IapSettings

The IAP configurable settings.

JSON representation 
{
  "name": string,
  "accessSettings": {
    object (AccessSettings)
  },
  "applicationSettings": {
    object (ApplicationSettings)
  }
}
Fields
name

string

Required. The resource name of the IAP protected resource.
accessSettings

object (AccessSettings)

Top level wrapper for all access related setting in IAP
applicationSettings

object (ApplicationSettings)

Top level wrapper for all application related settings in IAP

AccessSettings

Access related settings for IAP protected apps.

JSON representation 
{
  "gcipSettings": {
    object (GcipSettings)
  },
  "corsSettings": {
    object (CorsSettings)
  },
  "oauthSettings": {
    object (OAuthSettings)
  }
}
Fields
gcipSettings

object (GcipSettings)

GCIP claims and endpoint configurations for 3p identity providers.
corsSettings

object (CorsSettings)

Configuration to allow cross-origin requests via IAP.
oauthSettings

object (OAuthSettings)

Settings to configure IAP's OAuth behavior.

GcipSettings

Allows customers to configure tenant_id for GCIP instance per-app.

JSON representation 
{
  "tenantIds": [
    string
  ],
  "loginPageUri": string
}
Fields
tenantIds[]

string

GCIP tenant ids that are linked to the IAP resource. tenantIds could be a string beginning with a number character to indicate authenticating with GCIP tenant flow, or in the format of _ to indicate authenticating with GCIP agent flow. If agent flow is used, tenantIds should only contain one single element, while for tenant flow, tenantIds can contain multiple elements.
loginPageUri

string

Login page URI associated with the GCIP tenants. Typically, all resources within the same project share the same login page, though it could be overridden at the sub resource level.

CorsSettings

Allows customers to configure HTTP request paths that'll allow HTTP OPTIONS call to bypass authentication and authorization.

JSON representation 
{
  "allowHttpOptions": boolean
}
Fields
allowHttpOptions

boolean

Configuration to allow HTTP OPTIONS calls to skip authorization. If undefined, IAP will not apply any special logic to OPTIONS requests.

OAuthSettings

Configuration for OAuth login&consent flow behavior as well as for OAuth Credentials.

JSON representation 
{
  "loginHint": string,
  "clientId": string
}
Fields
loginHint

string

Domain hint to send as hd=? parameter in OAuth request flow. Enables redirect to primary IDP by skipping Google's login screen. https://developers.google.com/identity/protocols/OpenIDConnect#hd-param Note: IAP does not verify that the id token's hd claim matches this value since access behavior is managed by IAM policies.
clientId

string

OAuth 2.0 client ID used in the OAuth flow to generate an access token. If this field is set, you can skip obtaining the OAuth credentials in this step: https://developers.google.com/identity/protocols/OAuth2?hl=en_US#1.-obtain-oauth-2.0-credentials-from-the-google-api-console. However, this could allow for client sharing. The risks of client sharing are outlined here: https://cloud.google.com/iap/docs/sharing-oauth-clients#risks.

ApplicationSettings

Wrapper over application specific settings for IAP.

JSON representation 
{
  "csmSettings": {
    object (CsmSettings)
  }
}
Fields
csmSettings

object (CsmSettings)

Settings to configure IAP's behavior for a CSM mesh.

CsmSettings

Configuration for RCTokens generated for CSM workloads protected by IAP. RCTokens are IAP generated JWTs that can be verified at the application. The RCToken is primarily used for ISTIO deployments, and can be scoped to a single mesh by configuring the audience field accordingly

JSON representation 
{
  "rctokenAud": string
}
Fields
rctokenAud

string

Audience claim set in the generated RCToken. This value is not validated by IAP.