hasAccess(IapUserIdentity user, HttpServletRequest request) { String path = request.getRequestURI(); String method = request.getMethod(); // Check domain restrictions if (!isDomainAllowed(user)) { log.warn("Domain not allowed for user: {} from domain: {}", user.getEmail(), user.getDomain()); return false; } // Check access policies AccessPolicy policy = accessPolicyRepository.findPolicyForPath(path); if (policy != null) { return evaluateAccessPolicy(user, policy, method); } // Default: allow access if authenticated return true; } /** * Check if user has specific role */ public boolean hasRole(IapUserIdentity user, String role) { // Extract roles from claims or external source List<String> userRoles = extractUserRoles(user); return userRoles.contains(role); } /** * Check if user has permission for specific action */ public boolean hasPermission(IapUserIdentity user, String resource, String action) { Permission permission = Permission.builder() .resource(resource) .action(action) .build(); return evaluatePermission(user, permission); } /** * Get user's accessible resources */ public List<String> getAccessibleResources(IapUserIdentity user) { return accessPolicyRepository.findAccessibleResources(user); } /** * Context-aware access check with additional context */ public boolean hasAccessWithContext(IapUserIdentity user, AccessContext context) { // Implement context-aware access logic // Consider time, location, device, etc. // Time-based access if (context.getAccessTime() != null && !isWithinAccessHours(context.getAccessTime())) { return false; } // Location-based access if (context.getUserLocation() != null && !isAllowedLocation(context.getUserLocation())) { return false; } // Device-based access if (context.getUserDevice() != null && !isAllowedDevice(context.getUserDevice())) { return false; } return true; } private boolean isDomainAllowed(IapUserIdentity user) { List<String> allowedDomains = iapProperties.getSecurity().getAllowedDomains(); if (allowedDomains.isEmpty()) { return true; // No domain restrictions } String userDomain = user.getDomain(); return userDomain != null && allowedDomains.contains(userDomain); } private boolean evaluateAccessPolicy(IapUserIdentity user, AccessPolicy policy, String method) { // Check if method is allowed if (!policy.getAllowedMethods().contains(method)) { return false; } // Check role requirements if (!policy.getRequiredRoles().isEmpty()) { List<String> userRoles = extractUserRoles(user); if (policy.getRequiredRoles().stream().noneMatch(userRoles::contains)) { return false; } } // Check domain restrictions if (!policy.getAllowedDomains().isEmpty()) { String userDomain = user.getDomain(); if (userDomain == null || !policy.getAllowedDomains().contains(userDomain)) { return false; } } return true; } private List<String> extractUserRoles(IapUserIdentity user) { // Extract roles from JWT claims or external service @SuppressWarnings("unchecked") List<String> roles = (List<String>) user.getClaims().get("roles"); return roles != null ? roles : List.of("USER"); } private boolean evaluatePermission(IapUserIdentity user, Permission permission) { // Implement permission evaluation logic // This could integrate with external policy engines return accessPolicyRepository.hasPermission(user, permission); } private boolean isWithinAccessHours(Instant accessTime) { // Implement time-based access logic LocalTime time = LocalTime.ofInstant(accessTime, ZoneId.systemDefault()); return !time.isBefore(LocalTime.of(8, 0)) && !time.isAfter(LocalTime.of(18, 0)); } private boolean isAllowedLocation(String location) { // Implement location-based access logic List<String> allowedLocations = List.of("US", "CA", "EU"); return allowedLocations.contains(location.toUpperCase()); } private boolean isAllowedDevice(String device) { // Implement device-based access logic return !"mobile".equalsIgnoreCase(device); // Example: block mobile devices } } @Service @Slf4j public class AccessPolicyRepository { private final Map<String, AccessPolicy> pathPolicies = new ConcurrentHashMap<>(); private final Map<String, List<Permission>> userPermissions = new ConcurrentHashMap<>(); public AccessPolicyRepository() { initializeDefaultPolicies(); } public AccessPolicy findPolicyForPath(String path) { return pathPolicies.entrySet().stream() .filter(entry -> path.matches(entry.getKey())) .map(Map.Entry::getValue) .findFirst() .orElse(null); } public List<String> findAccessibleResources(IapUserIdentity user) { return pathPolicies.entrySet().stream() .filter(entry -> { AccessPolicy policy = entry.getValue(); return policy.getRequiredRoles().stream() .anyMatch(role -> hasRole(user, role)); }) .map(Map.Entry::getKey) .collect(Collectors.toList()); } public boolean hasPermission(IapUserIdentity user, Permission permission) { List<Permission> permissions = userPermissions.get(user.getEmail()); return permissions != null && permissions.contains(permission); } public void addPolicy(String pathPattern, AccessPolicy policy) { pathPolicies.put(pathPattern, policy); } public void grantPermission(String userEmail, Permission permission) { userPermissions.computeIfAbsent(userEmail, k -> new ArrayList<>()) .add(permission); } private void initializeDefaultPolicies() { // Admin API policies addPolicy("/api/admin/.*", AccessPolicy.builder() .allowedMethods(List.of("GET", "POST", "PUT", "DELETE")) .requiredRoles(List.of("ADMIN")) .allowedDomains(List.of("company.com")) .build()); // User API policies addPolicy("/api/users/.*", AccessPolicy.builder() .allowedMethods(List.of("GET", "POST", "PUT")) .requiredRoles(List.of("USER", "ADMIN")) .allowedDomains(List.of("company.com")) .build()); // Public API policies addPolicy("/api/public/.*", AccessPolicy.builder() .allowedMethods(List.of("GET")) .requiredRoles(Collections.emptyList()) .allowedDomains(Collections.emptyList()) .build()); } private boolean hasRole(IapUserIdentity user, String role) { @SuppressWarnings("unchecked") List<String> roles = (List<String>) user.getClaims().get("roles"); return roles != null && roles.contains(role); } } @Data @Builder @NoArgsConstructor @AllArgsConstructor public class AccessPolicy { private List<String> allowedMethods; private List<String> requiredRoles; private List<String> allowedDomains; private List<String> allowedIps; private Map<String, Object> conditions; } @Data @Builder @NoArgsConstructor @AllArgsConstructor public class Permission { private String resource; private String action; private Map<String, Object> conditions; @Override public boolean equals(Object o) { if (this == o) return true; if (o == null || getClass() != o.getClass()) return false; Permission that = (Permission) o; return Objects.equals(resource, that.resource) && Objects.equals(action, that.action); } @Override public int hashCode() { return Objects.hash(resource, action); } } @Data @Builder @NoArgsConstructor @AllArgsConstructor public class AccessContext { private Instant accessTime; private String userLocation; private String userDevice; private String clientIp; private Map<String, Object> additionalContext; }

