IapSettings

The IAP configurable settings.

JSON representation 
{
  "name": string,
  "accessSettings": {
    object (AccessSettings)
  },
  "applicationSettings": {
    object (ApplicationSettings)
  }
}
Fields
name

string

Required. The resource name of the IAP protected resource.
accessSettings

object (AccessSettings)

Top level wrapper for all access related setting in IAP
applicationSettings

object (ApplicationSettings)

Top level wrapper for all application related settings in IAP

AccessSettings

Access related settings for IAP protected apps.

JSON representation 
{
  "gcipSettings": {
    object (GcipSettings)
  },
  "corsSettings": {
    object (CorsSettings)
  },
  "oauthSettings": {
    object (OAuthSettings)
  },
  "policyDelegationSettings": {
    object (PolicyDelegationSettings)
  }
}
Fields
gcipSettings

object (GcipSettings)

GCIP claims and endpoint configurations for 3p identity providers.
corsSettings

object (CorsSettings)

Configuration to allow cross-origin requests via IAP.
oauthSettings

object (OAuthSettings)

Settings to configure IAP's OAuth behavior.
policyDelegationSettings

object (PolicyDelegationSettings)

Settings to configure Policy delegation for apps hosted in tenant projects. INTERNAL_ONLY.

GcipSettings

Allows customers to configure tenant_id for GCIP instance per-app.

JSON representation 
{
  "tenantIds": [
    string
  ],
  "loginPageUri": string
}
Fields
tenantIds[]

string

GCIP tenant ids that are linked to the IAP resource. tenantIds could be a string beginning with a number character to indicate authenticating with GCIP tenant flow, or in the format of _ to indicate authenticating with GCIP agent flow. If agent flow is used, tenantIds should only contain one single element, while for tenant flow, tenantIds can contain multiple elements.
loginPageUri

string

Login page URI associated with the GCIP tenants. Typically, all resources within the same project share the same login page, though it could be overridden at the sub resource level.

CorsSettings

Allows customers to configure HTTP request paths that'll allow HTTP OPTIONS call to bypass authentication and authorization.

JSON representation 
{
  "allowHttpOptions": boolean
}
Fields
allowHttpOptions

boolean

Configuration to allow HTTP OPTIONS calls to skip authorization. If undefined, IAP will not apply any special logic to OPTIONS requests.

OAuthSettings

Configuration for OAuth login&consent flow behavior as well as for OAuth Credentials.

JSON representation 
{
  "loginHint": string,
  "clientId": string
}
Fields
loginHint

string

Domain hint to send as hd=? parameter in OAuth request flow. Enables redirect to primary IDP by skipping Google's login screen. https://developers.google.com/identity/protocols/OpenIDConnect#hd-param Note: IAP does not verify that the id token's hd claim matches this value since access behavior is managed by IAM policies.
clientId

string

OAuth 2.0 client ID used in the OAuth flow to generate an access token. If this field is set, you can skip obtaining the OAuth credentials in this step: https://developers.google.com/identity/protocols/OAuth2?hl=en_US#1.-obtain-oauth-2.0-credentials-from-the-google-api-console. However, this could allow for client sharing. The risks of client sharing are outlined here: https://cloud.google.com/iap/docs/sharing-oauth-clients#risks.

PolicyDelegationSettings

PolicyDelegationConfig allows google-internal teams to use IAP for apps hosted in a tenant project. Using these settings, the app can delegate permission check to happen against the linked customer project. This is only ever supposed to be used by google internal teams, hence the restriction on the proto.

