Blame - docs/dyn/iap_v1.v1.html - platform/external/python/google-api-python-client

"corsSettings": { # Allows customers to configure HTTP request paths that'll allow HTTP OPTIONS # Configuration to allow cross-origin requests via IAP.

373

# call to bypass authentication and authorization.

374

"allowHttpOptions": True or False, # Configuration to allow HTTP OPTIONS calls to skip authorization. If

375

# undefined, IAP will not apply any special logic to OPTIONS requests.

376

},

377

"policyDelegationSettings": { # PolicyDelegationConfig allows google-internal teams to use IAP for apps # Settings to configure Policy delegation for apps hosted in tenant projects.

378

# INTERNAL_ONLY.

379

# hosted in a tenant project. Using these settings, the app can delegate

380

# permission check to happen against the linked customer project.

381

# This is only ever supposed to be used by google internal teams, hence the

382

# restriction on the proto.

383

"policyName": { # Policy name to be checked

384

"region": "A String", # For Cloud IAM:

385

# The location of the Policy.

386

# Must be empty or "global" for Policies owned by global IAM. Must name a

387

# region from prodspec/cloud-iam-cloudspec for Regional IAM Policies, see

388

# http://go/iam-faq#where-is-iam-currently-deployed.

389

#

390

# For Local IAM:

391

# This field should be set to "local".

392

"type": "A String", # Valid values for type might be 'gce', 'gcs', 'project', 'account' etc.

393

"id": "A String",

394

},

395

"iamPermission": "A String", # Permission to check in IAM.

396

"resource": { # IAM resource to check permission on

397

"labels": { # The service defined labels of the resource on which the conditions will be

398

# evaluated. The semantics - including the key names - are vague to IAM.

399

# If the effective condition has a reference to a `resource.labels[foo]`

400

# construct, IAM consults with this map to retrieve the values associated

401

# with `foo` key for Conditions evaluation. If the provided key is not found

402

# in the labels map, the condition would evaluate to false.

403

#

404

# This field is in limited use. If your intended use case is not expected

405

# to express resource.labels attribute in IAM Conditions, leave this field

406

# empty. Before planning on using this attribute please:

407

# * Read go/iam-conditions-labels-comm and ensure your service can meet the

408

# data availability and management requirements.

409

# * Talk to iam-conditions-eng@ about your use case.

410

"a_key": "A String",

411

},

412

"type": "A String", # The public resource type name of the resource on which conditions will be

413

# evaluated. It is configured using the official_name of the ResourceType as

414

# defined in service configurations under //configs/cloud/resourcetypes.

415

# For example, the official_name for GCP projects is set as

416

# 'cloudresourcemanager.googleapis.com/Project' according to

417

# //configs/cloud/resourcetypes/google/cloud/resourcemanager/prod.yaml

418

# For details see go/iam-conditions-integration-guide.

419

"name": "A String", # Name of the resource on which conditions will be evaluated.

420

# Must use the Relative Resource Name of the resource, which is the URI

421

# path of the resource without the leading "/". Examples are

422

# "projects/_/buckets/[BUCKET-ID]" for storage buckets or

423

# "projects/[PROJECT-ID]/global/firewalls/[FIREWALL-ID]" for a firewall.

424

#

425

# This field is required for evaluating conditions with rules on resource

426

# names. For a `list` permission check, the resource.name value must be set

427

# to the parent resource. If the parent resource is a project, this field

428

# should be left unset.

429

"service": "A String", # The name of the service this resource belongs to. It is configured using

430

# the official_service_name of the Service as defined in service

431

# configurations under //configs/cloud/resourcetypes.

432

# For example, the official_service_name of cloud resource manager service

433

# is set as 'cloudresourcemanager.googleapis.com' according to

434

# //configs/cloud/resourcetypes/google/cloud/resourcemanager/prod.yaml

435

},

436

"iamServiceName": "A String", # The DNS name of the service (e.g. "resourcemanager.googleapis.com").

437

# This should be the domain name part of the full resource names (see

438

# https://aip.dev/122#full-resource-names), which is usually

439

# the same as IamServiceSpec.service of the service where the resource type

440

# is defined.

441

},

442

"gcipSettings": { # Allows customers to configure tenant_id for GCIP instance per-app. # GCIP claims and endpoint configurations for 3p identity providers.

443

"loginPageUri": "A String", # Login page URI associated with the GCIP tenants.

444

# Typically, all resources within the same project share the same login page,

445

# though it could be overridden at the sub resource level.

446

"tenantIds": [ # GCIP tenant ids that are linked to the IAP resource.

447

# tenant_ids could be a string beginning with a number character to indicate

448

# authenticating with GCIP tenant flow, or in the format of _<ProjectNumber>

449

# to indicate authenticating with GCIP agent flow.

450

# If agent flow is used, tenant_ids should only contain one single element,

451

# while for tenant flow, tenant_ids can contain multiple elements.

"A String",

],

},

},

"name": "A String", # Required. The resource name of the IAP protected resource.

