Blame - docs/dyn/iam_v1.projects.locations.workloadIdentityPools.providers.html - platform/external/python/google-api-python-client

blob: c949b4df41dba76d28db7192da74031069c13959 [file] [log] [blame]

Dmitry Frenkel	3e17f89	2020-10-06 16:46:05 -0700	[diff] [blame]	1	<html><body>
				2	<style>
				3
				4	body, h1, h2, h3, div, span, p, pre, a {
				5	margin: 0;
				6	padding: 0;
				7	border: 0;
				8	font-weight: inherit;
				9	font-style: inherit;
				10	font-size: 100%;
				11	font-family: inherit;
				12	vertical-align: baseline;
				13	}
				14
				15	body {
				16	font-size: 13px;
				17	padding: 1em;
				18	}
				19
				20	h1 {
				21	font-size: 26px;
				22	margin-bottom: 1em;
				23	}
				24
				25	h2 {
				26	font-size: 24px;
				27	margin-bottom: 1em;
				28	}
				29
				30	h3 {
				31	font-size: 20px;
				32	margin-bottom: 1em;
				33	margin-top: 1em;
				34	}
				35
				36	pre, code {
				37	line-height: 1.5;
				38	font-family: Monaco, 'DejaVu Sans Mono', 'Bitstream Vera Sans Mono', 'Lucida Console', monospace;
				39	}
				40
				41	pre {
				42	margin-top: 0.5em;
				43	}
				44
				45	h1, h2, h3, p {
				46	font-family: Arial, sans serif;
				47	}
				48
				49	h1, h2, h3 {
				50	border-bottom: solid #CCC 1px;
				51	}
				52
				53	.toc_element {
				54	margin-top: 0.5em;
				55	}
				56
				57	.firstline {
				58	margin-left: 2 em;
				59	}
				60
				61	.method {
				62	margin-top: 1em;
				63	border: solid 1px #CCC;
				64	padding: 1em;
				65	background: #EEE;
				66	}
				67
				68	.details {
				69	font-weight: bold;
				70	font-size: 14px;
				71	}
				72
				73	</style>
				74
Yoshi Automation Bot	0d561ef	2020-11-25 07:50:41 -0800	[diff] [blame]	75	<h1><a href="iam_v1.html">Identity and Access Management (IAM) API</a> . <a href="iam_v1.projects.html">projects</a> . <a href="iam_v1.projects.locations.html">locations</a> . <a href="iam_v1.projects.locations.workloadIdentityPools.html">workloadIdentityPools</a> . <a href="iam_v1.projects.locations.workloadIdentityPools.providers.html">providers</a></h1>
Dmitry Frenkel	3e17f89	2020-10-06 16:46:05 -0700	[diff] [blame]	76	<h2>Instance Methods</h2>
				77	<p class="toc_element">
Yoshi Automation Bot	0d561ef	2020-11-25 07:50:41 -0800	[diff] [blame]	78	<code><a href="iam_v1.projects.locations.workloadIdentityPools.providers.operations.html">operations()</a></code>
Dmitry Frenkel	3e17f89	2020-10-06 16:46:05 -0700	[diff] [blame]	79	</p>
				80	<p class="firstline">Returns the operations Resource.</p>
				81
				82	<p class="toc_element">
Dmitry Frenkel	3e17f89	2020-10-06 16:46:05 -0700	[diff] [blame]	83	<code><a href="#close">close()</a></code></p>
				84	<p class="firstline">Close httplib2 connections.</p>
yoshi-code-bot	b6dc1b9	2021-03-02 11:49:08 -0800	[diff] [blame]	85	<p class="toc_element">
				86	<code><a href="#create">create(parent, body=None, workloadIdentityPoolProviderId=None, x__xgafv=None)</a></code></p>
				87	<p class="firstline">Creates a new WorkloadIdentityPoolProvider in a WorkloadIdentityPool. You cannot reuse the name of a deleted provider until 30 days after deletion.</p>
				88	<p class="toc_element">
				89	<code><a href="#delete">delete(name, x__xgafv=None)</a></code></p>
				90	<p class="firstline">Deletes a WorkloadIdentityPoolProvider. Deleting a provider does not revoke credentials that have already been issued; they continue to grant access. You can undelete a provider for 30 days. After 30 days, deletion is permanent. You cannot update deleted providers. However, you can view and list them.</p>
				91	<p class="toc_element">
				92	<code><a href="#get">get(name, x__xgafv=None)</a></code></p>
				93	<p class="firstline">Gets an individual WorkloadIdentityPoolProvider.</p>
				94	<p class="toc_element">
				95	<code><a href="#list">list(parent, pageSize=None, pageToken=None, showDeleted=None, x__xgafv=None)</a></code></p>
				96	<p class="firstline">Lists all non-deleted WorkloadIdentityPoolProviders in a WorkloadIdentityPool. If `show_deleted` is set to `true`, then deleted providers are also listed.</p>
				97	<p class="toc_element">
				98	<code><a href="#list_next">list_next(previous_request, previous_response)</a></code></p>
				99	<p class="firstline">Retrieves the next page of results.</p>
				100	<p class="toc_element">
				101	<code><a href="#patch">patch(name, body=None, updateMask=None, x__xgafv=None)</a></code></p>
				102	<p class="firstline">Updates an existing WorkloadIdentityPoolProvider.</p>
				103	<p class="toc_element">
				104	<code><a href="#undelete">undelete(name, body=None, x__xgafv=None)</a></code></p>
				105	<p class="firstline">Undeletes a WorkloadIdentityPoolProvider, as long as it was deleted fewer than 30 days ago.</p>
Dmitry Frenkel	3e17f89	2020-10-06 16:46:05 -0700	[diff] [blame]	106	<h3>Method Details</h3>
				107	<div class="method">
				108	<code class="details" id="close">close()</code>
				109	<pre>Close httplib2 connections.</pre>
				110	</div>
				111
yoshi-code-bot	b6dc1b9	2021-03-02 11:49:08 -0800	[diff] [blame]	112	<div class="method">
				113	<code class="details" id="create">create(parent, body=None, workloadIdentityPoolProviderId=None, x__xgafv=None)</code>
				114	<pre>Creates a new WorkloadIdentityPoolProvider in a WorkloadIdentityPool. You cannot reuse the name of a deleted provider until 30 days after deletion.
