Gitiles
Code Review Sign In
gerrit-public.fairphone.software / platform / external / python / google-api-python-client / 7700bbffda386345cc4426ef413fc643f6368ef4 / . / docs / dyn / sts_v1.v1.html
blob: 46b10c306eb1c84be56cb93989f559f9e9a2b5ec [file] [log] [blame]
Dmitry Frenkel3e17f892020-10-06 16:46:05 -0700[diff] [blame]1<html><body>
2<style>
3
4body, h1, h2, h3, div, span, p, pre, a {
5 margin: 0;
6 padding: 0;
7 border: 0;
8 font-weight: inherit;
9 font-style: inherit;
10 font-size: 100%;
11 font-family: inherit;
12 vertical-align: baseline;
13}
14
15body {
16 font-size: 13px;
17 padding: 1em;
18}
19
20h1 {
21 font-size: 26px;
22 margin-bottom: 1em;
23}
24
25h2 {
26 font-size: 24px;
27 margin-bottom: 1em;
28}
29
30h3 {
31 font-size: 20px;
32 margin-bottom: 1em;
33 margin-top: 1em;
34}
35
36pre, code {
37 line-height: 1.5;
38 font-family: Monaco, 'DejaVu Sans Mono', 'Bitstream Vera Sans Mono', 'Lucida Console', monospace;
39}
40
41pre {
42 margin-top: 0.5em;
43}
44
45h1, h2, h3, p {
46 font-family: Arial, sans serif;
47}
48
49h1, h2, h3 {
50 border-bottom: solid #CCC 1px;
51}
52
53.toc_element {
54 margin-top: 0.5em;
55}
56
57.firstline {
58 margin-left: 2 em;
59}
60
61.method {
62 margin-top: 1em;
63 border: solid 1px #CCC;
64 padding: 1em;
65 background: #EEE;
66}
67
68.details {
69 font-weight: bold;
70 font-size: 14px;
71}
72
73</style>
74
75<h1><a href="sts_v1.html">Security Token Service API</a> . <a href="sts_v1.v1.html">v1</a></h1>
76<h2>Instance Methods</h2>
77<p class="toc_element">
78 <code><a href="#close">close()</a></code></p>
79<p class="firstline">Close httplib2 connections.</p>
80<p class="toc_element">
81 <code><a href="#token">token(body=None, x__xgafv=None)</a></code></p>
yoshi-code-botb6dc1b92021-03-02 11:49:08 -0800[diff] [blame]82<p class="firstline">Exchanges a credential for a Google OAuth 2.0 access token. The token asserts an external identity within a workload identity pool, or it applies a Credential Access Boundary to a Google access token. When you call this method, do not send the `Authorization` HTTP header in the request. This method does not require the `Authorization` header, and using the header can cause the request to fail.</p>
Dmitry Frenkel3e17f892020-10-06 16:46:05 -0700[diff] [blame]83<h3>Method Details</h3>
84<div class="method">
85 <code class="details" id="close">close()</code>
86 <pre>Close httplib2 connections.</pre>
87</div>
88
89<div class="method">
90 <code class="details" id="token">token(body=None, x__xgafv=None)</code>
yoshi-code-botb6dc1b92021-03-02 11:49:08 -0800[diff] [blame]91 <pre>Exchanges a credential for a Google OAuth 2.0 access token. The token asserts an external identity within a workload identity pool, or it applies a Credential Access Boundary to a Google access token. When you call this method, do not send the `Authorization` HTTP header in the request. This method does not require the `Authorization` header, and using the header can cause the request to fail.
Dmitry Frenkel3e17f892020-10-06 16:46:05 -0700[diff] [blame]92
93Args:
94 body: object, The request body.
95 The object takes the form of:
96
97{ # Request message for ExchangeToken.
yoshi-code-botb6dc1b92021-03-02 11:49:08 -0800[diff] [blame]98 &quot;audience&quot;: &quot;A String&quot;, # The full resource name of the identity provider; for example: `//iam.googleapis.com/projects//workloadIdentityPools//providers/`. Required when exchanging an external credential for a Google access token.
