10 Comments
Nov 21, 2023Liked by Christo Olivier

Thanks for the tutorial. Is there a way to get the IAP user inside the streamlit app? (e.g. to log which user is doing which actions)

Expand full comment
author

You should be able to pull this information out of the HTTP request's header https://cloud.google.com/iap/docs/identity-howto

There seems to only be an unofficial API in Streamlit to get the HTTP header of a request using this code here. (It sucks that they dont support it outright at the moment)

-------------------------------------------

from streamlit.web.server.websocket_headers import _get_websocket_headers

headers = _get_websocket_headers()

-------------------------------------------

Expand full comment
Jan 9Liked by Christo Olivier

Works perfectly. Thank you :-)

Expand full comment
author

Glad I could help :-)

Expand full comment

Hey Christo, I hope you can help me with another question: Is it possible to customize the Google IAP-Screen which is shown when the access is denied to the Streamlit-App? Thanks!!

Expand full comment
author

Hey Fen. As far as I know you can set a URL that the user is redirected to when access is denied. This page in the documentation provides more detail https://cloud.google.com/iap/docs/customizing#setting_a_custom_access_denied_error_page

Expand full comment

Again, solved the problem. Thank you very much.

Expand full comment
author

You are most welcome.

Expand full comment

Hey, is cloud run a good option for streamlit though? Streamlit session management for example is in memory, so the session data will be lost every time the instance is shutdown given that's how cloud run or serverless work in general. How did you go about that?

Expand full comment
author

That is a good question. What I did was to ensure session affinity to make sure the same user's request is handled by the same instance spun up by Cloud Run. The second thing to do is to set the timeouts to a reasonable number and to ensure instances wont spin down too early to avoid what you have mentioned.

Expand full comment