Custom Annotations and Aspect-Oriented Security

1. Custom Security Annotations

@Target(ElementType.METHOD) @Retention(RetentionPolicy.RUNTIME) public @interface IapSecured { String[] roles() default {}; String[] domains() default {}; String condition() default ""; } @Target(ElementType.METHOD) @Retention(RetentionPolicy.RUNTIME) public @interface IapPreAuthorize { String value(); } @Target(ElementType.METHOD) @Retention(RetentionPolicy.RUNTIME) public @interface IapPostAuthorize { String value(); } @Target(ElementType.METHOD) @Retention(RetentionPolicy.RUNTIME) public @interface IapContextAware { String[] requiredContext() default {}; } @Component @Aspect @Slf4j public class IapSecurityAspect { private final IapAuthorizationService authorizationService; public IapSecurityAspect(IapAuthorizationService authorizationService) { this.authorizationService = authorizationService; } @Around("@annotation(iapSecured)") public Object checkIapSecurity(ProceedingJoinPoint joinPoint, IapSecured iapSecured) throws Throwable { IapUserIdentity user = getCurrentUser(); if (user == null) { throw new IapAuthenticationException("User not authenticated"); } // Check roles if (iapSecured.roles().length > 0) { boolean hasRequiredRole = Arrays.stream(iapSecured.roles()) .anyMatch(role -> authorizationService.hasRole(user, role)); if (!hasRequiredRole) { throw new IapAuthorizationException("Insufficient roles"); } } // Check domains if (iapSecured.domains().length > 0) { boolean hasRequiredDomain = Arrays.stream(iapSecured.domains()) .anyMatch(domain -> user.isFromDomain(domain)); if (!hasRequiredDomain) { throw new IapAuthorizationException("Domain not allowed"); } } return joinPoint.proceed(); } @Around("@annotation(iapContextAware)") public Object checkContextAwareSecurity(ProceedingJoinPoint joinPoint, IapContextAware iapContextAware) throws Throwable { IapUserIdentity user = getCurrentUser(); if (user == null) { throw new IapAuthenticationException("User not authenticated"); } // Build access context from method parameters AccessContext accessContext = buildAccessContext(joinPoint); if (!authorizationService.hasAccessWithContext(user, accessContext)) { throw new IapAuthorizationException("Context-based access denied"); } return joinPoint.proceed(); } private IapUserIdentity getCurrentUser() { Authentication authentication = SecurityContextHolder.getContext().getAuthentication(); if (authentication != null && authentication.getPrincipal() instanceof IapUserIdentity) { return (IapUserIdentity) authentication.getPrincipal(); } return null; } private AccessContext buildAccessContext(ProceedingJoinPoint joinPoint) { // Extract context information from method parameters and request HttpServletRequest request = getCurrentRequest(); return AccessContext.builder() .accessTime(Instant.now()) .clientIp(getClientIp(request)) .userDevice(request.getHeader("User-Agent")) .additionalContext(extractMethodContext(joinPoint)) .build(); } private HttpServletRequest getCurrentRequest() { RequestAttributes requestAttributes = RequestContextHolder.getRequestAttributes(); if (requestAttributes instanceof ServletRequestAttributes servletRequestAttributes) { return servletRequestAttributes.getRequest(); } return null; } private String getClientIp(HttpServletRequest request) { if (request == null) return "unknown"; String xForwardedFor = request.getHeader("X-Forwarded-For"); if (xForwardedFor != null && !xForwardedFor.isEmpty()) { return xForwardedFor.split(",")[0].trim(); } return request.getRemoteAddr(); } private Map<String, Object> extractMethodContext(ProceedingJoinPoint joinPoint) { Map<String, Object> context = new HashMap<>(); // Extract method parameters for context Object[] args = joinPoint.getArgs(); String[] paramNames = getParameterNames(joinPoint); if (paramNames != null) { for (int i = 0; i < args.length; i++) { context.put(paramNames[i], args[i]); } } return context; } private String[] getParameterNames(ProceedingJoinPoint joinPoint) { MethodSignature signature = (MethodSignature) joinPoint.getSignature(); return signature.getParameterNames(); } }