}</pre>

</div>

<code class="details" id="setIamPolicy">setIamPolicy(resource, body=None, x__xgafv=None)</code>

462

<pre>Sets the access control policy for an Identity-Aware Proxy protected

463

resource. Replaces any existing policy.

464

More information about managing access via IAP can be found at:

465

https://cloud.google.com/iap/docs/managing-access#managing_access_via_the_api

466

467

Args:

468

resource: string, REQUIRED: The resource for which the policy is being specified.

469

See the operation documentation for the appropriate value for this field. (required)

470

body: object, The request body.

471

The object takes the form of:

472

473

{ # Request message for `SetIamPolicy` method.

474

"policy": { # An Identity and Access Management (IAM) policy, which specifies access # REQUIRED: The complete policy to be applied to the `resource`. The size of

475

# the policy is limited to a few 10s of KB. An empty policy is a

476

# valid policy but certain Cloud Platform services (such as Projects)

477

# might reject them.

478

# controls for Google Cloud resources.

479

#

480

#

481

# A `Policy` is a collection of `bindings`. A `binding` binds one or more

482

# `members` to a single `role`. Members can be user accounts, service accounts,

483

# Google groups, and domains (such as G Suite). A `role` is a named list of

484

# permissions; each `role` can be an IAM predefined role or a user-created

485

# custom role.

486

#

487

# Optionally, a `binding` can specify a `condition`, which is a logical

488

# expression that allows access to a resource only if the expression evaluates

489

# to `true`. A condition can add constraints based on attributes of the

490

# request, the resource, or both.

#

# **JSON example:**

#

# {

# "bindings": [

# {

# "role": "roles/resourcemanager.organizationAdmin",

498

# "members": [

499

# "user:mike@example.com",

500

# "group:admins@example.com",

501

# "domain:google.com",

502

# "serviceAccount:my-project-id@appspot.gserviceaccount.com"

# ]

# },

# {

# "role": "roles/resourcemanager.organizationViewer",

507

# "members": ["user:eve@example.com"],

508

# "condition": {

509

# "title": "expirable access",

510

# "description": "Does not grant access after Sep 2020",

511

# "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')",

# }

# }

# ],

# "etag": "BwWWja0YfJA=",

# "version": 3

# }

#

# **YAML example:**

#

# bindings:

# - members:

# - user:mike@example.com

524

# - group:admins@example.com

525

# - domain:google.com

526

# - serviceAccount:my-project-id@appspot.gserviceaccount.com

527

# role: roles/resourcemanager.organizationAdmin

528

# - members:

529

# - user:eve@example.com

530

# role: roles/resourcemanager.organizationViewer

531

# condition:

532

# title: expirable access

533

# description: Does not grant access after Sep 2020

534

# expression: request.time < timestamp('2020-10-01T00:00:00.000Z')

535

# - etag: BwWWja0YfJA=

536

# - version: 3

537

#

538

# For a description of IAM and its features, see the

539

# [IAM documentation](https://cloud.google.com/iam/docs/).

540

"bindings": [ # Associates a list of `members` to a `role`. Optionally, may specify a

541

# `condition` that determines how and when the `bindings` are applied. Each

542

# of the `bindings` must contain at least one member.

543

{ # Associates `members` with a `role`.

544

"role": "A String", # Role that is assigned to `members`.

545

# For example, `roles/viewer`, `roles/editor`, or `roles/owner`.

546

"members": [ # Specifies the identities requesting access for a Cloud Platform resource.

