The login worked yesterday. Today it throws a 403. Nothing in your backend changed. The only difference is how the Identity-Aware Proxy reads the user config.
Identity-Aware Proxy (IAP) sits between your users and your app, controlling access based on identity and context. When IAP behavior changes without code changes, it’s almost always due to a shift in user configuration: OAuth scopes, group memberships, or access policies that IAP checks before letting anyone through.
User config-dependent issues can be hard to spot. The app still runs. The deployment looks fine. Yet, certain users can’t log in. You trace the requests and find IAP rejecting them before they even touch your service. The cause may be a modified identity attribute, a removed role, or a stale authorization mapping.
The fastest way to debug is to isolate the problem:
- Verify the user’s identity with the same account IAP sees.
- Check role assignment and group policy in your identity provider.
- Inspect IAP logs for the denied request and match it to a rule.
- Confirm that your app’s backend is aware it’s behind IAP and validates the correct headers.
IAP works by trusting that configs in your identity source are current. When access breaks, the fault is often upstream. Watch out for automated sync jobs or admin role changes. Even a small policy tweak in your cloud console can lock out whole teams.
A solid workflow for keeping IAP stable is to make configuration drift visible. Track every identity policy change. Test logins after updates. Pair configuration checks with deploys. Doing this lets you catch problems before they reach production.
Access control is core security. When it depends on a user config, you must handle it like critical application code. Treat identity policies, group rules, and OAuth scopes as versioned, reviewable assets. This makes outages easier to diagnose and faster to fix.
If you want to see identity-aware, user-config-sensitive access control in action, and test how fast you can go from zero to working with live requests, jump into hoop.dev. You can watch it work in minutes.