@@ -98,6 +98,14 @@ service IdentityAwareProxyAdminService {
9898 };
9999 }
100100
101+ // Validates that a given CEL expression conforms to IAP restrictions.
102+ rpc ValidateIapAttributeExpression (ValidateIapAttributeExpressionRequest )
103+ returns (ValidateIapAttributeExpressionResponse ) {
104+ option (google.api.http ) = {
105+ post : "/v1/{name=**}:validateAttributeExpression"
106+ };
107+ }
108+
101109 // Lists the existing TunnelDestGroups. To group across all locations, use a
102110 // `-` as the location ID. For example:
103111 // `/v1/projects/123/iap_tunnel/locations/-/destGroups`
@@ -342,19 +350,21 @@ message TunnelDestGroup {
342350 pattern : "projects/{project}/iap_tunnel/locations/{location}/destGroups/{dest_group}"
343351 };
344352
345- // Required. Immutable. Identifier for the TunnelDestGroup. Must be unique
346- // within the project and contain only lower case letters (a-z) and dashes
347- // (-).
348- string name = 1 [
349- (google.api.field_behavior ) = REQUIRED ,
350- (google.api.field_behavior ) = IMMUTABLE
351- ];
353+ // Identifier. Identifier for the TunnelDestGroup. Must be unique within the
354+ // project and contain only lower case letters (a-z) and dashes (-).
355+ string name = 1 [(google.api.field_behavior ) = IDENTIFIER ];
352356
353- // Unordered list. List of CIDRs that this group applies to.
354- repeated string cidrs = 2 [(google.api.field_behavior ) = UNORDERED_LIST ];
357+ // Optional. Unordered list. List of CIDRs that this group applies to.
358+ repeated string cidrs = 2 [
359+ (google.api.field_behavior ) = UNORDERED_LIST ,
360+ (google.api.field_behavior ) = OPTIONAL
361+ ];
355362
356- // Unordered list. List of FQDNs that this group applies to.
357- repeated string fqdns = 3 [(google.api.field_behavior ) = UNORDERED_LIST ];
363+ // Optional. Unordered list. List of FQDNs that this group applies to.
364+ repeated string fqdns = 3 [
365+ (google.api.field_behavior ) = UNORDERED_LIST ,
366+ (google.api.field_behavior ) = OPTIONAL
367+ ];
358368}
359369
360370// The request sent to GetIapSettings.
@@ -386,40 +396,67 @@ message IapSettings {
386396 // Required. The resource name of the IAP protected resource.
387397 string name = 1 [(google.api.field_behavior ) = REQUIRED ];
388398
389- // Top level wrapper for all access related setting in IAP
390- AccessSettings access_settings = 5 ;
399+ // Optional. Top level wrapper for all access related setting in IAP
400+ AccessSettings access_settings = 5 [ (google.api .field_behavior ) = OPTIONAL ] ;
391401
392- // Top level wrapper for all application related settings in IAP
393- ApplicationSettings application_settings = 6 ;
402+ // Optional. Top level wrapper for all application related settings in IAP
403+ ApplicationSettings application_settings = 6
404+ [(google.api.field_behavior ) = OPTIONAL ];
394405}
395406
396407// Access related settings for IAP protected apps.
397408message AccessSettings {
398- // GCIP claims and endpoint configurations for 3p identity providers.
399- GcipSettings gcip_settings = 1 ;
409+ // Types of identity source supported by IAP.
410+ enum IdentitySource {
411+ // IdentitySource Unspecified.
412+ // When selected, IAP relies on which identity settings are fully configured
413+ // to redirect the traffic to. The precedence order is
414+ // WorkforceIdentitySettings > GcipSettings. If none is set, default to use
415+ // Google identity.
416+ IDENTITY_SOURCE_UNSPECIFIED = 0 ;
417+
418+ // Use external identities set up on Google Cloud Workforce Identity
419+ // Federation.
420+ WORKFORCE_IDENTITY_FEDERATION = 3 ;
421+ }
422+
423+ // Optional. GCIP claims and endpoint configurations for 3p identity
424+ // providers.
425+ GcipSettings gcip_settings = 1 [(google.api.field_behavior ) = OPTIONAL ];
426+
427+ // Optional. Configuration to allow cross-origin requests via IAP.
428+ CorsSettings cors_settings = 2 [(google.api.field_behavior ) = OPTIONAL ];
429+
430+ // Optional. Settings to configure IAP's OAuth behavior.
431+ OAuthSettings oauth_settings = 3 [(google.api.field_behavior ) = OPTIONAL ];
400432
401- // Configuration to allow cross-origin requests via IAP.
402- CorsSettings cors_settings = 2 ;
433+ // Optional. Settings to configure reauthentication policies in IAP.
434+ ReauthSettings reauth_settings = 6 [ (google.api .field_behavior ) = OPTIONAL ] ;
403435
404- // Settings to configure IAP's OAuth behavior.
405- OAuthSettings oauth_settings = 3 ;
436+ // Optional. Settings to configure and enable allowed domains.