547

# `members` can have the following values:

548

#

549

# * `allUsers`: A special identifier that represents anyone who is

550

# on the internet; with or without a Google account.

551

#

552

# * `allAuthenticatedUsers`: A special identifier that represents anyone

553

# who is authenticated with a Google account or a service account.

554

#

555

# * `user:{emailid}`: An email address that represents a specific Google

556

# account. For example, `alice@example.com` .

557

#

558

#

559

# * `serviceAccount:{emailid}`: An email address that represents a service

560

# account. For example, `my-other-app@appspot.gserviceaccount.com`.

561

#

562

# * `group:{emailid}`: An email address that represents a Google group.

563

# For example, `admins@example.com`.

564

#

565

# * `deleted:user:{emailid}?uid={uniqueid}`: An email address (plus unique

566

# identifier) representing a user that has been recently deleted. For

567

# example, `alice@example.com?uid=123456789012345678901`. If the user is

568

# recovered, this value reverts to `user:{emailid}` and the recovered user

569

# retains the role in the binding.

570

#

571

# * `deleted:serviceAccount:{emailid}?uid={uniqueid}`: An email address (plus

572

# unique identifier) representing a service account that has been recently

573

# deleted. For example,

574

# `my-other-app@appspot.gserviceaccount.com?uid=123456789012345678901`.

575

# If the service account is undeleted, this value reverts to

576

# `serviceAccount:{emailid}` and the undeleted service account retains the

577

# role in the binding.

578

#

579

# * `deleted:group:{emailid}?uid={uniqueid}`: An email address (plus unique

580

# identifier) representing a Google group that has been recently

581

# deleted. For example, `admins@example.com?uid=123456789012345678901`. If

582

# the group is recovered, this value reverts to `group:{emailid}` and the

583

# recovered group retains the role in the binding.

584

#

585

#

586

# * `domain:{domain}`: The G Suite domain (primary) that represents all the

587

# users of that domain. For example, `google.com` or `example.com`.

#

"A String",

],

"condition": { # Represents a textual expression in the Common Expression Language (CEL) # The condition that is associated with this binding.

592

# NOTE: An unsatisfied condition will not allow user access via current

593

# binding. Different bindings, including their conditions, are examined

594

# independently.

595

# syntax. CEL is a C-like expression language. The syntax and semantics of CEL

596

# are documented at https://github.com/google/cel-spec.

597

#

598

# Example (Comparison):

599

#

600

# title: "Summary size limit"

601

# description: "Determines if a summary is less than 100 chars"

602

# expression: "document.summary.size() < 100"

603

#

604

# Example (Equality):

605

#

606

# title: "Requestor is owner"

607

# description: "Determines if requestor is the document owner"

608

# expression: "document.owner == request.auth.claims.email"

#

# Example (Logic):

#

# title: "Public documents"

613

# description: "Determine whether the document should be publicly visible"

614

# expression: "document.type != 'private' && document.type != 'internal'"

615

#

616

# Example (Data Manipulation):

617

#

618

# title: "Notification string"

619

# description: "Create a notification string with a timestamp."

620

# expression: "'New message received at ' + string(document.create_time)"

621

#

622

# The exact variables and functions that may be referenced within an expression

623

# are determined by the service that evaluates it. See the service

624

# documentation for additional information.

625

"description": "A String", # Optional. Description of the expression. This is a longer text which

626

# describes the expression, e.g. when hovered over it in a UI.

627

"expression": "A String", # Textual representation of an expression in Common Expression Language

628

# syntax.

629

"location": "A String", # Optional. String indicating the location of the expression for error

630

# reporting, e.g. a file name and a position in the file.

631

"title": "A String", # Optional. Title for the expression, i.e. a short string describing

632

# its purpose. This can be used e.g. in UIs which allow to enter the

# expression.

},

},

],

"etag": "A String", # `etag` is used for optimistic concurrency control as a way to help

638

# prevent simultaneous updates of a policy from overwriting each other.

639

# It is strongly suggested that systems make use of the `etag` in the

640

# read-modify-write cycle to perform policy updates in order to avoid race

641

# conditions: An `etag` is returned in the response to `getIamPolicy`, and

642

# systems are expected to put that etag in the request to `setIamPolicy` to

643

# ensure that their change will be applied to the same version of the policy.

644

#

645

# **Important:** If you use IAM Conditions, you must include the `etag` field

646

# whenever you call `setIamPolicy`. If you omit this field, then IAM allows

647

# you to overwrite a version `3` policy with a version `1` policy, and all of

648

# the conditions in the version `3` policy are lost.

649

"version": 42, # Specifies the format of the policy.

650

#

651

# Valid values are `0`, `1`, and `3`. Requests that specify an invalid value

652

# are rejected.

653

#

654

# Any operation that affects conditional role bindings must specify version

655

# `3`. This requirement applies to the following operations:

656

#

657

# * Getting a policy that includes a conditional role binding

658

# * Adding a conditional role binding to a policy

659

# * Changing a conditional role binding in a policy

660

# * Removing any role binding, with or without a condition, from a policy

661

# that includes conditions

662

#

663

# **Important:** If you use IAM Conditions, you must include the `etag` field

664

# whenever you call `setIamPolicy`. If you omit this field, then IAM allows

665

# you to overwrite a version `3` policy with a version `1` policy, and all of

666

# the conditions in the version `3` policy are lost.

667

#

668

# If a policy does not include any conditions, operations on that policy may

669

# specify any valid version or leave the field unset.

},

}

x__xgafv: string, V1 error format.