				115
				116	Args:
				117	parent: string, Required. The pool to create this provider in. (required)
				118	body: object, The request body.
				119	The object takes the form of:
				120
				121	{ # A configuration for an external identity provider.
				122	"attributeCondition": "A String", # [A Common Expression Language](https://opensource.google/projects/cel) expression, in plain text, to restrict what otherwise valid authentication credentials issued by the provider should not be accepted. The expression must output a boolean representing whether to allow the federation. The following keywords may be referenced in the expressions: * `assertion`: JSON representing the authentication credential issued by the provider. * `google`: The Google attributes mapped from the assertion in the `attribute_mappings`. * `attribute`: The custom attributes mapped from the assertion in the `attribute_mappings`. The maximum length of the attribute condition expression is 4096 characters. If unspecified, all valid authentication credential are accepted. The following example shows how to only allow credentials with a mapped `google.groups` value of `admins`: ``` "'admins' in google.groups" ```
				123	"attributeMapping": { # Maps attributes from authentication credentials issued by an external identity provider to Google Cloud attributes, such as `subject` and `segment`. Each key must be a string specifying the Google Cloud IAM attribute to map to. The following keys are supported: * `google.subject`: The principal IAM is authenticating. You can reference this value in IAM bindings. This is also the subject that appears in Cloud Logging logs. Cannot exceed 127 characters. * `google.groups`: Groups the external identity belongs to. You can grant groups access to resources using an IAM `principalSet` binding; access applies to all members of the group. You can also provide custom attributes by specifying `attribute.{custom_attribute}`, where `{custom_attribute}` is the name of the custom attribute to be mapped. You can define a maximum of 50 custom attributes. The maximum length of a mapped attribute key is 100 characters, and the key may only contain the characters [a-z0-9_]. You can reference these attributes in IAM policies to define fine-grained access for a workload to Google Cloud resources. For example: * `google.subject`: `principal://iam.googleapis.com/projects/{project}/locations/{location}/workloadIdentityPools/{pool}/subject/{value}` * `google.groups`: `principalSet://iam.googleapis.com/projects/{project}/locations/{location}/workloadIdentityPools/{pool}/group/{value}` * `attribute.{custom_attribute}`: `principalSet://iam.googleapis.com/projects/{project}/locations/{location}/workloadIdentityPools/{pool}/attribute.{custom_attribute}/{value}` Each value must be a [Common Expression Language] (https://opensource.google/projects/cel) function that maps an identity provider credential to the normalized attribute specified by the corresponding map key. You can use the `assertion` keyword in the expression to access a JSON representation of the authentication credential issued by the provider. The maximum length of an attribute mapping expression is 2048 characters. When evaluated, the total size of all mapped attributes must not exceed 8KB. For AWS providers, if no attribute mapping is defined, the following default mapping applies: ``` { "google.subject":"assertion.arn", "attribute.aws_role": "assertion.arn.contains('assumed-role')" " ? assertion.arn.extract('{account_arn}assumed-role/')" " + 'assumed-role/'" " + assertion.arn.extract('assumed-role/{role_name}/')" " : assertion.arn", } ``` If any custom attribute mappings are defined, they must include a mapping to the `google.subject` attribute. For OIDC providers, you must supply a custom mapping, which must include the `google.subject` attribute. For example, the following maps the `sub` claim of the incoming credential to the `subject` attribute on a Google token: ``` {"google.subject": "assertion.sub"} ```
				124	"a_key": "A String",
				125	},
				126	"aws": { # Represents an Amazon Web Services identity provider. # An Amazon Web Services identity provider.
