Blame - docs/dyn/sts_v1beta.v1beta.html - platform/external/python/google-api-python-client

blob: 9e810be2d5a3705524ed7ef368b9d631178bf34e [file] [log] [blame]

Dmitry Frenkel	3e17f89	2020-10-06 16:46:05 -0700	[diff] [blame^]	1	<html><body>
				2	<style>
				3
				4	body, h1, h2, h3, div, span, p, pre, a {
				5	margin: 0;
				6	padding: 0;
				7	border: 0;
				8	font-weight: inherit;
				9	font-style: inherit;
				10	font-size: 100%;
				11	font-family: inherit;
				12	vertical-align: baseline;
				13	}
				14
				15	body {
				16	font-size: 13px;
				17	padding: 1em;
				18	}
				19
				20	h1 {
				21	font-size: 26px;
				22	margin-bottom: 1em;
				23	}
				24
				25	h2 {
				26	font-size: 24px;
				27	margin-bottom: 1em;
				28	}
				29
				30	h3 {
				31	font-size: 20px;
				32	margin-bottom: 1em;
				33	margin-top: 1em;
				34	}
				35
				36	pre, code {
				37	line-height: 1.5;
				38	font-family: Monaco, 'DejaVu Sans Mono', 'Bitstream Vera Sans Mono', 'Lucida Console', monospace;
				39	}
				40
				41	pre {
				42	margin-top: 0.5em;
				43	}
				44
				45	h1, h2, h3, p {
				46	font-family: Arial, sans serif;
				47	}
				48
				49	h1, h2, h3 {
				50	border-bottom: solid #CCC 1px;
				51	}
				52
				53	.toc_element {
				54	margin-top: 0.5em;
				55	}
				56
				57	.firstline {
				58	margin-left: 2 em;
				59	}
				60
				61	.method {
				62	margin-top: 1em;
				63	border: solid 1px #CCC;
				64	padding: 1em;
				65	background: #EEE;
				66	}
				67
				68	.details {
				69	font-weight: bold;
				70	font-size: 14px;
				71	}
				72
				73	</style>
				74
				75	<h1><a href="sts_v1beta.html">Security Token Service API</a> . <a href="sts_v1beta.v1beta.html">v1beta</a></h1>
				76	<h2>Instance Methods</h2>
				77	<p class="toc_element">
				78	<code><a href="#close">close()</a></code></p>
				79	<p class="firstline">Close httplib2 connections.</p>
				80	<p class="toc_element">
				81	<code><a href="#token">token(body=None, x__xgafv=None)</a></code></p>
				82	<p class="firstline">Exchanges a credential for a Google OAuth 2.0 access token. The token asserts an external identity within a WorkloadIdentityPool, or applies an Access Boundary on a Google access token.</p>
				83	<h3>Method Details</h3>
				84	<div class="method">
				85	<code class="details" id="close">close()</code>
				86	<pre>Close httplib2 connections.</pre>
				87	</div>
				88
				89	<div class="method">
				90	<code class="details" id="token">token(body=None, x__xgafv=None)</code>
				91	<pre>Exchanges a credential for a Google OAuth 2.0 access token. The token asserts an external identity within a WorkloadIdentityPool, or applies an Access Boundary on a Google access token.
				92
				93	Args:
				94	body: object, The request body.
				95	The object takes the form of:
				96
				97	{ # Request message for ExchangeToken.
				98	"requestedTokenType": "A String", # Required. An identifier for the type of requested security token. Must be `urn:ietf:params:oauth:token-type:access_token`.
				99	"audience": "A String", # The full resource name of the identity provider; for example: `https://iam.googleapis.com/projects/{PROJECT_ID}/workloadIdentityPools/{POOL_ID}/providers/{PROVIDER_ID}`. Required when exchanging an external credential for a Google access token.
				100	"options": "A String", # A set of features that Security Token Service supports, in addition to the standard OAuth 2.0 token exchange, formatted as a serialized JSON object of Options.
				101	"subjectTokenType": "A String", # Required. An identifier that indicates the type of the security token in the `subject_token` parameter. Supported values are `urn:ietf:params:oauth:token-type:jwt`, `urn:ietf:params:aws:token-type:aws4_request` and `urn:ietf:params:oauth:token-type:access_token`.
				102	"scope": "A String", # The OAuth 2.0 scopes to include on the resulting access token, formatted as a list of space-delimited, case-sensitive strings. Required when exchanging an external credential for a Google access token.