Allowed values

1 - v1 error format

2 - v2 error format

Returns:

An object of the form:

680

681

{ # An Identity and Access Management (IAM) policy, which specifies access

682

# controls for Google Cloud resources.

683

#

684

#

685

# A `Policy` is a collection of `bindings`. A `binding` binds one or more

686

# `members` to a single `role`. Members can be user accounts, service accounts,

687

# Google groups, and domains (such as G Suite). A `role` is a named list of

688

# permissions; each `role` can be an IAM predefined role or a user-created

689

# custom role.

690

#

691

# Optionally, a `binding` can specify a `condition`, which is a logical

692

# expression that allows access to a resource only if the expression evaluates

693

# to `true`. A condition can add constraints based on attributes of the

694

# request, the resource, or both.

#

# **JSON example:**

#

# {

# "bindings": [

# {

# "role": "roles/resourcemanager.organizationAdmin",

702

# "members": [

703

# "user:mike@example.com",

704

# "group:admins@example.com",

705

# "domain:google.com",

706

# "serviceAccount:my-project-id@appspot.gserviceaccount.com"

# ]

# },

# {

# "role": "roles/resourcemanager.organizationViewer",

711

# "members": ["user:eve@example.com"],

712

# "condition": {

713

# "title": "expirable access",

714

# "description": "Does not grant access after Sep 2020",

715

# "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')",

# }

# }

# ],

# "etag": "BwWWja0YfJA=",

# "version": 3

# }

#

# **YAML example:**

#

# bindings:

# - members:

# - user:mike@example.com

728

# - group:admins@example.com

729

# - domain:google.com

730

# - serviceAccount:my-project-id@appspot.gserviceaccount.com

731

# role: roles/resourcemanager.organizationAdmin

732

# - members:

733

# - user:eve@example.com

734

# role: roles/resourcemanager.organizationViewer

735

# condition:

736

# title: expirable access

737

# description: Does not grant access after Sep 2020

738

# expression: request.time < timestamp('2020-10-01T00:00:00.000Z')

739

# - etag: BwWWja0YfJA=

740

# - version: 3

741

#

742

# For a description of IAM and its features, see the

743

# [IAM documentation](https://cloud.google.com/iam/docs/).

744

"bindings": [ # Associates a list of `members` to a `role`. Optionally, may specify a

745

# `condition` that determines how and when the `bindings` are applied. Each

746

# of the `bindings` must contain at least one member.

747

{ # Associates `members` with a `role`.

748

"role": "A String", # Role that is assigned to `members`.

749

# For example, `roles/viewer`, `roles/editor`, or `roles/owner`.

750

"members": [ # Specifies the identities requesting access for a Cloud Platform resource.

751

# `members` can have the following values:

752

#

753

# * `allUsers`: A special identifier that represents anyone who is

754

# on the internet; with or without a Google account.

755

#

756

# * `allAuthenticatedUsers`: A special identifier that represents anyone

757

# who is authenticated with a Google account or a service account.

758

#

759

# * `user:{emailid}`: An email address that represents a specific Google

760

# account. For example, `alice@example.com` .

761

#

762

#

763

# * `serviceAccount:{emailid}`: An email address that represents a service

764

# account. For example, `my-other-app@appspot.gserviceaccount.com`.

765

#

766

# * `group:{emailid}`: An email address that represents a Google group.

767

# For example, `admins@example.com`.

768

#

769

# * `deleted:user:{emailid}?uid={uniqueid}`: An email address (plus unique

770

# identifier) representing a user that has been recently deleted. For

771

# example, `alice@example.com?uid=123456789012345678901`. If the user is

772

# recovered, this value reverts to `user:{emailid}` and the recovered user

773

# retains the role in the binding.

774

#

775

# * `deleted:serviceAccount:{emailid}?uid={uniqueid}`: An email address (plus

776

# unique identifier) representing a service account that has been recently

777

# deleted. For example,

778

# `my-other-app@appspot.gserviceaccount.com?uid=123456789012345678901`.

779

# If the service account is undeleted, this value reverts to

780

# `serviceAccount:{emailid}` and the undeleted service account retains the

781

# role in the binding.

782

#

783

# * `deleted:group:{emailid}?uid={uniqueid}`: An email address (plus unique

784

# identifier) representing a Google group that has been recently

785

# deleted. For example, `admins@example.com?uid=123456789012345678901`. If

786

# the group is recovered, this value reverts to `group:{emailid}` and the

787

# recovered group retains the role in the binding.

788

#

789

#

790

# * `domain:{domain}`: The G Suite domain (primary) that represents all the

791

# users of that domain. For example, `google.com` or `example.com`.

#

"A String",

],

"condition": { # Represents a textual expression in the Common Expression Language (CEL) # The condition that is associated with this binding.