				127	"accountId": "A String", # Required. The AWS account ID.
				128	},
				129	"description": "A String", # A description for the provider. Cannot exceed 256 characters.
				130	"disabled": True or False, # Whether the provider is disabled. You cannot use a disabled provider to exchange tokens. However, existing tokens still grant access.
				131	"displayName": "A String", # A display name for the provider. Cannot exceed 32 characters.
				132	"name": "A String", # Output only. The resource name of the provider.
				133	"oidc": { # Represents an OpenId Connect 1.0 identity provider. # An OpenId Connect 1.0 identity provider.
				134	"allowedAudiences": [ # Acceptable values for the `aud` field (audience) in the OIDC token. Token exchange requests are rejected if the token audience does not match one of the configured values. Each audience may be at most 256 characters. A maximum of 10 audiences may be configured. If this list is empty, the OIDC token audience must be equal to the full canonical resource name of the WorkloadIdentityPoolProvider, with or without the HTTPS prefix. For example: ``` //iam.googleapis.com/projects//locations//workloadIdentityPools//providers/ https://iam.googleapis.com/projects//locations//workloadIdentityPools//providers/ ```
				135	"A String",
				136	],
yoshi-code-bot	73a0aa3	2021-05-25 00:30:03 -0700	[diff] [blame]	137	"issuerUri": "A String", # Required. The OIDC issuer URL. Must be an HTTPS endpoint.
yoshi-code-bot	b6dc1b9	2021-03-02 11:49:08 -0800	[diff] [blame]	138	},
				139	"state": "A String", # Output only. The state of the provider.
				140	}
				141
				142	workloadIdentityPoolProviderId: string, Required. The ID for the provider, which becomes the final component of the resource name. This value must be 4-32 characters, and may contain the characters [a-z0-9-]. The prefix `gcp-` is reserved for use by Google, and may not be specified.
				143	x__xgafv: string, V1 error format.
				144	Allowed values
				145	1 - v1 error format
				146	2 - v2 error format
				147
				148	Returns:
				149	An object of the form:
				150
				151	{ # This resource represents a long-running operation that is the result of a network API call.
				152	"done": True or False, # If the value is `false`, it means the operation is still in progress. If `true`, the operation is completed, and either `error` or `response` is available.
				153	"error": { # The `Status` type defines a logical error model that is suitable for different programming environments, including REST APIs and RPC APIs. It is used by [gRPC](https://github.com/grpc). Each `Status` message contains three pieces of data: error code, error message, and error details. You can find out more about this error model and how to work with it in the [API Design Guide](https://cloud.google.com/apis/design/errors). # The error result of the operation in case of failure or cancellation.
				154	"code": 42, # The status code, which should be an enum value of google.rpc.Code.
				155	"details": [ # A list of messages that carry the error details. There is a common set of message types for APIs to use.
				156	{
				157	"a_key": "", # Properties of the object. Contains field @type with type URL.
				158	},
				159	],
				160	"message": "A String", # A developer-facing error message, which should be in English. Any user-facing error message should be localized and sent in the google.rpc.Status.details field, or localized by the client.
				161	},
				162	"metadata": { # Service-specific metadata associated with the operation. It typically contains progress information and common metadata such as create time. Some services might not provide such metadata. Any method that returns a long-running operation should document the metadata type, if any.
				163	"a_key": "", # Properties of the object. Contains field @type with type URL.
				164	},
				165	"name": "A String", # The server-assigned name, which is only unique within the same service that originally returns it. If you use the default HTTP mapping, the `name` should be a resource name ending with `operations/{unique_id}`.
				166	"response": { # The normal response of the operation in case of success. If the original method returns no data on success, such as `Delete`, the response is `google.protobuf.Empty`. If the original method is standard `Get`/`Create`/`Update`, the response should be the resource. For other methods, the response should have the type `XxxResponse`, where `Xxx` is the original method name. For example, if the original method name is `TakeSnapshot()`, the inferred response type is `TakeSnapshotResponse`.
				167	"a_key": "", # Properties of the object. Contains field @type with type URL.
				168	},
				169	}</pre>
				170	</div>
				171
				172	<div class="method">
				173	<code class="details" id="delete">delete(name, x__xgafv=None)</code>
				174	<pre>Deletes a WorkloadIdentityPoolProvider. Deleting a provider does not revoke credentials that have already been issued; they continue to grant access. You can undelete a provider for 30 days. After 30 days, deletion is permanent. You cannot update deleted providers. However, you can view and list them.
				175
				176	Args:
				177	name: string, Required. The name of the provider to delete. (required)
				178	x__xgafv: string, V1 error format.
				179	Allowed values
				180	1 - v1 error format
				181	2 - v2 error format
				182
				183	Returns:
				184	An object of the form:
				185
				186	{ # This resource represents a long-running operation that is the result of a network API call.
				187	"done": True or False, # If the value is `false`, it means the operation is still in progress. If `true`, the operation is completed, and either `error` or `response` is available.