				103	"subjectToken": "A String", # Required. The input token. This is a either an external credential issued by a WorkloadIdentityPoolProvider, or a short-lived access token issued by Google. If the token is an OIDC JWT, it must use the JWT format defined in [RFC 7523](https://tools.ietf.org/html/rfc7523), and `subject_token_type` must be `urn:ietf:params:oauth:token-type:jwt`. The following headers are required: - `kid`: The identifier of the signing key securing the JWT. - `alg`: The cryptographic algorithm securing the JWT. Must be `RS256`. The following payload fields are required. For more information, see [RFC 7523, Section 3](https://tools.ietf.org/html/rfc7523#section-3). - `iss`: The issuer of the token. The issuer must provide a discovery document at `/.well-known/openid-configuration`, formatted according to section 4.2 of the [OIDC 1.0 Discovery specification](https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderConfigurationResponse). - `iat`: The issue time, in seconds, since epoch. Must be in the past. - `exp`: The expiration time, in seconds, since epoch. Must be fewer than 48 hours after `iat`. Shorter expiration times are more. secure. If possible, we recommend setting an expiration time fewer than 6 hours. - `sub`: The identity asserted in the JWT. - `aud`: Configured by the mapper policy. The default value is the service account's unique ID. Example header: ``` { "alg": "RS256", "kid": "us-east-11" } ``` Example payload: ``` { "iss": "https://accounts.google.com", "iat": 1517963104, "exp": 1517966704, "aud": "113475438248934895348", "sub": "113475438248934895348", "my_claims": { "additional_claim": "value" } } ``` If `subject_token` is an AWS token, it must be a serialized, [signed](https://docs.aws.amazon.com/general/latest/gr/signing_aws_api_requests.html) request to the AWS [`GetCallerIdentity()`](https://docs.aws.amazon.com/STS/latest/APIReference/API_GetCallerIdentity) method. Format the request as URL-encoded JSON, and set the `subject_token_type` parameter to `urn:ietf:params:aws:token-type:aws4_request`. The following parameters are required: - `url`: The URL of the AWS STS endpoint for `GetCallerIdentity()`, such as `https://sts.amazonaws.com?Action=GetCallerIdentity&Version=2011-06-15`. Regional endpoints are also supported. - `method`: The HTTP request method: `POST`. - `headers`: The HTTP request headers, which must include: - `Authorization`: The request signature. - `x-amz-date``: The time you will send the request, formatted as an [ISO8601 Basic](https://docs.aws.amazon.com/general/latest/gr/sigv4_elements.html#sigv4_elements_date) string. This is typically set to the current time, and used to prevent replay attacks. - `host`: The hostname of the `url` field; for example, `sts.amazonaws.com`. - `x-goog-cloud-target-resource`: The full, canonical resource name of the WorkloadIdentityPoolProvider, with or without the HTTPS prefix. For example: ``` //iam.googleapis.com/projects//locations//workloadIdentityPools//providers/ https://iam.googleapis.com/projects//locations//workloadIdentityPools//providers/ ``` Signing this header as part of the signature is recommended to ensure data integrity. If you are using temporary security credentials provided by AWS, you must also include the header `x-amz-security-token`, with the value `[SESSION_TOKEN]`. The following is an example of a signed, serialized request: ``` { "headers":[ {"key": "x-amz-date", "value": "20200815T015049Z"}, {"key": "Authorization", "value": "AWS4-HMAC-SHA256+Credential=$credential,+SignedHeaders=host;x-amz-date;x-goog-cloud-target-resource,+Signature=$signature"}, {"key": "x-goog-cloud-target-resource", "value": "//iam.googleapis.com/projects//locations//workloadIdentityPools//providers/"}, {"key": "host", "value": "sts.amazonaws.com"} . ], "method":"POST", "url":"https://sts.amazonaws.com?Action=GetCallerIdentity&Version=2011-06-15" } ``` You can also use a Google-issued OAuth 2.0 access token with this field to obtain an access token with new security attributes applied, such as an AccessBoundary. In this case, set `subject_token_type` to `urn:ietf:params:oauth:token-type:access_token`. Applying additional security attributes on access tokens that already contain security attributes is not allowed.
				104	"grantType": "A String", # Required. The grant type. Must be `urn:ietf:params:oauth:grant-type:token-exchange`, which indicates a token exchange is requested.
				105	}
				106
				107	x__xgafv: string, V1 error format.
				108	Allowed values
				109	1 - v1 error format
				110	2 - v2 error format
				111
				112	Returns:
				113	An object of the form:
				114
				115	{ # Response message for ExchangeToken.
				116	"token_type": "A String", # The type of `access_token`. Always has the value `Bearer`.
				117	"expires_in": 42, # The expiration time of `access_token`, in seconds, from the time of issuance. This field is absent when the `subject_token` in the request is a Google-issued, short-lived access token. In this case, the expiration time of the `access_token` is the same as the `subject_token`.
				118	"access_token": "A String", # An OAuth 2.0 security token, issued by Google, in response to the token exchange request. Tokens can vary in size (mainly depending on the size of mapped claims), currently up to the 12288 bytes (12 KB) size limit. Google reserves the right to change token size, including increasing these limits. Your application must support variable token sizes accordingly.
				119	"issued_token_type": "A String", # The token type. Always matches the value of `requested_token_type` from the request.
				120	}</pre>
				121	</div>
				122
				123	</body></html>