在配置出站流量代理之前测试组织限制标头

本页面介绍 Google Cloud 管理员如何测试组织权限限制 而无需配置出站流量代理。

如需创建和测试组织限制标头，请执行以下操作：

  1. 如需获取组织的 Google Cloud 组织 ID，请使用 gcloud organizations list 命令：

        gcloud organizations list

    输出示例如下：

        DISPLAY_NAME: Organization A
    ID: 123456789
    DIRECTORY_CUSTOMER_ID: a1b2c3d4

  2. 获取组织 ID 后，为标头编写 JSON 表示法 值的格式如下：

     {
 "resources": ["organizations/123456789"],
  "options": "strict"
 }

  3. 按照 RFC 4648 第 5 节规范对请求标头的值进行编码。

    例如，如果标头值的 JSON 表示法存储在 authorized_orgs.json 文件中，则以下是通过 basenc 进行编码的结果：

     $ OR_HEADER=`cat authorized_orgs.json | basenc --base64url -w0`
 $ echo $OR_HEADER
ewogInJlc291cmNlcyI6IFsib3JnYW5pemF0aW9ucy8xMjM0NTY3ODkiXQogIm9wdGlvbnMiOiAic3RyaWN0Igp9Cgo=

  4. 如需测试标头配置是否允许访问已获授权的 Google Cloud 组织中的资源，请针对已获授权的 Google Cloud 组织中的资源创建 curl 请求。以下是一个示例 curl 请求：

    # Get auth token
$ TOKEN=$(gcloud auth print-access-token)

# Make a request that includes the organization restriction header; this call makes a request to the logging API for a project within the same organization listed in the header
$ curl -H "X-Goog-Allowed-Resources: ${OR_HEADER}" -X POST -d '{"projectIds":
["my-project-123"]}' -H 'Content-Type: application/json' -H "Authorization: Bearer ${TOKEN}" "https://logging.googleapis.com/v2/entries:list"
# A successful request returns log entries in this project

  5. 如需测试标头配置是否会拒绝对已获授权 Google Cloud 组织之外的资源的访问权限，请针对已获授权 Google Cloud 组织之外的资源创建 curl 请求。以下是 curl 请求示例：

    # Get auth token
$ TOKEN=$(gcloud auth print-access-token)

# Make a request that includes the organization restriction header; this call makes a request to the logging API for a project not within the same organization listed in the header
$ curl -H "X-Goog-Allowed-Resources: ${OR_HEADER}" -X POST -d '{"projectIds": ["other-project-123"]}' -H 'Content-Type: application/json' -H "Authorization: Bearer ${TOKEN}" "https://logging.googleapis.com/v2/entries:list" 
{
  "error": {
 "code": 403,
    "message": "Access denied by organization restriction. Contact your administrator for additional information.",
    "status": "PERMISSION_DENIED",
    "details": [
      {
        "@type": "type.googleapis.com/google.rpc.ErrorInfo",
        "reason": "ORG_RESTRICTION_VIOLATION",
        "domain": "googleapis.com",
        "metadata": {
          "service": "logging.googleapis.com",
          "consumer": "other-project-123"
        }
      }
    ]
  }
}

    “访问权限被拒”错误消息表示系统拒绝了对资源的请求。

后续步骤