JSON representation 
{
  "iamServiceName": string,
  "iamPermission": string,
  "resource": {
    object (Resource)
  },
  "policyName": {
    object (PolicyName)
  }
}
Fields
iamServiceName

string

The DNS name of the service (e.g. "resourcemanager.googleapis.com"). This should be the domain name part of the full resource names (see https://aip.dev/122#full-resource-names), which is usually the same as IamServiceSpec.service of the service where the resource type is defined.
iamPermission

string

Permission to check in IAM.
resource

object (Resource)

IAM resource to check permission on
policyName

object (PolicyName)

Policy name to be checked

Resource

JSON representation 
{
  "name": string,
  "type": string,
  "service": string,
  "labels": {
    string: string,
    ...
  }
}
Fields
name

string

Name of the resource on which conditions will be evaluated. Must use the Relative Resource Name of the resource, which is the URI path of the resource without the leading "/". Examples are "projects/_/buckets/[BUCKET-ID]" for storage buckets or "projects/[PROJECT-ID]/global/firewalls/[FIREWALL-ID]" for a firewall.

This field is required for evaluating conditions with rules on resource names. For a list permission check, the resource.name value must be set to the parent resource. If the parent resource is a project, this field should be left unset.
type

string

The public resource type name of the resource on which conditions will be evaluated. It is configured using the official_name of the ResourceType as defined in service configurations under //configs/cloud/resourcetypes. For example, the official_name for GCP projects is set as 'cloudresourcemanager.googleapis.com/Project' according to //configs/cloud/resourcetypes/google/cloud/resourcemanager/prod.yaml For details see go/iam-conditions-integration-guide.
service

string

The name of the service this resource belongs to. It is configured using the official_service_name of the Service as defined in service configurations under //configs/cloud/resourcetypes. For example, the official_service_name of cloud resource manager service is set as 'cloudresourcemanager.googleapis.com' according to //configs/cloud/resourcetypes/google/cloud/resourcemanager/prod.yaml
labels

map (key: string, value: string)

The service defined labels of the resource on which the conditions will be evaluated. The semantics - including the key names - are vague to IAM. If the effective condition has a reference to a resource.labels[foo] construct, IAM consults with this map to retrieve the values associated with foo key for Conditions evaluation. If the provided key is not found in the labels map, the condition would evaluate to false.

This field is in limited use. If your intended use case is not expected to express resource.labels attribute in IAM Conditions, leave this field empty. Before planning on using this attribute please: * Read go/iam-conditions-labels-comm and ensure your service can meet the data availability and management requirements. * Talk to iam-conditions-eng@ about your use case.

An object containing a list of "key": value pairs. Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }.

PolicyName

JSON representation 
{
  "type": string,
  "id": string,
  "region": string
}
Fields
type

string

Valid values for type might be 'gce', 'gcs', 'project', 'account' etc.
id

string
region

string

For Cloud IAM: The location of the Policy. Must be empty or "global" for Policies owned by global IAM. Must name a region from prodspec/cloud-iam-cloudspec for Regional IAM Policies, see go/iam-faq#where-is-iam-currently-deployed.

For Local IAM: This field should be set to "local".

ApplicationSettings

Wrapper over application specific settings for IAP.

JSON representation 
{
  "csmSettings": {
    object (CsmSettings)
  },
  "accessDeniedPageSettings": {
    object (AccessDeniedPageSettings)
  },
  "cookieDomain": string
}
Fields
csmSettings

object (CsmSettings)

Settings to configure IAP's behavior for a CSM mesh.
accessDeniedPageSettings

object (AccessDeniedPageSettings)

Customization for Access Denied page.
cookieDomain

string

The Domain value to set for cookies generated by IAP. This value is not validated by the API, but will be ignored at runtime if invalid.

CsmSettings

Configuration for RCTokens generated for CSM workloads protected by IAP. RCTokens are IAP generated JWTs that can be verified at the application. The RCToken is primarily used for ISTIO deployments, and can be scoped to a single mesh by configuring the audience field accordingly

JSON representation 
{
  "rctokenAud": string
}
Fields
rctokenAud

string

Audience claim set in the generated RCToken. This value is not validated by IAP.

AccessDeniedPageSettings

Custom content configuration for access denied page. IAP allows customers to define a custom URI to use as the error page when access is denied to users. If IAP prevents access to this page, the default IAP error page will be displayed instead.

JSON representation 
{
  "accessDeniedPageUri": string
}
Fields
accessDeniedPageUri

string

The URI to be redirected to when access is denied.