enumDeviceEncryptionStatus{// The encryption status of the device is not specified or not known.ENCRYPTION_UNSPECIFIED==0;// The device does not support encryption.ENCRYPTION_UNSUPPORTED==1;// The device supports encryption, but is currently unencrypted.UNENCRYPTED==2;// The device is encrypted.ENCRYPTED==3;}
enumOsType{// The operating system of the device is not specified or not known.OS_UNSPECIFIED==0;// A desktop Mac operating system.DESKTOP_MAC==1;// A desktop Windows operating system.DESKTOP_WINDOWS==2;// A desktop Linux operating system.DESKTOP_LINUX==3;// An Android operating system.ANDROID==4;// An iOS operating system.IOS==5;// A desktop ChromeOS operating system.DESKTOP_CHROME_OS==6;}
此外，供应商可以提供使用 data 属性引用的自己的密钥和值。data 属性的可用密钥因供应商而异。 在政策表达式中比较键值对时，请确保一致性。例如，如果您希望键值对为字符串或布尔值，请确保相应地在政策表达式中将其与字符串或布尔值进行比较。请注意，当值是整数时，应在政策表达式中将其与双精度数字进行比较。
如需引用设备状态，请使用 key-acme 格式，其中 acme 是组织的客户 ID。您可以从 GET https://www.googleapis.com/admin/directory/v1/customers/my_customer 网址中获取客户 ID。响应中的 ID 字段包含以字母 C 开头的客户 ID。使用字母 C 后面的字符串（不包括字母 C）作为客户 ID。
枚举值：
// Health score of the device as provided by the vendor (possibly third party).enumDeviceHealthScore{// The health score for the device is not specified or unknown.DEVICE_HEALTH_SCORE_UNSPECIFIED=0;// The health of the device is very poor.VERY_POOR=1;// The health of the device is poor.POOR=2;// The health of the device is ok.NEUTRAL=3;// The health of the device is good.GOOD=4;// The health of the device is very good.VERY_GOOD=5;}
// Checks if the enterprise certificate associated with the origin matches the device.device.certificates.exists(cert,cert.is_valid && cert.cert_fingerprint==origin.clientCertFingerprint())
[[["易于理解","easyToUnderstand","thumb-up"],["解决了我的问题","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["很难理解","hardToUnderstand","thumb-down"],["信息或示例代码不正确","incorrectInformationOrSampleCode","thumb-down"],["没有我需要的信息/示例","missingTheInformationSamplesINeed","thumb-down"],["翻译问题","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["最后更新时间 (UTC)：2025-09-09。"],[[["\u003cp\u003eThis document outlines four primary objects—\u003ccode\u003eorigin\u003c/code\u003e, \u003ccode\u003erequest.auth\u003c/code\u003e, \u003ccode\u003elevels\u003c/code\u003e, and \u003ccode\u003edevice\u003c/code\u003e—used to construct Common Expression Language (CEL) expressions for Access Context Manager, each containing specific attributes to evaluate access levels.\u003c/p\u003e\n"],["\u003cp\u003eThe \u003ccode\u003eorigin\u003c/code\u003e object offers attributes like \u003ccode\u003eip\u003c/code\u003e and \u003ccode\u003eregion_code\u003c/code\u003e to define the request's source, allowing checks like whether a user is within a specific IP range or region, and supports the use of \u003ccode\u003einIpRange\u003c/code\u003e to compare ip addresses.\u003c/p\u003e\n"],["\u003cp\u003eThe \u003ccode\u003erequest.auth\u003c/code\u003e object verifies user authentication, identifying the user's ID (\u003ccode\u003eprincipal\u003c/code\u003e) and the method used for authentication, such as password, push notification, or security key, via \u003ccode\u003eclaims.crd_str\u003c/code\u003e attributes.\u003c/p\u003e\n"],["\u003cp\u003eThe \u003ccode\u003edevice\u003c/code\u003e object provides detailed information about the requesting device, including its encryption status, admin approval, ownership, OS type, and device-specific attributes for third-party vendor data, and the use of security protocols.\u003c/p\u003e\n"],["\u003cp\u003eThe document also includes function and macro details for defining CEL expressions, such as \u003ccode\u003einIpRange\u003c/code\u003e, \u003ccode\u003edevice.versionAtLeast\u003c/code\u003e, \u003ccode\u003ecertificateBindingState\u003c/code\u003e, \u003ccode\u003ehas\u003c/code\u003e, and \u003ccode\u003ee.all\u003c/code\u003e , \u003ccode\u003ee.exists\u003c/code\u003e and \u003ccode\u003ee.exists_one\u003c/code\u003e for constructing complex access control rules.\u003c/p\u003e\n"]]],[],null,[]]