796

# NOTE: An unsatisfied condition will not allow user access via current

797

# binding. Different bindings, including their conditions, are examined

798

# independently.

799

# syntax. CEL is a C-like expression language. The syntax and semantics of CEL

800

# are documented at https://github.com/google/cel-spec.

801

#

802

# Example (Comparison):

803

#

804

# title: "Summary size limit"

805

# description: "Determines if a summary is less than 100 chars"

806

# expression: "document.summary.size() < 100"

807

#

808

# Example (Equality):

809

#

810

# title: "Requestor is owner"

811

# description: "Determines if requestor is the document owner"

812

# expression: "document.owner == request.auth.claims.email"

#

# Example (Logic):

#

# title: "Public documents"

817

# description: "Determine whether the document should be publicly visible"

818

# expression: "document.type != 'private' && document.type != 'internal'"

819

#

820

# Example (Data Manipulation):

821

#

822

# title: "Notification string"

823

# description: "Create a notification string with a timestamp."

824

# expression: "'New message received at ' + string(document.create_time)"

825

#

826

# The exact variables and functions that may be referenced within an expression

827

# are determined by the service that evaluates it. See the service

828

# documentation for additional information.

829

"description": "A String", # Optional. Description of the expression. This is a longer text which

830

# describes the expression, e.g. when hovered over it in a UI.

831

"expression": "A String", # Textual representation of an expression in Common Expression Language

832

# syntax.

833

"location": "A String", # Optional. String indicating the location of the expression for error

834

# reporting, e.g. a file name and a position in the file.

835

"title": "A String", # Optional. Title for the expression, i.e. a short string describing

836

# its purpose. This can be used e.g. in UIs which allow to enter the

# expression.

},

},

],

"etag": "A String", # `etag` is used for optimistic concurrency control as a way to help

842

# prevent simultaneous updates of a policy from overwriting each other.

843

# It is strongly suggested that systems make use of the `etag` in the

844

# read-modify-write cycle to perform policy updates in order to avoid race

845

# conditions: An `etag` is returned in the response to `getIamPolicy`, and

846

# systems are expected to put that etag in the request to `setIamPolicy` to

847

# ensure that their change will be applied to the same version of the policy.

848

#

849

# **Important:** If you use IAM Conditions, you must include the `etag` field

850

# whenever you call `setIamPolicy`. If you omit this field, then IAM allows

851

# you to overwrite a version `3` policy with a version `1` policy, and all of

852

# the conditions in the version `3` policy are lost.

853

"version": 42, # Specifies the format of the policy.

854

#

855

# Valid values are `0`, `1`, and `3`. Requests that specify an invalid value

856

# are rejected.

857

#

858

# Any operation that affects conditional role bindings must specify version

859

# `3`. This requirement applies to the following operations:

860

#

861

# * Getting a policy that includes a conditional role binding

862

# * Adding a conditional role binding to a policy

863

# * Changing a conditional role binding in a policy

864

# * Removing any role binding, with or without a condition, from a policy

865

# that includes conditions

866

#

867

# **Important:** If you use IAM Conditions, you must include the `etag` field

868

# whenever you call `setIamPolicy`. If you omit this field, then IAM allows

869

# you to overwrite a version `3` policy with a version `1` policy, and all of

870

# the conditions in the version `3` policy are lost.

871

#

872

# If a policy does not include any conditions, operations on that policy may

873

# specify any valid version or leave the field unset.

}</pre>

</div>

<code class="details" id="testIamPermissions">testIamPermissions(resource, body=None, x__xgafv=None)</code>

Bu Sun Kim

715bd7f

2019-06-14 16:50:42 -0700

[diff] [blame]

879

<pre>Returns permissions that a caller has on the Identity-Aware Proxy protected

880

resource.

881

More information about managing access via IAP can be found at:

882

https://cloud.google.com/iap/docs/managing-access#managing_access_via_the_api

883

884

Args:

885

resource: string, REQUIRED: The resource for which the policy detail is being requested.

886

See the operation documentation for the appropriate value for this field. (required)

Dan O'Meara

dd49464

2020-05-01 07:42:23 -0700

[diff] [blame^]

887

body: object, The request body.

Bu Sun Kim

715bd7f

2019-06-14 16:50:42 -0700

[diff] [blame]

888

The object takes the form of:

889

890

{ # Request message for `TestIamPermissions` method.

891

"permissions": [ # The set of permissions to check for the `resource`. Permissions with

892

# wildcards (such as '*' or 'storage.*') are not allowed. For more

893

# information see

894

# [IAM Overview](https://cloud.google.com/iam/docs/overview#permissions).

"A String",

],

}

x__xgafv: string, V1 error format.

Allowed values

1 - v1 error format

2 - v2 error format

Returns:

An object of the form:

906

907

{ # Response message for `TestIamPermissions` method.

908

"permissions": [ # A subset of `TestPermissionsRequest.permissions` that the caller is

# allowed.

"A String",

],

}</pre>

</div>

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame^]

915

916

<code class="details" id="updateIapSettings">updateIapSettings(name, body=None, updateMask=None, x__xgafv=None)</code>

917

<pre>Updates the IAP settings on a particular IAP protected resource. It

918

replaces all fields unless the `update_mask` is set.

919

920

Args:

921

name: string, Required. The resource name of the IAP protected resource. (required)

922

body: object, The request body.

923

The object takes the form of:

924

925

{ # The IAP configurable settings.

