- JSON representation
- AccessSettings
- GcipSettings
- CorsSettings
- OAuthSettings
- ReauthSettings
- Method
- PolicyType
- AllowedDomainsSettings
- WorkforceIdentitySettings
- OAuth2
- IdentitySource
- ApplicationSettings
- CsmSettings
- AccessDeniedPageSettings
- AttributePropagationSettings
- OutputCredentials
The IAP configurable settings.
JSON representation |
---|
{ "name": string, "accessSettings": { object ( |
Fields | |
---|---|
name |
Required. The resource name of the IAP protected resource. |
accessSettings |
Optional. Top level wrapper for all access related setting in IAP |
applicationSettings |
Optional. Top level wrapper for all application related settings in IAP |
AccessSettings
Access related settings for IAP protected apps.
JSON representation |
---|
{ "gcipSettings": { object ( |
Fields | |
---|---|
gcipSettings |
Optional. GCIP claims and endpoint configurations for 3p identity providers. |
corsSettings |
Optional. Configuration to allow cross-origin requests via IAP. |
oauthSettings |
Optional. Settings to configure IAP's OAuth behavior. |
reauthSettings |
Optional. Settings to configure reauthentication policies in IAP. |
allowedDomainsSettings |
Optional. Settings to configure and enable allowed domains. |
workforceIdentitySettings |
Optional. Settings to configure the workforce identity federation, including workforce pools and OAuth 2.0 settings. |
identitySources[] |
Optional. Identity sources that IAP can use to authenticate the end user. Only one identity source can be configured. |
GcipSettings
Allows customers to configure tenant_id for GCIP instance per-app.
JSON representation |
---|
{ "tenantIds": [ string ], "loginPageUri": string } |
Fields | |
---|---|
tenantIds[] |
Optional. GCIP tenant ids that are linked to the IAP resource. tenantIds could be a string beginning with a number character to indicate authenticating with GCIP tenant flow, or in the format of _ |
loginPageUri |
Login page URI associated with the GCIP tenants. Typically, all resources within the same project share the same login page, though it could be overridden at the sub resource level. |
CorsSettings
Allows customers to configure HTTP request paths that'll allow HTTP OPTIONS call to bypass authentication and authorization.
JSON representation |
---|
{ "allowHttpOptions": boolean } |
Fields | |
---|---|
allowHttpOptions |
Configuration to allow HTTP OPTIONS calls to skip authorization. If undefined, IAP will not apply any special logic to OPTIONS requests. |
OAuthSettings
Configuration for OAuth login&consent flow behavior as well as for OAuth Credentials.
JSON representation |
---|
{ "loginHint": string, "programmaticClients": [ string ] } |
Fields | |
---|---|
loginHint |
Domain hint to send as hd=? parameter in OAuth request flow. Enables redirect to primary IDP by skipping Google's login screen. https://developers.google.com/identity/protocols/OpenIDConnect#hd-param Note: IAP does not verify that the id token's hd claim matches this value since access behavior is managed by IAM policies. |
programmaticClients[] |
Optional. List of client ids allowed to use IAP programmatically. |
ReauthSettings
Configuration for IAP reauthentication policies.
JSON representation |
---|
{ "method": enum ( |
Fields | |
---|---|
method |
Reauth method requested. |
maxAge |
Optional. Reauth session lifetime, how long before a user has to reauthenticate again. A duration in seconds with up to nine fractional digits, ending with ' |
policyType |
Optional. How IAP determines the effective policy in cases of hierarchical policies. Policies are merged from higher in the hierarchy to lower in the hierarchy. |
Method
Types of reauthentication methods supported by IAP.
Enums | |
---|---|
METHOD_UNSPECIFIED |
Reauthentication disabled. |
LOGIN |
Prompts the user to log in again. |
PASSWORD |
|
SECURE_KEY |
User must use their secure key 2nd factor device. |
ENROLLED_SECOND_FACTORS |
User can use any enabled 2nd factor. |
PolicyType
Type of policy in the case of hierarchical policies.
Enums | |
---|---|
POLICY_TYPE_UNSPECIFIED |
Default value. This value is unused. |
MINIMUM |
This policy acts as a minimum to other policies, lower in the hierarchy. Effective policy may only be the same or stricter. |
DEFAULT |
This policy acts as a default if no other reauth policy is set. |
AllowedDomainsSettings
Configuration for IAP allowed domains. Lets you to restrict access to an app and allow access to only the domains that you list.