Yoshi Automation Botcc94ec82021-01-15 07:10:04 -0800[diff] [blame]99 &quot;grantType&quot;: &quot;A String&quot;, # Required. The grant type. Must be `urn:ietf:params:oauth:grant-type:token-exchange`, which indicates a token exchange.
100 &quot;options&quot;: &quot;A String&quot;, # A set of features that Security Token Service supports, in addition to the standard OAuth 2.0 token exchange, formatted as a serialized JSON object of Options.
101 &quot;requestedTokenType&quot;: &quot;A String&quot;, # Required. An identifier for the type of requested security token. Must be `urn:ietf:params:oauth:token-type:access_token`.
yoshi-code-botb6dc1b92021-03-02 11:49:08 -0800[diff] [blame]102 &quot;scope&quot;: &quot;A String&quot;, # The OAuth 2.0 scopes to include on the resulting access token, formatted as a list of space-delimited, case-sensitive strings. Required when exchanging an external credential for a Google access token.
yoshi-code-botc2cd3262021-05-16 02:16:04 -0700[diff] [blame]103 &quot;subjectToken&quot;: &quot;A String&quot;, # Required. The input token. This token is a either an external credential issued by a workload identity pool provider, or a short-lived access token issued by Google. If the token is an OIDC JWT, it must use the JWT format defined in [RFC 7523](https://tools.ietf.org/html/rfc7523), and the `subject_token_type` must be `urn:ietf:params:oauth:token-type:jwt`. The following headers are required: - `kid`: The identifier of the signing key securing the JWT. - `alg`: The cryptographic algorithm securing the JWT. Must be `RS256` or `ES256`. The following payload fields are required. For more information, see [RFC 7523, Section 3](https://tools.ietf.org/html/rfc7523#section-3): - `iss`: The issuer of the token. The issuer must provide a discovery document at the URL `/.well-known/openid-configuration`, where `` is the value of this field. The document must be formatted according to section 4.2 of the [OIDC 1.0 Discovery specification](https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderConfigurationResponse). - `iat`: The issue time, in seconds, since the Unix epoch. Must be in the past. - `exp`: The expiration time, in seconds, since the Unix epoch. Must be less than 48 hours after `iat`. Shorter expiration times are more secure. If possible, we recommend setting an expiration time less than 6 hours. - `sub`: The identity asserted in the JWT. - `aud`: For workload identity pools, this must be a value specified in the allowed audiences for the workload identity pool provider, or one of the audiences allowed by default if no audiences were specified. See https://cloud.google.com/iam/docs/reference/rest/v1/projects.locations.workloadIdentityPools.providers#oidc Example header: ``` { &quot;alg&quot;: &quot;RS256&quot;, &quot;kid&quot;: &quot;us-east-11&quot; } ``` Example payload: ``` { &quot;iss&quot;: &quot;https://accounts.google.com&quot;, &quot;iat&quot;: 1517963104, &quot;exp&quot;: 1517966704, &quot;aud&quot;: &quot;//iam.googleapis.com/projects/1234567890123/locations/global/workloadIdentityPools/my-pool/providers/my-provider&quot;, &quot;sub&quot;: &quot;113475438248934895348&quot;, &quot;my_claims&quot;: { &quot;additional_claim&quot;: &quot;value&quot; } } ``` If `subject_token` is for AWS, it must be a serialized `GetCallerIdentity` token. This token contains the same information as a request to the AWS [`GetCallerIdentity()`](https://docs.aws.amazon.com/STS/latest/APIReference/API_GetCallerIdentity) method, as well as the AWS [signature](https://docs.aws.amazon.com/general/latest/gr/signing_aws_api_requests.html) for the request information. Use Signature Version 4. Format the request as URL-encoded JSON, and set the `subject_token_type` parameter to `urn:ietf:params:aws:token-type:aws4_request`. The following parameters are required: - `url`: The URL of the AWS STS endpoint for `GetCallerIdentity()`, such as `https://sts.amazonaws.com?Action=GetCallerIdentity&amp;Version=2011-06-15`. Regional endpoints are also supported. - `method`: The HTTP request method: `POST`. - `headers`: The HTTP request headers, which must include: - `Authorization`: The request signature. - `x-amz-date`: The time you will send the request, formatted as an [ISO8601 Basic](https://docs.aws.amazon.com/general/latest/gr/sigv4_elements.html#sigv4_elements_date) string. This value is typically set to the current time and is used to help prevent replay attacks. - `host`: The hostname of the `url` field; for example, `sts.amazonaws.com`. - `x-goog-cloud-target-resource`: The full, canonical resource name of the workload identity pool provider, with or without an `https:` prefix. To help ensure data integrity, we recommend including this header in the `SignedHeaders` field of the signed request. For example: //iam.googleapis.com/projects//locations//workloadIdentityPools//providers/ https://iam.googleapis.com/projects//locations//workloadIdentityPools//providers/ If you are using temporary security credentials provided by AWS, you must also include the header `x-amz-security-token`, with the value set to the session token. The following example shows a `GetCallerIdentity` token: ``` { &quot;headers&quot;: [ {&quot;key&quot;: &quot;x-amz-date&quot;, &quot;value&quot;: &quot;20200815T015049Z&quot;}, {&quot;key&quot;: &quot;Authorization&quot;, &quot;value&quot;: &quot;AWS4-HMAC-SHA256+Credential=$credential,+SignedHeaders=host;x-amz-date;x-goog-cloud-target-resource,+Signature=$signature&quot;}, {&quot;key&quot;: &quot;x-goog-cloud-target-resource&quot;, &quot;value&quot;: &quot;//iam.googleapis.com/projects//locations//workloadIdentityPools//providers/&quot;}, {&quot;key&quot;: &quot;host&quot;, &quot;value&quot;: &quot;sts.amazonaws.com&quot;} . ], &quot;method&quot;: &quot;POST&quot;, &quot;url&quot;: &quot;https://sts.amazonaws.com?Action=GetCallerIdentity&amp;Version=2011-06-15&quot; } ``` You can also use a Google-issued OAuth 2.0 access token with this field to obtain an access token with new security attributes applied, such as a Credential Access Boundary. In this case, set `subject_token_type` to `urn:ietf:params:oauth:token-type:access_token`. If an access token already contains security attributes, you cannot apply additional security attributes.
yoshi-code-botb6dc1b92021-03-02 11:49:08 -0800[diff] [blame]104 &quot;subjectTokenType&quot;: &quot;A String&quot;, # Required. An identifier that indicates the type of the security token in the `subject_token` parameter. Supported values are `urn:ietf:params:oauth:token-type:jwt`, `urn:ietf:params:aws:token-type:aws4_request`, and `urn:ietf:params:oauth:token-type:access_token`.
Yoshi Automation Botcc94ec82021-01-15 07:10:04 -0800[diff] [blame]105}
Dmitry Frenkel3e17f892020-10-06 16:46:05 -0700[diff] [blame]106
107 x__xgafv: string, V1 error format.
108 Allowed values
109 1 - v1 error format
110 2 - v2 error format
111
112Returns:
113 An object of the form:
114
115 { # Response message for ExchangeToken.
yoshi-code-botb6dc1b92021-03-02 11:49:08 -0800[diff] [blame]116 &quot;access_token&quot;: &quot;A String&quot;, # An OAuth 2.0 security token, issued by Google, in response to the token exchange request. Tokens can vary in size, depending in part on the size of mapped claims, up to a maximum of 12288 bytes (12 KB). Google reserves the right to change the token size and the maximum length at any time.
117 &quot;expires_in&quot;: 42, # The amount of time, in seconds, between the time when the access token was issued and the time when the access token will expire. This field is absent when the `subject_token` in the request is a Google-issued, short-lived access token. In this case, the access token has the same expiration time as the `subject_token`.
Yoshi Automation Botcc94ec82021-01-15 07:10:04 -0800[diff] [blame]118 &quot;issued_token_type&quot;: &quot;A String&quot;, # The token type. Always matches the value of `requested_token_type` from the request.
yoshi-code-botb6dc1b92021-03-02 11:49:08 -0800[diff] [blame]119 &quot;token_type&quot;: &quot;A String&quot;, # The type of access token. Always has the value `Bearer`.
Yoshi Automation Botcc94ec82021-01-15 07:10:04 -0800[diff] [blame]120}</pre>
Dmitry Frenkel3e17f892020-10-06 16:46:05 -0700[diff] [blame]121</div>
122
123</body></html>