				188	"error": { # The `Status` type defines a logical error model that is suitable for different programming environments, including REST APIs and RPC APIs. It is used by [gRPC](https://github.com/grpc). Each `Status` message contains three pieces of data: error code, error message, and error details. You can find out more about this error model and how to work with it in the [API Design Guide](https://cloud.google.com/apis/design/errors). # The error result of the operation in case of failure or cancellation.
				189	"code": 42, # The status code, which should be an enum value of google.rpc.Code.
				190	"details": [ # A list of messages that carry the error details. There is a common set of message types for APIs to use.
				191	{
				192	"a_key": "", # Properties of the object. Contains field @type with type URL.
				193	},
				194	],
				195	"message": "A String", # A developer-facing error message, which should be in English. Any user-facing error message should be localized and sent in the google.rpc.Status.details field, or localized by the client.
				196	},
				197	"metadata": { # Service-specific metadata associated with the operation. It typically contains progress information and common metadata such as create time. Some services might not provide such metadata. Any method that returns a long-running operation should document the metadata type, if any.
				198	"a_key": "", # Properties of the object. Contains field @type with type URL.
				199	},
				200	"name": "A String", # The server-assigned name, which is only unique within the same service that originally returns it. If you use the default HTTP mapping, the `name` should be a resource name ending with `operations/{unique_id}`.
				201	"response": { # The normal response of the operation in case of success. If the original method returns no data on success, such as `Delete`, the response is `google.protobuf.Empty`. If the original method is standard `Get`/`Create`/`Update`, the response should be the resource. For other methods, the response should have the type `XxxResponse`, where `Xxx` is the original method name. For example, if the original method name is `TakeSnapshot()`, the inferred response type is `TakeSnapshotResponse`.
				202	"a_key": "", # Properties of the object. Contains field @type with type URL.
				203	},
				204	}</pre>
				205	</div>
				206
				207	<div class="method">
				208	<code class="details" id="get">get(name, x__xgafv=None)</code>
				209	<pre>Gets an individual WorkloadIdentityPoolProvider.
				210
				211	Args:
				212	name: string, Required. The name of the provider to retrieve. (required)
				213	x__xgafv: string, V1 error format.
				214	Allowed values
				215	1 - v1 error format
				216	2 - v2 error format
				217
				218	Returns:
				219	An object of the form:
				220
				221	{ # A configuration for an external identity provider.
				222	"attributeCondition": "A String", # [A Common Expression Language](https://opensource.google/projects/cel) expression, in plain text, to restrict what otherwise valid authentication credentials issued by the provider should not be accepted. The expression must output a boolean representing whether to allow the federation. The following keywords may be referenced in the expressions: * `assertion`: JSON representing the authentication credential issued by the provider. * `google`: The Google attributes mapped from the assertion in the `attribute_mappings`. * `attribute`: The custom attributes mapped from the assertion in the `attribute_mappings`. The maximum length of the attribute condition expression is 4096 characters. If unspecified, all valid authentication credential are accepted. The following example shows how to only allow credentials with a mapped `google.groups` value of `admins`: ``` "'admins' in google.groups" ```
				223	"attributeMapping": { # Maps attributes from authentication credentials issued by an external identity provider to Google Cloud attributes, such as `subject` and `segment`. Each key must be a string specifying the Google Cloud IAM attribute to map to. The following keys are supported: * `google.subject`: The principal IAM is authenticating. You can reference this value in IAM bindings. This is also the subject that appears in Cloud Logging logs. Cannot exceed 127 characters. * `google.groups`: Groups the external identity belongs to. You can grant groups access to resources using an IAM `principalSet` binding; access applies to all members of the group. You can also provide custom attributes by specifying `attribute.{custom_attribute}`, where `{custom_attribute}` is the name of the custom attribute to be mapped. You can define a maximum of 50 custom attributes. The maximum length of a mapped attribute key is 100 characters, and the key may only contain the characters [a-z0-9_]. You can reference these attributes in IAM policies to define fine-grained access for a workload to Google Cloud resources. For example: * `google.subject`: `principal://iam.googleapis.com/projects/{project}/locations/{location}/workloadIdentityPools/{pool}/subject/{value}` * `google.groups`: `principalSet://iam.googleapis.com/projects/{project}/locations/{location}/workloadIdentityPools/{pool}/group/{value}` * `attribute.{custom_attribute}`: `principalSet://iam.googleapis.com/projects/{project}/locations/{location}/workloadIdentityPools/{pool}/attribute.{custom_attribute}/{value}` Each value must be a [Common Expression Language] (https://opensource.google/projects/cel) function that maps an identity provider credential to the normalized attribute specified by the corresponding map key. You can use the `assertion` keyword in the expression to access a JSON representation of the authentication credential issued by the provider. The maximum length of an attribute mapping expression is 2048 characters. When evaluated, the total size of all mapped attributes must not exceed 8KB. For AWS providers, if no attribute mapping is defined, the following default mapping applies: ``` { "google.subject":"assertion.arn", "attribute.aws_role": "assertion.arn.contains('assumed-role')" " ? assertion.arn.extract('{account_arn}assumed-role/')" " + 'assumed-role/'" " + assertion.arn.extract('assumed-role/{role_name}/')" " : assertion.arn", } ``` If any custom attribute mappings are defined, they must include a mapping to the `google.subject` attribute. For OIDC providers, you must supply a custom mapping, which must include the `google.subject` attribute. For example, the following maps the `sub` claim of the incoming credential to the `subject` attribute on a Google token: ``` {"google.subject": "assertion.sub"} ```
				224	"a_key": "A String",
				225	},
				226	"aws": { # Represents an Amazon Web Services identity provider. # An Amazon Web Services identity provider.