437+ AllowedDomainsSettings allowed_domains_settings = 7
438+ [(google.api.field_behavior ) = OPTIONAL ];
406439
407- // Settings to configure reauthentication policies in IAP.
408- ReauthSettings reauth_settings = 6 ;
440+ // Optional. Settings to configure the workforce identity federation,
441+ // including workforce pools and OAuth 2.0 settings.
442+ WorkforceIdentitySettings workforce_identity_settings = 9
443+ [(google.api.field_behavior ) = OPTIONAL ];
409444
410- // Settings to configure and enable allowed domains.
411- AllowedDomainsSettings allowed_domains_settings = 7 ;
445+ // Optional. Identity sources that IAP can use to authenticate the end user.
446+ // Only one identity source can be configured.
447+ repeated IdentitySource identity_sources = 10
448+ [(google.api.field_behavior ) = OPTIONAL ];
412449}
413450
414451// Allows customers to configure tenant_id for GCIP instance per-app.
415452message GcipSettings {
416- // GCIP tenant ids that are linked to the IAP resource.
453+ // Optional. GCIP tenant ids that are linked to the IAP resource.
417454 // tenant_ids could be a string beginning with a number character to indicate
418455 // authenticating with GCIP tenant flow, or in the format of _<ProjectNumber>
419456 // to indicate authenticating with GCIP agent flow.
420457 // If agent flow is used, tenant_ids should only contain one single element,
421458 // while for tenant flow, tenant_ids can contain multiple elements.
422- repeated string tenant_ids = 1 ;
459+ repeated string tenant_ids = 1 [ (google.api .field_behavior ) = OPTIONAL ] ;
423460
424461 // Login page URI associated with the GCIP tenants.
425462 // Typically, all resources within the same project share the same login page,
@@ -445,8 +482,36 @@ message OAuthSettings {
445482 // since access behavior is managed by IAM policies.
446483 google.protobuf.StringValue login_hint = 2 ;
447484
448- // List of OAuth client IDs allowed to programmatically authenticate with IAP.
449- repeated string programmatic_clients = 5 ;
485+ // Optional. List of client ids allowed to use IAP programmatically.
486+ repeated string programmatic_clients = 5
487+ [(google.api.field_behavior ) = OPTIONAL ];
488+ }
489+
490+ // WorkforceIdentitySettings allows customers to configure workforce pools and
491+ // OAuth 2.0 settings to gate their applications using a third-party IdP with
492+ // access control.
493+ message WorkforceIdentitySettings {
494+ // The workforce pool resources. Only one workforce pool is accepted.
495+ repeated string workforce_pools = 1 ;
496+
497+ // OAuth 2.0 settings for IAP to perform OIDC flow with workforce identity
498+ // federation services.
499+ OAuth2 oauth2 = 2 ;
500+ }
501+
502+ // The OAuth 2.0 Settings
503+ message OAuth2 {
504+ // The OAuth 2.0 client ID registered in the workforce identity federation
505+ // OAuth 2.0 Server.
506+ string client_id = 1 ;
507+
508+ // Input only. The OAuth 2.0 client secret created while registering the
509+ // client ID.
510+ string client_secret = 2 [(google.api.field_behavior ) = INPUT_ONLY ];
511+
512+ // Output only. SHA256 hash value for the client secret. This field is
513+ // returned by IAP when the settings are retrieved.
514+ string client_secret_sha256 = 3 [(google.api.field_behavior ) = OUTPUT_ONLY ];
450515}
451516
452517// Configuration for IAP reauthentication policies.
@@ -468,7 +533,7 @@ message ReauthSettings {
468533 ENROLLED_SECOND_FACTORS = 4 ;
469534 }
470535
471- // Type of policy in the case of hierarchial policies.
536+ // Type of policy in the case of hierarchical policies.
472537 enum PolicyType {
473538 // Default value. This value is unused.
474539 POLICY_TYPE_UNSPECIFIED = 0 ;
@@ -481,42 +546,45 @@ message ReauthSettings {
481546 DEFAULT = 2 ;
482547 }
483548
484- // Reauth method requested.
485- Method method = 1 ;
549+ // Optional. Reauth method requested.
550+ Method method = 1 [ (google.api .field_behavior ) = OPTIONAL ] ;
486551
487- // Reauth session lifetime, how long before a user has to reauthenticate
488- // again.
489- google.protobuf.Duration max_age = 2 ;
552+ // Optional. Reauth session lifetime, how long before a user has to
553+ // reauthenticate again.
554+ google.protobuf.Duration max_age = 2 [ (google.api .field_behavior ) = OPTIONAL ] ;
490555
491- // How IAP determines the effective policy in cases of hierarchial policies.
492- // Policies are merged from higher in the hierarchy to lower in the hierarchy.
493- PolicyType policy_type = 3 ;
556+ // Optional. How IAP determines the effective policy in cases of hierarchical
557+ // policies. Policies are merged from higher in the hierarchy to lower in the
558+ // hierarchy.