REST API Controllers with IAP Security

1. Secure REST Controllers

@RestController @RequestMapping("/api") @Slf4j public class SecureUserController { private final UserService userService; private final IapAuthorizationService authorizationService; public SecureUserController(UserService userService, IapAuthorizationService authorizationService) { this.userService = userService; this.authorizationService = authorizationService; } @GetMapping("/users") @IapSecured(roles = {"USER", "ADMIN"}) public ResponseEntity<List<User>> getUsers() { IapUserIdentity currentUser = getCurrentUser(); log.info("User {} accessed users list", currentUser.getEmail()); List<User> users = userService.getAllUsers(); return ResponseEntity.ok(users); } @GetMapping("/users/{id}") @IapSecured(roles = {"USER", "ADMIN"}) public ResponseEntity<User> getUser(@PathVariable String id) { IapUserIdentity currentUser = getCurrentUser(); // Context-aware authorization if (!currentUser.getEmail().equals(id) && !authorizationService.hasRole(currentUser, "ADMIN")) { throw new IapAuthorizationException("Cannot access other user's data"); } User user = userService.getUserById(id); return ResponseEntity.ok(user); } @PostMapping("/users") @IapSecured(roles = {"ADMIN"}, domains = {"company.com"}) public ResponseEntity<User> createUser(@RequestBody CreateUserRequest request) { IapUserIdentity currentUser = getCurrentUser(); log.info("Admin {} creating user: {}", currentUser.getEmail(), request.getEmail()); User user = userService.createUser(request); return ResponseEntity.status(HttpStatus.CREATED).body(user); } @PutMapping("/users/{id}") @IapSecured(roles = {"ADMIN"}) @IapContextAware(requiredContext = {"businessHours"}) public ResponseEntity<User> updateUser(@PathVariable String id, @RequestBody UpdateUserRequest request) { IapUserIdentity currentUser = getCurrentUser(); User user = userService.updateUser(id, request); return ResponseEntity.ok(user); } @GetMapping("/profile") public ResponseEntity<UserProfile> getProfile() { IapUserIdentity currentUser = getCurrentUser(); UserProfile profile = userService.getUserProfile(currentUser.getEmail()); return ResponseEntity.ok(profile); } @GetMapping("/admin/stats") @IapSecured(roles = {"ADMIN"}, domains = {"company.com"}) public ResponseEntity<AdminStats> getAdminStats() { IapUserIdentity currentUser = getCurrentUser(); log.info("Admin {} accessed statistics", currentUser.getEmail()); AdminStats stats = userService.getAdminStatistics(); return ResponseEntity.ok(stats); } @GetMapping("/context-test") @IapContextAware(requiredContext = {"location=US", "device=desktop"}) public ResponseEntity<String> contextAwareEndpoint() { return ResponseEntity.ok("Context-aware access granted"); } private IapUserIdentity getCurrentUser() { Authentication authentication = SecurityContextHolder.getContext().getAuthentication(); if (authentication != null && authentication.getPrincipal() instanceof IapUserIdentity) { return (IapUserIdentity) authentication.getPrincipal(); } throw new IapAuthenticationException("User not authenticated"); } } @RestController @RequestMapping("/api/public") @Slf4j public class PublicController { @GetMapping("/health") public ResponseEntity<Map<String, String>> health() { Map<String, String> status = new HashMap<>(); status.put("status", "UP"); status.put("timestamp", Instant.now().toString()); return ResponseEntity.ok(status); } @GetMapping("/info") public ResponseEntity<Map<String, String>> info() { Map<String, String> info = new HashMap<>(); info.put("name", "IAP Protected Application"); info.put("version", "1.0.0"); return ResponseEntity.ok(info); } }