				227	"accountId": "A String", # Required. The AWS account ID.
				228	},
				229	"description": "A String", # A description for the provider. Cannot exceed 256 characters.
				230	"disabled": True or False, # Whether the provider is disabled. You cannot use a disabled provider to exchange tokens. However, existing tokens still grant access.
				231	"displayName": "A String", # A display name for the provider. Cannot exceed 32 characters.
				232	"name": "A String", # Output only. The resource name of the provider.
				233	"oidc": { # Represents an OpenId Connect 1.0 identity provider. # An OpenId Connect 1.0 identity provider.
				234	"allowedAudiences": [ # Acceptable values for the `aud` field (audience) in the OIDC token. Token exchange requests are rejected if the token audience does not match one of the configured values. Each audience may be at most 256 characters. A maximum of 10 audiences may be configured. If this list is empty, the OIDC token audience must be equal to the full canonical resource name of the WorkloadIdentityPoolProvider, with or without the HTTPS prefix. For example: ``` //iam.googleapis.com/projects//locations//workloadIdentityPools//providers/ https://iam.googleapis.com/projects//locations//workloadIdentityPools//providers/ ```
				235	"A String",
				236	],
yoshi-code-bot	73a0aa3	2021-05-25 00:30:03 -0700	[diff] [blame]	237	"issuerUri": "A String", # Required. The OIDC issuer URL. Must be an HTTPS endpoint.
yoshi-code-bot	b6dc1b9	2021-03-02 11:49:08 -0800	[diff] [blame]	238	},
				239	"state": "A String", # Output only. The state of the provider.
				240	}</pre>
				241	</div>
				242
				243	<div class="method">
				244	<code class="details" id="list">list(parent, pageSize=None, pageToken=None, showDeleted=None, x__xgafv=None)</code>
				245	<pre>Lists all non-deleted WorkloadIdentityPoolProviders in a WorkloadIdentityPool. If `show_deleted` is set to `true`, then deleted providers are also listed.
				246
				247	Args:
				248	parent: string, Required. The pool to list providers for. (required)
				249	pageSize: integer, The maximum number of providers to return. If unspecified, at most 50 providers are returned. The maximum value is 100; values above 100 are truncated to 100.
				250	pageToken: string, A page token, received from a previous `ListWorkloadIdentityPoolProviders` call. Provide this to retrieve the subsequent page.
				251	showDeleted: boolean, Whether to return soft-deleted providers.
				252	x__xgafv: string, V1 error format.
				253	Allowed values
				254	1 - v1 error format
				255	2 - v2 error format
				256
				257	Returns:
				258	An object of the form:
				259
				260	{ # Response message for ListWorkloadIdentityPoolProviders.
				261	"nextPageToken": "A String", # A token, which can be sent as `page_token` to retrieve the next page. If this field is omitted, there are no subsequent pages.
				262	"workloadIdentityPoolProviders": [ # A list of providers.
				263	{ # A configuration for an external identity provider.
