title: Google Cloud Run Hosted User Sign-In 'Redirect' Throws Error When Using External Identity Providers
body: <p>I have a Google Cloud App Engine app that functions correctly when either I allow unauthenticated AllUsers access or turn on IAM for controlling access in Identity Aware Proxy.  However when I follow the instructions on this page <a href="https://cloud.google.com/iap/docs/cloud-run-sign-in" rel="nofollow noreferrer">https://cloud.google.com/iap/docs/cloud-run-sign-in</a> to enable Cloud Run Hosted sign-in with external identities and attempt to access either the login page or the Google Cloud Run hosted sign-in page, I receive the following error in the browser.</p>
  <blockquote>
  <p>&quot;Could not fetch URI /computeMetadata/v1/instance/service-accounts/default/token?scopes=https://www.googleapis.com/auth/cloud-platform,https://www.googleapis.com/auth/identitytoolkit&quot;</p>
  </blockquote>
  <p>For context, the Google Cloud Run service hosting the user sign-in is set to allow all Unauthenticated. It should re-direct to the Google App Engine web app. I <em>think</em> this is related to permissions or redirects, but I am at a loss as to how to fix. Any thoughts?  Thanks!</p>
  <p>I attempted to fix by re-deploying the Cloud Run Service, switching IAP on and off, switching between IAM and external identities, but to no success.</p>
  <p>Thanks @John Hanley, I discovered that one my compute engine service account was disabled for some reason within the project. Re-enabling solved the problem partially. I'll spend more time matrix out the permissions and re-directs to make sure they are aligned.</p>
  <p><em><strong>I originally thought I completely answered my own question and solved my problem. Unfortunately, I only solved one of the problems with my implementation of the external identities authentication method.</strong></em></p>
  <p>Description of the other problem:
  I enabled email/password and Google as providers, but when I click on the the option to authenticate with Google, I receive the following text in the browser: &quot;The requested action is invalid.&quot;</p>
  <p>At the Console in Dev Tools I get the following error:</p>
  <blockquote>
  <p>GET <a href="https://www.googleapis.com/identitytoolkit/v3/relyingparty/getProjectConfig?key=*mykey*&amp;cb=1599165379363" rel="nofollow noreferrer">https://www.googleapis.com/identitytoolkit/v3/relyingparty/getProjectConfig?key=*mykey*&amp;cb=1599165379363</a> 403</p>
  </blockquote>
  <p>The following url is displayed in the URL bar:</p>
  <blockquote>
  <p>https://<em><em><strong>.firebaseapp.com/__/auth/handler?apiKey=<em><strong>mykey</strong></em>&amp;appName=%5BDEFAULT%5D-firebaseui-temp&amp;authType=signInViaRedirect&amp;providerId=google.com&amp;customParameters=%7B%22hl%22%3A%22en%22%7D&amp;scopes=profile&amp;redirectUrl=https%3A%2F%2Fiap-gcip-hosted-ui-app-engine-app-</strong></em>myserver</em><strong>-uc.a.run.app%2F%3FapiKey%3D</strong>mykey**&amp;v=7.16.0&amp;fw=FirebaseUI-web</p>
  </blockquote>
  <p><em>mykey</em> and <em>myserver</em> were removed for this post and is not the actual values.</p>
  <p>Email/password sign-in works, but not the Google sign-in. What am I missing here?</p>