926

"applicationSettings": { # Wrapper over application specific settings for IAP. # Top level wrapper for all application related settings in IAP

927

"accessDeniedPageSettings": { # Custom content configuration for access denied page. # Customization for Access Denied page.

928

# IAP allows customers to define a custom URI to use as the error page when

929

# access is denied to users. If IAP prevents access to this page, the default

930

# IAP error page will be displayed instead.

931

"accessDeniedPageUri": "A String", # The URI to be redirected to when access is denied.

932

},

933

"csmSettings": { # Configuration for RCTokens generated for CSM workloads protected by IAP. # Settings to configure IAP's behavior for a CSM mesh.

934

# RCTokens are IAP generated JWTs that can be verified at the application. The

935

# RCToken is primarily used for ISTIO deployments, and can be scoped to a

936

# single mesh by configuring the audience field accordingly

937

"rctokenAud": "A String", # Audience claim set in the generated RCToken. This value is not validated by

# IAP.

},

},

"accessSettings": { # Access related settings for IAP protected apps. # Top level wrapper for all access related setting in IAP

942

"oauthSettings": { # Configuration for OAuth login&consent flow behavior as well as for OAuth # Settings to configure IAP's OAuth behavior.

943

# Credentials.

944

"loginHint": "A String", # Domain hint to send as hd=? parameter in OAuth request flow. Enables

945

# redirect to primary IDP by skipping Google's login screen.

946

# https://developers.google.com/identity/protocols/OpenIDConnect#hd-param

947

# Note: IAP does not verify that the id token's hd claim matches this value

948

# since access behavior is managed by IAM policies.

949

"clientId": "A String", # OAuth 2.0 client ID used in the OAuth flow to generate an access token. If

950

# this field is set, you can skip obtaining the OAuth credentials in this

951

# step:

952

# https://developers.google.com/identity/protocols/OAuth2?hl=en_US#1.-obtain-oauth-2.0-credentials-from-the-google-api-console.

953

# However, this could allow for client sharing. The risks of client sharing

954

# are outlined here:

955

# https://cloud.google.com/iap/docs/sharing-oauth-clients#risks.

956

},

957

"corsSettings": { # Allows customers to configure HTTP request paths that'll allow HTTP OPTIONS # Configuration to allow cross-origin requests via IAP.

958

# call to bypass authentication and authorization.

959

"allowHttpOptions": True or False, # Configuration to allow HTTP OPTIONS calls to skip authorization. If

960

# undefined, IAP will not apply any special logic to OPTIONS requests.

961

},

962

"policyDelegationSettings": { # PolicyDelegationConfig allows google-internal teams to use IAP for apps # Settings to configure Policy delegation for apps hosted in tenant projects.

963

# INTERNAL_ONLY.

964

# hosted in a tenant project. Using these settings, the app can delegate

965

# permission check to happen against the linked customer project.

966

# This is only ever supposed to be used by google internal teams, hence the

967

# restriction on the proto.

968

"policyName": { # Policy name to be checked

969

"region": "A String", # For Cloud IAM:

970

# The location of the Policy.

971

# Must be empty or "global" for Policies owned by global IAM. Must name a

972

# region from prodspec/cloud-iam-cloudspec for Regional IAM Policies, see

973

# http://go/iam-faq#where-is-iam-currently-deployed.

974

#

975

# For Local IAM:

976

# This field should be set to "local".

977

"type": "A String", # Valid values for type might be 'gce', 'gcs', 'project', 'account' etc.

978

"id": "A String",

979

},

980

"iamPermission": "A String", # Permission to check in IAM.

981

"resource": { # IAM resource to check permission on

982

"labels": { # The service defined labels of the resource on which the conditions will be

983

# evaluated. The semantics - including the key names - are vague to IAM.

984

# If the effective condition has a reference to a `resource.labels[foo]`

985

# construct, IAM consults with this map to retrieve the values associated

986

# with `foo` key for Conditions evaluation. If the provided key is not found

987

# in the labels map, the condition would evaluate to false.

988

#

989

# This field is in limited use. If your intended use case is not expected

990

# to express resource.labels attribute in IAM Conditions, leave this field

991

# empty. Before planning on using this attribute please:

992

# * Read go/iam-conditions-labels-comm and ensure your service can meet the

993

# data availability and management requirements.

994

# * Talk to iam-conditions-eng@ about your use case.

995

"a_key": "A String",

996

},

997

"type": "A String", # The public resource type name of the resource on which conditions will be

998

# evaluated. It is configured using the official_name of the ResourceType as

999

# defined in service configurations under //configs/cloud/resourcetypes.

1000

# For example, the official_name for GCP projects is set as

1001

# 'cloudresourcemanager.googleapis.com/Project' according to

1002

# //configs/cloud/resourcetypes/google/cloud/resourcemanager/prod.yaml

1003

# For details see go/iam-conditions-integration-guide.

1004

"name": "A String", # Name of the resource on which conditions will be evaluated.