Monitoring and Auditing

1. IAP Audit Service

```java
@Service
@Slf4j
public class IapAuditService {

private final MeterRegistry meterRegistry; private final Counter authenticationCounter; private final Counter authorizationCounter; public IapAuditService(MeterRegistry meterRegistry) { this.meterRegistry = meterRegistry; this.authenticationCounter = Counter.builder("iap.authentication.attempts") .description("IAP authentication attempts") .register(meterRegistry); this.authorizationCounter = Counter.builder("iap.authorization.checks") .description("IAP authorization checks") .register(meterRegistry); } public void logAuthenticationSuccess(IapUserIdentity user, HttpServletRequest request) { authenticationCounter.increment(); log.info("IAP Authentication SUCCESS - User: {}, IP: {}, Path: {}", user.getEmail(), getClientIp(request), request.getRequestURI()); // Record detailed metrics meterRegistry.counter("iap.authentication.success", "user", user.getEmail(), "domain", user.getDomain()) .increment(); } public void logAuthenticationFailure(String reason, HttpServletRequest request) { authenticationCounter.increment(); log.warn("IAP Authentication FAILURE - Reason: {}, IP: {}, Path: {}", reason, getClientIp(request), request.getRequestURI()); meterRegistry.counter("iap.authentication.failure", "reason", reason) .increment(); } public void logAuthorizationSuccess(IapUserIdentity user, String resource, String action) { authorizationCounter.increment(); log.debug("IAP Authorization SUCCESS - User: {}, Resource: {}, Action: {}", user.getEmail(), resource, action); meterRegistry.counter("iap.authorization.success", "user", user.getEmail(), "resource", resource, "action", action) .increment(); } public void logAuthorizationFailure(IapUserIdentity user, String resource, String action, String reason) { authorizationCounter.increment(); log.warn("IAP Authorization FAILURE - User: {}, Resource: {}, Action: {}, Reason: {}", user.getEmail(), resource, action, reason); meterRegistry.counter("iap.authorization.failure", "user", user.getEmail(), "resource", resource, "action", action, "reason", reason) .increment

Java Logistics, Shipping Integration & Enterprise Inventory Automation (Tracking, ERP, RFID & Billing Systems)

https://macronepal.com/blog/aftership-tracking-in-java-enterprise-package-visibility/
Explains how to integrate AfterShip tracking services into Java applications to provide real-time shipment visibility, delivery status updates, and centralized tracking across multiple courier services.

https://macronepal.com/blog/shipping-integration-using-fedex-api-with-java-for-logistics-automation/
Explains how to integrate the FedEx API into Java systems to automate shipping tasks such as creating shipments, calculating delivery costs, generating shipping labels, and tracking packages.

https://macronepal.com/blog/shipping-and-logistics-integrating-ups-apis-with-java-applications/
Explains UPS API integration in Java to enable automated shipping operations including rate calculation, shipment scheduling, tracking, and delivery confirmation management.

https://macronepal.com/blog/generating-and-reading-qr-codes-for-products-in-java/
Explains how Java applications generate and read QR codes for product identification, tracking, and authentication, supporting faster inventory handling and product verification processes.

https://macronepal.com/blog/designing-a-robust-pick-and-pack-workflow-in-java/
Explains how to design an efficient pick-and-pack workflow in Java warehouse systems, covering order processing, item selection, packaging steps, and logistics preparation to improve fulfillment efficiency.

https://macronepal.com/blog/rfid-inventory-management-system-in-java-a-complete-guide/
Explains how RFID technology integrates with Java applications to automate inventory tracking, reduce manual errors, and enable real-time stock monitoring in warehouses and retail environments.

https://macronepal.com/blog/erp-integration-with-odoo-in-java/
Explains how Java applications connect with Odoo ERP systems to synchronize inventory, orders, customer records, and financial data across enterprise systems.

https://macronepal.com/blog/automated-invoice-generation-creating-professional-excel-invoices-with-apache-poi-in-java/
Explains how to automatically generate professional Excel invoices in Java using Apache POI, enabling structured billing documents and automated financial record creation.

https://macronepal.com/blog/enterprise-financial-integration-using-quickbooks-api-in-java-applications/
Explains QuickBooks API integration in Java to automate financial workflows such as invoice management, payment tracking, accounting synchronization, and financial reporting.