				264	"attributeCondition": "A String", # [A Common Expression Language](https://opensource.google/projects/cel) expression, in plain text, to restrict what otherwise valid authentication credentials issued by the provider should not be accepted. The expression must output a boolean representing whether to allow the federation. The following keywords may be referenced in the expressions: * `assertion`: JSON representing the authentication credential issued by the provider. * `google`: The Google attributes mapped from the assertion in the `attribute_mappings`. * `attribute`: The custom attributes mapped from the assertion in the `attribute_mappings`. The maximum length of the attribute condition expression is 4096 characters. If unspecified, all valid authentication credential are accepted. The following example shows how to only allow credentials with a mapped `google.groups` value of `admins`: ``` "'admins' in google.groups" ```
				265	"attributeMapping": { # Maps attributes from authentication credentials issued by an external identity provider to Google Cloud attributes, such as `subject` and `segment`. Each key must be a string specifying the Google Cloud IAM attribute to map to. The following keys are supported: * `google.subject`: The principal IAM is authenticating. You can reference this value in IAM bindings. This is also the subject that appears in Cloud Logging logs. Cannot exceed 127 characters. * `google.groups`: Groups the external identity belongs to. You can grant groups access to resources using an IAM `principalSet` binding; access applies to all members of the group. You can also provide custom attributes by specifying `attribute.{custom_attribute}`, where `{custom_attribute}` is the name of the custom attribute to be mapped. You can define a maximum of 50 custom attributes. The maximum length of a mapped attribute key is 100 characters, and the key may only contain the characters [a-z0-9_]. You can reference these attributes in IAM policies to define fine-grained access for a workload to Google Cloud resources. For example: * `google.subject`: `principal://iam.googleapis.com/projects/{project}/locations/{location}/workloadIdentityPools/{pool}/subject/{value}` * `google.groups`: `principalSet://iam.googleapis.com/projects/{project}/locations/{location}/workloadIdentityPools/{pool}/group/{value}` * `attribute.{custom_attribute}`: `principalSet://iam.googleapis.com/projects/{project}/locations/{location}/workloadIdentityPools/{pool}/attribute.{custom_attribute}/{value}` Each value must be a [Common Expression Language] (https://opensource.google/projects/cel) function that maps an identity provider credential to the normalized attribute specified by the corresponding map key. You can use the `assertion` keyword in the expression to access a JSON representation of the authentication credential issued by the provider. The maximum length of an attribute mapping expression is 2048 characters. When evaluated, the total size of all mapped attributes must not exceed 8KB. For AWS providers, if no attribute mapping is defined, the following default mapping applies: ``` { "google.subject":"assertion.arn", "attribute.aws_role": "assertion.arn.contains('assumed-role')" " ? assertion.arn.extract('{account_arn}assumed-role/')" " + 'assumed-role/'" " + assertion.arn.extract('assumed-role/{role_name}/')" " : assertion.arn", } ``` If any custom attribute mappings are defined, they must include a mapping to the `google.subject` attribute. For OIDC providers, you must supply a custom mapping, which must include the `google.subject` attribute. For example, the following maps the `sub` claim of the incoming credential to the `subject` attribute on a Google token: ``` {"google.subject": "assertion.sub"} ```
				266	"a_key": "A String",
				267	},
				268	"aws": { # Represents an Amazon Web Services identity provider. # An Amazon Web Services identity provider.
				269	"accountId": "A String", # Required. The AWS account ID.
				270	},
				271	"description": "A String", # A description for the provider. Cannot exceed 256 characters.
				272	"disabled": True or False, # Whether the provider is disabled. You cannot use a disabled provider to exchange tokens. However, existing tokens still grant access.
				273	"displayName": "A String", # A display name for the provider. Cannot exceed 32 characters.
				274	"name": "A String", # Output only. The resource name of the provider.
				275	"oidc": { # Represents an OpenId Connect 1.0 identity provider. # An OpenId Connect 1.0 identity provider.
				276	"allowedAudiences": [ # Acceptable values for the `aud` field (audience) in the OIDC token. Token exchange requests are rejected if the token audience does not match one of the configured values. Each audience may be at most 256 characters. A maximum of 10 audiences may be configured. If this list is empty, the OIDC token audience must be equal to the full canonical resource name of the WorkloadIdentityPoolProvider, with or without the HTTPS prefix. For example: ``` //iam.googleapis.com/projects//locations//workloadIdentityPools//providers/ https://iam.googleapis.com/projects//locations//workloadIdentityPools//providers/ ```
				277	"A String",
				278	],
yoshi-code-bot	73a0aa3	2021-05-25 00:30:03 -0700	[diff] [blame]	279	"issuerUri": "A String", # Required. The OIDC issuer URL. Must be an HTTPS endpoint.
yoshi-code-bot	b6dc1b9	2021-03-02 11:49:08 -0800	[diff] [blame]	280	},
				281	"state": "A String", # Output only. The state of the provider.
				282	},
				283	],
				284	}</pre>
				285	</div>
				286
				287	<div class="method">
				288	<code class="details" id="list_next">list_next(previous_request, previous_response)</code>
				289	<pre>Retrieves the next page of results.
				290
				291	Args:
				292	previous_request: The request for the previous page. (required)
				293	previous_response: The response from the request for the previous page. (required)
				294
				295	Returns:
				296	A request object that you can call 'execute()' on to request the next
				297	page. Returns None if there are no more items in the collection.
				298	</pre>
				299	</div>
				300
				301	<div class="method">
				302	<code class="details" id="patch">patch(name, body=None, updateMask=None, x__xgafv=None)</code>
				303	<pre>Updates an existing WorkloadIdentityPoolProvider.
				304
				305	Args:
				306	name: string, Output only. The resource name of the provider. (required)
				307	body: object, The request body.
				308	The object takes the form of:
				309
				310	{ # A configuration for an external identity provider.