1005

# Must use the Relative Resource Name of the resource, which is the URI

1006

# path of the resource without the leading "/". Examples are

1007

# "projects/_/buckets/[BUCKET-ID]" for storage buckets or

1008

# "projects/[PROJECT-ID]/global/firewalls/[FIREWALL-ID]" for a firewall.

1009

#

1010

# This field is required for evaluating conditions with rules on resource

1011

# names. For a `list` permission check, the resource.name value must be set

1012

# to the parent resource. If the parent resource is a project, this field

1013

# should be left unset.

1014

"service": "A String", # The name of the service this resource belongs to. It is configured using

1015

# the official_service_name of the Service as defined in service

1016

# configurations under //configs/cloud/resourcetypes.

1017

# For example, the official_service_name of cloud resource manager service

1018

# is set as 'cloudresourcemanager.googleapis.com' according to

1019

# //configs/cloud/resourcetypes/google/cloud/resourcemanager/prod.yaml

1020

},

1021

"iamServiceName": "A String", # The DNS name of the service (e.g. "resourcemanager.googleapis.com").

1022

# This should be the domain name part of the full resource names (see

1023

# https://aip.dev/122#full-resource-names), which is usually

1024

# the same as IamServiceSpec.service of the service where the resource type

1025

# is defined.

1026

},

1027

"gcipSettings": { # Allows customers to configure tenant_id for GCIP instance per-app. # GCIP claims and endpoint configurations for 3p identity providers.

1028

"loginPageUri": "A String", # Login page URI associated with the GCIP tenants.

1029

# Typically, all resources within the same project share the same login page,

1030

# though it could be overridden at the sub resource level.

1031

"tenantIds": [ # GCIP tenant ids that are linked to the IAP resource.

1032

# tenant_ids could be a string beginning with a number character to indicate

1033

# authenticating with GCIP tenant flow, or in the format of _<ProjectNumber>

1034

# to indicate authenticating with GCIP agent flow.

1035

# If agent flow is used, tenant_ids should only contain one single element,

1036

# while for tenant flow, tenant_ids can contain multiple elements.

"A String",

],

},

},

"name": "A String", # Required. The resource name of the IAP protected resource.

1042

}

1043

1044

updateMask: string, The field mask specifying which IAP settings should be updated.

1045

If omitted, the all of the settings are updated. See

1046

https://developers.google.com/protocol-buffers/docs/reference/google.protobuf#fieldmask

1047

x__xgafv: string, V1 error format.

Allowed values

1 - v1 error format

2 - v2 error format

Returns:

An object of the form:

1054

1055

{ # The IAP configurable settings.

1056

"applicationSettings": { # Wrapper over application specific settings for IAP. # Top level wrapper for all application related settings in IAP

1057

"accessDeniedPageSettings": { # Custom content configuration for access denied page. # Customization for Access Denied page.

1058

# IAP allows customers to define a custom URI to use as the error page when

1059

# access is denied to users. If IAP prevents access to this page, the default

1060

# IAP error page will be displayed instead.

1061

"accessDeniedPageUri": "A String", # The URI to be redirected to when access is denied.

1062

},

1063

"csmSettings": { # Configuration for RCTokens generated for CSM workloads protected by IAP. # Settings to configure IAP's behavior for a CSM mesh.

1064

# RCTokens are IAP generated JWTs that can be verified at the application. The

1065

# RCToken is primarily used for ISTIO deployments, and can be scoped to a

1066

# single mesh by configuring the audience field accordingly

1067

"rctokenAud": "A String", # Audience claim set in the generated RCToken. This value is not validated by

# IAP.

},

},

"accessSettings": { # Access related settings for IAP protected apps. # Top level wrapper for all access related setting in IAP

1072

"oauthSettings": { # Configuration for OAuth login&consent flow behavior as well as for OAuth # Settings to configure IAP's OAuth behavior.

1073

# Credentials.

1074

"loginHint": "A String", # Domain hint to send as hd=? parameter in OAuth request flow. Enables

1075

# redirect to primary IDP by skipping Google's login screen.

1076

# https://developers.google.com/identity/protocols/OpenIDConnect#hd-param

1077

# Note: IAP does not verify that the id token's hd claim matches this value

1078

# since access behavior is managed by IAM policies.

1079

"clientId": "A String", # OAuth 2.0 client ID used in the OAuth flow to generate an access token. If

1080

# this field is set, you can skip obtaining the OAuth credentials in this

1081

# step:

1082

# https://developers.google.com/identity/protocols/OAuth2?hl=en_US#1.-obtain-oauth-2.0-credentials-from-the-google-api-console.

