- JSON representation
- AccessSettings
- GcipSettings
- CorsSettings
- OAuthSettings
- PolicyDelegationSettings
- Resource
- PolicyName
- ApplicationSettings
- CsmSettings
- AccessDeniedPageSettings
The IAP configurable settings.
JSON representation | |
---|---|
{ "name": string, "accessSettings": { object ( |
Fields | |
---|---|
name |
Required. The resource name of the IAP protected resource. |
accessSettings |
Top level wrapper for all access related setting in IAP |
applicationSettings |
Top level wrapper for all application related settings in IAP |
AccessSettings
Access related settings for IAP protected apps.
JSON representation | |
---|---|
{ "gcipSettings": { object ( |
Fields | |
---|---|
gcipSettings |
GCIP claims and endpoint configurations for 3p identity providers. |
corsSettings |
Configuration to allow cross-origin requests via IAP. |
oauthSettings |
Settings to configure IAP's OAuth behavior. |
policyDelegationSettings |
Settings to configure Policy delegation for apps hosted in tenant projects. INTERNAL_ONLY. |
GcipSettings
Allows customers to configure tenant_id for GCIP instance per-app.
JSON representation | |
---|---|
{ "tenantIds": [ string ], "loginPageUri": string } |
Fields | |
---|---|
tenantIds[] |
GCIP tenant ids that are linked to the IAP resource. tenantIds could be a string beginning with a number character to indicate authenticating with GCIP tenant flow, or in the format of _ |
loginPageUri |
Login page URI associated with the GCIP tenants. Typically, all resources within the same project share the same login page, though it could be overridden at the sub resource level. |
CorsSettings
Allows customers to configure HTTP request paths that'll allow HTTP OPTIONS call to bypass authentication and authorization.
JSON representation | |
---|---|
{ "allowHttpOptions": boolean } |
Fields | |
---|---|
allowHttpOptions |
Configuration to allow HTTP OPTIONS calls to skip authorization. If undefined, IAP will not apply any special logic to OPTIONS requests. |
OAuthSettings
Configuration for OAuth login&consent flow behavior as well as for OAuth Credentials.
JSON representation | |
---|---|
{ "loginHint": string, "clientId": string } |
Fields | |
---|---|
loginHint |
Domain hint to send as hd=? parameter in OAuth request flow. Enables redirect to primary IDP by skipping Google's login screen. https://developers.google.com/identity/protocols/OpenIDConnect#hd-param Note: IAP does not verify that the id token's hd claim matches this value since access behavior is managed by IAM policies. |
clientId |
OAuth 2.0 client ID used in the OAuth flow to generate an access token. If this field is set, you can skip obtaining the OAuth credentials in this step: https://developers.google.com/identity/protocols/OAuth2?hl=en_US#1.-obtain-oauth-2.0-credentials-from-the-google-api-console. However, this could allow for client sharing. The risks of client sharing are outlined here: https://cloud.google.com/iap/docs/sharing-oauth-clients#risks. |
PolicyDelegationSettings
PolicyDelegationConfig allows google-internal teams to use IAP for apps hosted in a tenant project. Using these settings, the app can delegate permission check to happen against the linked customer project. This is only ever supposed to be used by google internal teams, hence the restriction on the proto.
JSON representation | |
---|---|
{ "iamServiceName": string, "iamPermission": string, "resource": { object ( |
Fields | |
---|---|
iamServiceName |
The DNS name of the service (e.g. "resourcemanager.googleapis.com"). This should be the domain name part of the full resource names (see https://aip.dev/122#full-resource-names), which is usually the same as IamServiceSpec.service of the service where the resource type is defined. |
iamPermission |
Permission to check in IAM. |
resource |
IAM resource to check permission on |
policyName |
Policy name to be checked |
Resource
JSON representation | |
---|---|
{ "name": string, "type": string, "service": string, "labels": { string: string, ... } } |
Fields | |
---|---|
name |
Name of the resource on which conditions will be evaluated. Must use the Relative Resource Name of the resource, which is the URI path of the resource without the leading "/". Examples are "projects/_/buckets/[BUCKET-ID]" for storage buckets or "projects/[PROJECT-ID]/global/firewalls/[FIREWALL-ID]" for a firewall. This field is required for evaluating conditions with rules on resource names. For a |
type |
The public resource type name of the resource on which conditions will be evaluated. It is configured using the official_name of the ResourceType as defined in service configurations under //configs/cloud/resourcetypes. For example, the official_name for GCP projects is set as 'cloudresourcemanager.googleapis.com/Project' according to //configs/cloud/resourcetypes/google/cloud/resourcemanager/prod.yaml For details see go/iam-conditions-integration-guide. |
service |
The name of the service this resource belongs to. It is configured using the official_service_name of the Service as defined in service configurations under //configs/cloud/resourcetypes. For example, the official_service_name of cloud resource manager service is set as 'cloudresourcemanager.googleapis.com' according to //configs/cloud/resourcetypes/google/cloud/resourcemanager/prod.yaml |
labels |
The service defined labels of the resource on which the conditions will be evaluated. The semantics - including the key names - are vague to IAM. If the effective condition has a reference to a This field is in limited use. If your intended use case is not expected to express resource.labels attribute in IAM Conditions, leave this field empty. Before planning on using this attribute please: * Read go/iam-conditions-labels-comm and ensure your service can meet the data availability and management requirements. * Talk to iam-conditions-eng@ about your use case. An object containing a list of |
PolicyName
JSON representation | |
---|---|
{ "type": string, "id": string, "region": string } |
Fields | |
---|---|
type |
Valid values for type might be 'gce', 'gcs', 'project', 'account' etc. |
id |
|
region |
For Cloud IAM: The location of the Policy. Must be empty or "global" for Policies owned by global IAM. Must name a region from prodspec/cloud-iam-cloudspec for Regional IAM Policies, see go/iam-faq#where-is-iam-currently-deployed. For Local IAM: This field should be set to "local". |
ApplicationSettings
Wrapper over application specific settings for IAP.
JSON representation | |
---|---|
{ "csmSettings": { object ( |
Fields | |
---|---|
csmSettings |
Settings to configure IAP's behavior for a CSM mesh. |
accessDeniedPageSettings |
Customization for Access Denied page. |
cookieDomain |
The Domain value to set for cookies generated by IAP. This value is not validated by the API, but will be ignored at runtime if invalid. |
CsmSettings
Configuration for RCTokens generated for CSM workloads protected by IAP. RCTokens are IAP generated JWTs that can be verified at the application. The RCToken is primarily used for ISTIO deployments, and can be scoped to a single mesh by configuring the audience field accordingly
JSON representation | |
---|---|
{ "rctokenAud": string } |
Fields | |
---|---|
rctokenAud |
Audience claim set in the generated RCToken. This value is not validated by IAP. |
AccessDeniedPageSettings
Custom content configuration for access denied page. IAP allows customers to define a custom URI to use as the error page when access is denied to users. If IAP prevents access to this page, the default IAP error page will be displayed instead.
JSON representation | |
---|---|
{ "accessDeniedPageUri": string } |
Fields | |
---|---|
accessDeniedPageUri |
The URI to be redirected to when access is denied. |