				311	"attributeCondition": "A String", # [A Common Expression Language](https://opensource.google/projects/cel) expression, in plain text, to restrict what otherwise valid authentication credentials issued by the provider should not be accepted. The expression must output a boolean representing whether to allow the federation. The following keywords may be referenced in the expressions: * `assertion`: JSON representing the authentication credential issued by the provider. * `google`: The Google attributes mapped from the assertion in the `attribute_mappings`. * `attribute`: The custom attributes mapped from the assertion in the `attribute_mappings`. The maximum length of the attribute condition expression is 4096 characters. If unspecified, all valid authentication credential are accepted. The following example shows how to only allow credentials with a mapped `google.groups` value of `admins`: ``` "'admins' in google.groups" ```
				312	"attributeMapping": { # Maps attributes from authentication credentials issued by an external identity provider to Google Cloud attributes, such as `subject` and `segment`. Each key must be a string specifying the Google Cloud IAM attribute to map to. The following keys are supported: * `google.subject`: The principal IAM is authenticating. You can reference this value in IAM bindings. This is also the subject that appears in Cloud Logging logs. Cannot exceed 127 characters. * `google.groups`: Groups the external identity belongs to. You can grant groups access to resources using an IAM `principalSet` binding; access applies to all members of the group. You can also provide custom attributes by specifying `attribute.{custom_attribute}`, where `{custom_attribute}` is the name of the custom attribute to be mapped. You can define a maximum of 50 custom attributes. The maximum length of a mapped attribute key is 100 characters, and the key may only contain the characters [a-z0-9_]. You can reference these attributes in IAM policies to define fine-grained access for a workload to Google Cloud resources. For example: * `google.subject`: `principal://iam.googleapis.com/projects/{project}/locations/{location}/workloadIdentityPools/{pool}/subject/{value}` * `google.groups`: `principalSet://iam.googleapis.com/projects/{project}/locations/{location}/workloadIdentityPools/{pool}/group/{value}` * `attribute.{custom_attribute}`: `principalSet://iam.googleapis.com/projects/{project}/locations/{location}/workloadIdentityPools/{pool}/attribute.{custom_attribute}/{value}` Each value must be a [Common Expression Language] (https://opensource.google/projects/cel) function that maps an identity provider credential to the normalized attribute specified by the corresponding map key. You can use the `assertion` keyword in the expression to access a JSON representation of the authentication credential issued by the provider. The maximum length of an attribute mapping expression is 2048 characters. When evaluated, the total size of all mapped attributes must not exceed 8KB. For AWS providers, if no attribute mapping is defined, the following default mapping applies: ``` { "google.subject":"assertion.arn", "attribute.aws_role": "assertion.arn.contains('assumed-role')" " ? assertion.arn.extract('{account_arn}assumed-role/')" " + 'assumed-role/'" " + assertion.arn.extract('assumed-role/{role_name}/')" " : assertion.arn", } ``` If any custom attribute mappings are defined, they must include a mapping to the `google.subject` attribute. For OIDC providers, you must supply a custom mapping, which must include the `google.subject` attribute. For example, the following maps the `sub` claim of the incoming credential to the `subject` attribute on a Google token: ``` {"google.subject": "assertion.sub"} ```
				313	"a_key": "A String",
				314	},
				315	"aws": { # Represents an Amazon Web Services identity provider. # An Amazon Web Services identity provider.
				316	"accountId": "A String", # Required. The AWS account ID.
				317	},
				318	"description": "A String", # A description for the provider. Cannot exceed 256 characters.
				319	"disabled": True or False, # Whether the provider is disabled. You cannot use a disabled provider to exchange tokens. However, existing tokens still grant access.
				320	"displayName": "A String", # A display name for the provider. Cannot exceed 32 characters.
				321	"name": "A String", # Output only. The resource name of the provider.
				322	"oidc": { # Represents an OpenId Connect 1.0 identity provider. # An OpenId Connect 1.0 identity provider.
				323	"allowedAudiences": [ # Acceptable values for the `aud` field (audience) in the OIDC token. Token exchange requests are rejected if the token audience does not match one of the configured values. Each audience may be at most 256 characters. A maximum of 10 audiences may be configured. If this list is empty, the OIDC token audience must be equal to the full canonical resource name of the WorkloadIdentityPoolProvider, with or without the HTTPS prefix. For example: ``` //iam.googleapis.com/projects//locations//workloadIdentityPools//providers/ https://iam.googleapis.com/projects//locations//workloadIdentityPools//providers/ ```
				324	"A String",
				325	],
yoshi-code-bot	73a0aa3	2021-05-25 00:30:03 -0700	[diff] [blame]	326	"issuerUri": "A String", # Required. The OIDC issuer URL. Must be an HTTPS endpoint.
yoshi-code-bot	b6dc1b9	2021-03-02 11:49:08 -0800	[diff] [blame]	327	},
				328	"state": "A String", # Output only. The state of the provider.
				329	}
				330
				331	updateMask: string, Required. The list of fields to update.
				332	x__xgafv: string, V1 error format.
				333	Allowed values
				334	1 - v1 error format
				335	2 - v2 error format
				336
				337	Returns:
				338	An object of the form:
				339
				340	{ # This resource represents a long-running operation that is the result of a network API call.