559+ PolicyType policy_type = 3 [(google.api.field_behavior ) = OPTIONAL ];
494560}
495561
496562// Configuration for IAP allowed domains. Lets you to restrict access to an app
497563// and allow access to only the domains that you list.
498564message AllowedDomainsSettings {
499- // Configuration for customers to opt in for the feature.
500- optional bool enable = 1 ;
565+ // Optional. Configuration for customers to opt in for the feature.
566+ optional bool enable = 1 [ (google.api .field_behavior ) = OPTIONAL ] ;
501567
502- // List of trusted domains.
503- repeated string domains = 2 ;
568+ // Optional. List of trusted domains.
569+ repeated string domains = 2 [ (google.api .field_behavior ) = OPTIONAL ] ;
504570}
505571
506572// Wrapper over application specific settings for IAP.
507573message ApplicationSettings {
508- // Settings to configure IAP's behavior for a service mesh.
509- CsmSettings csm_settings = 1 ;
574+ // Optional. Settings to configure IAP's behavior for a service mesh.
575+ CsmSettings csm_settings = 1 [ (google.api .field_behavior ) = OPTIONAL ] ;
510576
511- // Customization for Access Denied page.
512- AccessDeniedPageSettings access_denied_page_settings = 2 ;
577+ // Optional. Customization for Access Denied page.
578+ AccessDeniedPageSettings access_denied_page_settings = 2
579+ [(google.api.field_behavior ) = OPTIONAL ];
513580
514581 // The Domain value to set for cookies generated by IAP. This value is not
515582 // validated by the API, but will be ignored at runtime if invalid.
516583 google.protobuf.StringValue cookie_domain = 3 ;
517584
518- // Settings to configure attribute propagation.
519- AttributePropagationSettings attribute_propagation_settings = 4 ;
585+ // Optional. Settings to configure attribute propagation.
586+ AttributePropagationSettings attribute_propagation_settings = 4
587+ [(google.api.field_behavior ) = OPTIONAL ];
520588}
521589
522590// Configuration for RCToken generated for service mesh workloads protected by
@@ -568,9 +636,9 @@ message AttributePropagationSettings {
568636 RCTOKEN = 3 ;
569637 }
570638
571- // Raw string CEL expression. Must return a list of attributes. A maximum of
572- // 45 attributes can be selected. Expressions can select different attribute
573- // types from `attributes`: `attributes.saml_attributes`,
639+ // Optional. Raw string CEL expression. Must return a list of attributes. A
640+ // maximum of 45 attributes can be selected. Expressions can select different
641+ // attribute types from `attributes`: `attributes.saml_attributes`,
574642 // `attributes.iap_attributes`. The following functions are supported:
575643 //
576644 // - filter `<list>.filter(<iter_var>, <predicate>)`: Returns a subset of
@@ -596,19 +664,34 @@ message AttributePropagationSettings {
596664 //
597665 // Example expression: `attributes.saml_attributes.filter(x, x.name in
598666 // ['test']).append(attributes.iap_attributes.selectByName('exact').emitAs('custom').strict())`
599- optional string expression = 1 ;
667+ optional string expression = 1 [ (google.api .field_behavior ) = OPTIONAL ] ;
600668
601- // Which output credentials attributes selected by the CEL expression should
602- // be propagated in. All attributes will be fully duplicated in each selected
603- // output credential.
604- repeated OutputCredentials output_credentials = 2 ;
669+ // Optional. Which output credentials attributes selected by the CEL
670+ // expression should be propagated in. All attributes will be fully duplicated
671+ // in each selected output credential.
672+ repeated OutputCredentials output_credentials = 2
673+ [(google.api.field_behavior ) = OPTIONAL ];
605674
606- // Whether the provided attribute propagation settings should be evaluated on
607- // user requests. If set to true, attributes returned from the expression will
608- // be propagated in the set output credentials.
609- optional bool enable = 3 ;
675+ // Optional. Whether the provided attribute propagation settings should be
676+ // evaluated on user requests. If set to true, attributes returned from the
677+ // expression will be propagated in the set output credentials.
678+ optional bool enable = 3 [ (google.api .field_behavior ) = OPTIONAL ] ;
610679}
611680
681+ // Request sent to IAP Expression Linter endpoint.
682+ message ValidateIapAttributeExpressionRequest {
683+ // Required. The resource name of the IAP protected resource.
684+ string name = 1 [(google.api.field_behavior ) = REQUIRED ];
685+
686+ // Required. User input string expression. Should be of the form
687+ // `attributes.saml_attributes.filter(attribute, attribute.name in
688+ // ['{attribute_name}', '{attribute_name}'])`
689+ string expression = 2 [(google.api.field_behavior ) = REQUIRED ];
690+ }
691+
692+ // IAP Expression Linter endpoint returns empty response body.
693+ message ValidateIapAttributeExpressionResponse {}
694+
612695// The request sent to ListBrands.
613696message ListBrandsRequest {
614697 // Required. GCP Project number/id.
![gcf-owl-bot[bot]](https://avatars.githubusercontent.com/in/99011?v=4&size=40){kind=avatar}
0 commit comments