JSON representation |
---|
{ "domains": [ string ], "enable": boolean } |
Fields | |
---|---|
domains[] |
Optional. List of trusted domains. |
enable |
Optional. Configuration for customers to opt in for the feature. |
WorkforceIdentitySettings
WorkforceIdentitySettings allows customers to configure workforce pools and OAuth 2.0 settings to gate their applications using a third-party IdP with access control.
JSON representation |
---|
{
"workforcePools": [
string
],
"oauth2": {
object ( |
Fields | |
---|---|
workforcePools[] |
The workforce pool resources. Only one workforce pool is accepted. |
oauth2 |
OAuth 2.0 settings for IAP to perform OIDC flow with workforce identity federation services. |
OAuth2
The OAuth 2.0 Settings
JSON representation |
---|
{ "clientId": string, "clientSecret": string, "clientSecretSha256": string } |
Fields | |
---|---|
clientId |
The OAuth 2.0 client ID registered in the workforce identity federation OAuth 2.0 Server. |
clientSecret |
Input only. The OAuth 2.0 client secret created while registering the client ID. |
clientSecretSha256 |
Output only. SHA256 hash value for the client secret. This field is returned by IAP when the settings are retrieved. |
IdentitySource
Types of identity source supported by IAP.
Enums | |
---|---|
IDENTITY_SOURCE_UNSPECIFIED |
IdentitySource Unspecified. When selected, IAP relies on which identity settings are fully configured to redirect the traffic to. The precedence order is WorkforceIdentitySettings > GcipSettings. If none is set, default to use Google identity. |
WORKFORCE_IDENTITY_FEDERATION |
Use external identities set up on Google Cloud Workforce Identity Federation. |
ApplicationSettings
Wrapper over application specific settings for IAP.
JSON representation |
---|
{ "csmSettings": { object ( |
Fields | |
---|---|
csmSettings |
Optional. Settings to configure IAP's behavior for a service mesh. |
accessDeniedPageSettings |
Optional. Customization for Access Denied page. |
cookieDomain |
The Domain value to set for cookies generated by IAP. This value is not validated by the API, but will be ignored at runtime if invalid. |
attributePropagationSettings |
Optional. Settings to configure attribute propagation. |
CsmSettings
Configuration for RCToken generated for service mesh workloads protected by IAP. RCToken are IAP generated JWTs that can be verified at the application. The RCToken is primarily used for service mesh deployments, and can be scoped to a single mesh by configuring the audience field accordingly.
JSON representation |
---|
{ "rctokenAud": string } |
Fields | |
---|---|
rctokenAud |
Audience claim set in the generated RCToken. This value is not validated by IAP. |
AccessDeniedPageSettings
Custom content configuration for access denied page. IAP allows customers to define a custom URI to use as the error page when access is denied to users. If IAP prevents access to this page, the default IAP error page will be displayed instead.
JSON representation |
---|
{ "accessDeniedPageUri": string, "generateTroubleshootingUri": boolean, "remediationTokenGenerationEnabled": boolean } |
Fields | |
---|---|
accessDeniedPageUri |
The URI to be redirected to when access is denied. |
generateTroubleshootingUri |
Whether to generate a troubleshooting URL on access denied events to this application. |
remediationTokenGenerationEnabled |
Whether to generate remediation token on access denied events to this application. |
AttributePropagationSettings
Configuration for propagating attributes to applications protected by IAP.
JSON representation |
---|
{
"outputCredentials": [
enum ( |
Fields | |
---|---|
outputCredentials[] |
Optional. Which output credentials attributes selected by the CEL expression should be propagated in. All attributes will be fully duplicated in each selected output credential. |
expression |
Optional. Raw string CEL expression. Must return a list of attributes. A maximum of 45 attributes can be selected. Expressions can select different attribute types from
Example expression: |
enable |
Optional. Whether the provided attribute propagation settings should be evaluated on user requests. If set to true, attributes returned from the expression will be propagated in the set output credentials. |
OutputCredentials
Supported output credentials for attribute propagation. Each output credential maps to a "field" in the response. For example, selecting JWT will propagate all attributes in the IAP JWT, header in the headers, etc.
Enums | |
---|---|
OUTPUT_CREDENTIALS_UNSPECIFIED |
An output credential is required. |
HEADER |
Propagate attributes in the headers with "x-goog-iap-attr-" prefix. |
JWT |
Propagate attributes in the JWT of the form: |
RCTOKEN |
Propagate attributes in the RCToken of the form: |