				341	"done": True or False, # If the value is `false`, it means the operation is still in progress. If `true`, the operation is completed, and either `error` or `response` is available.
				342	"error": { # The `Status` type defines a logical error model that is suitable for different programming environments, including REST APIs and RPC APIs. It is used by [gRPC](https://github.com/grpc). Each `Status` message contains three pieces of data: error code, error message, and error details. You can find out more about this error model and how to work with it in the [API Design Guide](https://cloud.google.com/apis/design/errors). # The error result of the operation in case of failure or cancellation.
				343	"code": 42, # The status code, which should be an enum value of google.rpc.Code.
				344	"details": [ # A list of messages that carry the error details. There is a common set of message types for APIs to use.
				345	{
				346	"a_key": "", # Properties of the object. Contains field @type with type URL.
				347	},
				348	],
				349	"message": "A String", # A developer-facing error message, which should be in English. Any user-facing error message should be localized and sent in the google.rpc.Status.details field, or localized by the client.
				350	},
				351	"metadata": { # Service-specific metadata associated with the operation. It typically contains progress information and common metadata such as create time. Some services might not provide such metadata. Any method that returns a long-running operation should document the metadata type, if any.
				352	"a_key": "", # Properties of the object. Contains field @type with type URL.
				353	},
				354	"name": "A String", # The server-assigned name, which is only unique within the same service that originally returns it. If you use the default HTTP mapping, the `name` should be a resource name ending with `operations/{unique_id}`.
				355	"response": { # The normal response of the operation in case of success. If the original method returns no data on success, such as `Delete`, the response is `google.protobuf.Empty`. If the original method is standard `Get`/`Create`/`Update`, the response should be the resource. For other methods, the response should have the type `XxxResponse`, where `Xxx` is the original method name. For example, if the original method name is `TakeSnapshot()`, the inferred response type is `TakeSnapshotResponse`.
				356	"a_key": "", # Properties of the object. Contains field @type with type URL.
				357	},
				358	}</pre>
				359	</div>
				360
				361	<div class="method">
				362	<code class="details" id="undelete">undelete(name, body=None, x__xgafv=None)</code>
				363	<pre>Undeletes a WorkloadIdentityPoolProvider, as long as it was deleted fewer than 30 days ago.
				364
				365	Args:
				366	name: string, Required. The name of the provider to undelete. (required)
				367	body: object, The request body.
				368	The object takes the form of:
				369
				370	{ # Request message for UndeleteWorkloadIdentityPoolProvider.
				371	}
				372
				373	x__xgafv: string, V1 error format.
				374	Allowed values
				375	1 - v1 error format
				376	2 - v2 error format
				377
				378	Returns:
				379	An object of the form:
				380
				381	{ # This resource represents a long-running operation that is the result of a network API call.
				382	"done": True or False, # If the value is `false`, it means the operation is still in progress. If `true`, the operation is completed, and either `error` or `response` is available.
				383	"error": { # The `Status` type defines a logical error model that is suitable for different programming environments, including REST APIs and RPC APIs. It is used by [gRPC](https://github.com/grpc). Each `Status` message contains three pieces of data: error code, error message, and error details. You can find out more about this error model and how to work with it in the [API Design Guide](https://cloud.google.com/apis/design/errors). # The error result of the operation in case of failure or cancellation.
				384	"code": 42, # The status code, which should be an enum value of google.rpc.Code.
				385	"details": [ # A list of messages that carry the error details. There is a common set of message types for APIs to use.
				386	{
				387	"a_key": "", # Properties of the object. Contains field @type with type URL.
				388	},
				389	],
				390	"message": "A String", # A developer-facing error message, which should be in English. Any user-facing error message should be localized and sent in the google.rpc.Status.details field, or localized by the client.
				391	},
				392	"metadata": { # Service-specific metadata associated with the operation. It typically contains progress information and common metadata such as create time. Some services might not provide such metadata. Any method that returns a long-running operation should document the metadata type, if any.
				393	"a_key": "", # Properties of the object. Contains field @type with type URL.
				394	},
				395	"name": "A String", # The server-assigned name, which is only unique within the same service that originally returns it. If you use the default HTTP mapping, the `name` should be a resource name ending with `operations/{unique_id}`.
				396	"response": { # The normal response of the operation in case of success. If the original method returns no data on success, such as `Delete`, the response is `google.protobuf.Empty`. If the original method is standard `Get`/`Create`/`Update`, the response should be the resource. For other methods, the response should have the type `XxxResponse`, where `Xxx` is the original method name. For example, if the original method name is `TakeSnapshot()`, the inferred response type is `TakeSnapshotResponse`.
				397	"a_key": "", # Properties of the object. Contains field @type with type URL.
				398	},
				399	}</pre>
				400	</div>
				401
Dmitry Frenkel	3e17f89	2020-10-06 16:46:05 -0700	[diff] [blame]	402	</body></html>