1083

# However, this could allow for client sharing. The risks of client sharing

1084

# are outlined here:

1085

# https://cloud.google.com/iap/docs/sharing-oauth-clients#risks.

1086

},

1087

"corsSettings": { # Allows customers to configure HTTP request paths that'll allow HTTP OPTIONS # Configuration to allow cross-origin requests via IAP.

1088

# call to bypass authentication and authorization.

1089

"allowHttpOptions": True or False, # Configuration to allow HTTP OPTIONS calls to skip authorization. If

1090

# undefined, IAP will not apply any special logic to OPTIONS requests.

1091

},

1092

"policyDelegationSettings": { # PolicyDelegationConfig allows google-internal teams to use IAP for apps # Settings to configure Policy delegation for apps hosted in tenant projects.

1093

# INTERNAL_ONLY.

1094

# hosted in a tenant project. Using these settings, the app can delegate

1095

# permission check to happen against the linked customer project.

1096

# This is only ever supposed to be used by google internal teams, hence the

1097

# restriction on the proto.

1098

"policyName": { # Policy name to be checked

1099

"region": "A String", # For Cloud IAM:

1100

# The location of the Policy.

1101

# Must be empty or "global" for Policies owned by global IAM. Must name a

1102

# region from prodspec/cloud-iam-cloudspec for Regional IAM Policies, see

1103

# http://go/iam-faq#where-is-iam-currently-deployed.

1104

#

1105

# For Local IAM:

1106

# This field should be set to "local".

1107

"type": "A String", # Valid values for type might be 'gce', 'gcs', 'project', 'account' etc.

1108

"id": "A String",

1109

},

1110

"iamPermission": "A String", # Permission to check in IAM.

1111

"resource": { # IAM resource to check permission on

1112

"labels": { # The service defined labels of the resource on which the conditions will be

1113

# evaluated. The semantics - including the key names - are vague to IAM.

1114

# If the effective condition has a reference to a `resource.labels[foo]`

1115

# construct, IAM consults with this map to retrieve the values associated

1116

# with `foo` key for Conditions evaluation. If the provided key is not found

1117

# in the labels map, the condition would evaluate to false.

1118

#

1119

# This field is in limited use. If your intended use case is not expected

1120

# to express resource.labels attribute in IAM Conditions, leave this field

1121

# empty. Before planning on using this attribute please:

1122

# * Read go/iam-conditions-labels-comm and ensure your service can meet the

1123

# data availability and management requirements.

1124

# * Talk to iam-conditions-eng@ about your use case.

1125

"a_key": "A String",

1126

},

1127

"type": "A String", # The public resource type name of the resource on which conditions will be

1128

# evaluated. It is configured using the official_name of the ResourceType as

1129

# defined in service configurations under //configs/cloud/resourcetypes.

1130

# For example, the official_name for GCP projects is set as

1131

# 'cloudresourcemanager.googleapis.com/Project' according to

1132

# //configs/cloud/resourcetypes/google/cloud/resourcemanager/prod.yaml

1133

# For details see go/iam-conditions-integration-guide.

1134

"name": "A String", # Name of the resource on which conditions will be evaluated.

1135

# Must use the Relative Resource Name of the resource, which is the URI

1136

# path of the resource without the leading "/". Examples are

1137

# "projects/_/buckets/[BUCKET-ID]" for storage buckets or

1138

# "projects/[PROJECT-ID]/global/firewalls/[FIREWALL-ID]" for a firewall.

1139

#

1140

# This field is required for evaluating conditions with rules on resource

1141

# names. For a `list` permission check, the resource.name value must be set

1142

# to the parent resource. If the parent resource is a project, this field

1143

# should be left unset.

1144

"service": "A String", # The name of the service this resource belongs to. It is configured using

1145

# the official_service_name of the Service as defined in service

1146

# configurations under //configs/cloud/resourcetypes.

1147

# For example, the official_service_name of cloud resource manager service

1148

# is set as 'cloudresourcemanager.googleapis.com' according to

1149

# //configs/cloud/resourcetypes/google/cloud/resourcemanager/prod.yaml

1150

},

1151

"iamServiceName": "A String", # The DNS name of the service (e.g. "resourcemanager.googleapis.com").

1152

# This should be the domain name part of the full resource names (see

1153

# https://aip.dev/122#full-resource-names), which is usually

1154

# the same as IamServiceSpec.service of the service where the resource type

1155

# is defined.

1156

},

1157

"gcipSettings": { # Allows customers to configure tenant_id for GCIP instance per-app. # GCIP claims and endpoint configurations for 3p identity providers.

1158

"loginPageUri": "A String", # Login page URI associated with the GCIP tenants.

1159

# Typically, all resources within the same project share the same login page,

1160

# though it could be overridden at the sub resource level.

1161

"tenantIds": [ # GCIP tenant ids that are linked to the IAP resource.

1162

# tenant_ids could be a string beginning with a number character to indicate

1163

# authenticating with GCIP tenant flow, or in the format of _<ProjectNumber>