- JSON representation
- AccessSettings
- GcipSettings
- CorsSettings
- OAuthSettings
- ReauthSettings
- Method
- PolicyType
- AllowedDomainsSettings
- ApplicationSettings
- CsmSettings
- AccessDeniedPageSettings
- AttributePropagationSettings
- OutputCredentials
The IAP configurable settings.
JSON representation |
---|
{ "name": string, "accessSettings": { object ( |
Fields | |
---|---|
name |
Required. The resource name of the IAP protected resource. |
accessSettings |
Top level wrapper for all access related setting in IAP |
applicationSettings |
Top level wrapper for all application related settings in IAP |
AccessSettings
Access related settings for IAP protected apps.
JSON representation |
---|
{ "gcipSettings": { object ( |
Fields | |
---|---|
gcipSettings |
GCIP claims and endpoint configurations for 3p identity providers. |
corsSettings |
Configuration to allow cross-origin requests via IAP. |
oauthSettings |
Settings to configure IAP's OAuth behavior. |
reauthSettings |
Settings to configure reauthentication policies in IAP. |
allowedDomainsSettings |
Settings to configure and enable allowed domains. |
GcipSettings
Allows customers to configure tenant_id for GCIP instance per-app.
JSON representation |
---|
{ "tenantIds": [ string ], "loginPageUri": string } |
Fields | |
---|---|
tenantIds[] |
GCIP tenant ids that are linked to the IAP resource. tenantIds could be a string beginning with a number character to indicate authenticating with GCIP tenant flow, or in the format of _ |
loginPageUri |
Login page URI associated with the GCIP tenants. Typically, all resources within the same project share the same login page, though it could be overridden at the sub resource level. |
CorsSettings
Allows customers to configure HTTP request paths that'll allow HTTP OPTIONS call to bypass authentication and authorization.
JSON representation |
---|
{ "allowHttpOptions": boolean } |
Fields | |
---|---|
allowHttpOptions |
Configuration to allow HTTP OPTIONS calls to skip authorization. If undefined, IAP will not apply any special logic to OPTIONS requests. |
OAuthSettings
Configuration for OAuth login&consent flow behavior as well as for OAuth Credentials.
JSON representation |
---|
{ "loginHint": string, "programmaticClients": [ string ] } |
Fields | |
---|---|
loginHint |
Domain hint to send as hd=? parameter in OAuth request flow. Enables redirect to primary IDP by skipping Google's login screen. https://developers.google.com/identity/protocols/OpenIDConnect#hd-param Note: IAP does not verify that the id token's hd claim matches this value since access behavior is managed by IAM policies. |
programmaticClients[] |
List of OAuth client IDs allowed to use IAP programmatically. |
ReauthSettings
Configuration for IAP reauthentication policies.
JSON representation |
---|
{ "method": enum ( |
Fields | |
---|---|
method |
Reauth method requested. |
maxAge |
Reauth session lifetime, how long before a user has to reauthenticate again. A duration in seconds with up to nine fractional digits, ending with ' |
policyType |
How IAP determines the effective policy in cases of hierarchial policies. Policies are merged from higher in the hierarchy to lower in the hierarchy. |
Method
Types of reauthentication methods supported by IAP.
Enums | |
---|---|
METHOD_UNSPECIFIED |
Reauthentication disabled. |
LOGIN |
Prompts the user to log in again. |
PASSWORD |
|
SECURE_KEY |
User must use their secure key 2nd factor device. |
ENROLLED_SECOND_FACTORS |
User can use any enabled 2nd factor. |
PolicyType
Type of policy in the case of hierarchial policies.
Enums | |
---|---|
POLICY_TYPE_UNSPECIFIED |
Default value. This value is unused. |
MINIMUM |
This policy acts as a minimum to other policies, lower in the hierarchy. Effective policy may only be the same or stricter. |
DEFAULT |
This policy acts as a default if no other reauth policy is set. |
AllowedDomainsSettings
Configuration for IAP allowed domains. Lets you to restrict access to an app and allow access to only the domains that you list.
JSON representation |
---|
{ "domains": [ string ], "enable": boolean } |
Fields | |
---|---|
domains[] |
List of trusted domains. |
enable |
Configuration for customers to opt in for the feature. |
ApplicationSettings
Wrapper over application specific settings for IAP.
JSON representation |
---|
{ "csmSettings": { object ( |
Fields | |
---|---|
csmSettings |
Settings to configure IAP's behavior for a service mesh. |
accessDeniedPageSettings |
Customization for Access Denied page. |
cookieDomain |
The Domain value to set for cookies generated by IAP. This value is not validated by the API, but will be ignored at runtime if invalid. |
attributePropagationSettings |
Settings to configure attribute propagation. |
CsmSettings
Configuration for RCToken generated for service mesh workloads protected by IAP. RCToken are IAP generated JWTs that can be verified at the application. The RCToken is primarily used for service mesh deployments, and can be scoped to a single mesh by configuring the audience field accordingly.
JSON representation |
---|
{ "rctokenAud": string } |
Fields | |
---|---|
rctokenAud |
Audience claim set in the generated RCToken. This value is not validated by IAP. |
AccessDeniedPageSettings
Custom content configuration for access denied page. IAP allows customers to define a custom URI to use as the error page when access is denied to users. If IAP prevents access to this page, the default IAP error page will be displayed instead.
JSON representation |
---|
{ "accessDeniedPageUri": string, "generateTroubleshootingUri": boolean, "remediationTokenGenerationEnabled": boolean } |
Fields | |
---|---|
accessDeniedPageUri |
The URI to be redirected to when access is denied. |
generateTroubleshootingUri |
Whether to generate a troubleshooting URL on access denied events to this application. |
remediationTokenGenerationEnabled |
Whether to generate remediation token on access denied events to this application. |
AttributePropagationSettings
Configuration for propagating attributes to applications protected by IAP.
JSON representation |
---|
{
"outputCredentials": [
enum ( |
Fields | |
---|---|
outputCredentials[] |
Which output credentials attributes selected by the CEL expression should be propagated in. All attributes will be fully duplicated in each selected output credential. |
expression |
Raw string CEL expression. Must return a list of attributes. A maximum of 45 attributes can be selected. Expressions can select different attribute types from
Example expression: |
enable |
Whether the provided attribute propagation settings should be evaluated on user requests. If set to true, attributes returned from the expression will be propagated in the set output credentials. |
OutputCredentials
Supported output credentials for attribute propagation. Each output credential maps to a "field" in the response. For example, selecting JWT will propagate all attributes in the IAP JWT, header in the headers, etc.
Enums | |
---|---|
OUTPUT_CREDENTIALS_UNSPECIFIED |
An output credential is required. |
HEADER |
Propagate attributes in the headers with "x-goog-iap-attr-" prefix. |
JWT |
Propagate attributes in the JWT of the form: |
RCTOKEN |
Propagate attributes in the RCToken of the form: |