Skip to content

Commit 9e3878c

Browse files
gcf-owl-bot[bot]gcf-owl-bot[bot]
authored
feat: [iap] Identity-aware Proxy (IAP) released a feature Use IAP with Workforce Identity Federation(https://cloud.google.com/iap/docs/use-workforce-identity-federation) at Feb 7, 2025. Two settings field are newly introduced in the feature release: ... (#6251)
* feat: Identity-aware Proxy (IAP) released a feature `Use IAP with Workforce Identity Federation`(https://cloud.google.com/iap/docs/use-workforce-identity-federation) at Feb 7, 2025. Two settings field are newly introduced in the feature release: `workforce_identity_settings` and `identity_sources` docs: A comment for field `name` in message `.google.cloud.iap.v1.TunnelDestGroup` is changed docs: A comment for field `cidrs` in message `.google.cloud.iap.v1.TunnelDestGroup` is changed docs: A comment for field `fqdns` in message `.google.cloud.iap.v1.TunnelDestGroup` is changed docs: Mark `access_settings` in message `.google.cloud.iap.v1.IapSettings` as optional docs: Mark `application_settings` in message `.google.cloud.iap.v1.IapSettings` as optional docs: Mark `gcip_settings` in message `.google.cloud.iap.v1.AccessSettings` as optional docs: Mark `cors_settings` in message `.google.cloud.iap.v1.AccessSettings` as optional docs: Mark `oauth_settings` in message `.google.cloud.iap.v1.AccessSettings` as optional docs: Mark `reauth_settings` in message `.google.cloud.iap.v1.AccessSettings` as optional docs: Mark `allowed_domains_settings` in message `.google.cloud.iap.v1.AccessSettings` as optional docs: Mark `tenant_ids` in message `.google.cloud.iap.v1.GcipSettings` as optional docs: Mark `programmatic_clients` in message `.google.cloud.iap.v1.OAuthSettings` as optional docs: A comment for enum `PolicyType` is changed docs: Mark `method` in message `.google.cloud.iap.v1.ReauthSettings` as optional docs: Mark `max_age` in message `.google.cloud.iap.v1.ReauthSettings` as optional docs: Mark `policy_type` in message `.google.cloud.iap.v1.ReauthSettings` as optional docs: Mark `enable` in message `.google.cloud.iap.v1.AllowedDomainsSettings` as optional docs: Mark `domains` in message `.google.cloud.iap.v1.AllowedDomainsSettings` as optional docs: Mark `csm_settings` in message `.google.cloud.iap.v1.ApplicationSettings` as optional docs: Mark `access_denied_page_settings` in message `.google.cloud.iap.v1.ApplicationSettings` as optional docs: Mark `attribute_propagation_settings` in message `.google.cloud.iap.v1.ApplicationSettings` as optional docs: Mark `expression` in message `.google.cloud.iap.v1.AttributePropagationSettings` as optional docs: Mark `output_credentials` in message `.google.cloud.iap.v1.AttributePropagationSettings` as optional docs: Mark `enable` in message `.google.cloud.iap.v1.AttributePropagationSettings` as optional PiperOrigin-RevId: 745722681 Source-Link: googleapis/googleapis@81dd948 Source-Link: googleapis/googleapis-gen@553184a Copy-Tag: eyJwIjoicGFja2FnZXMvZ29vZ2xlLWNsb3VkLWlhcC8uT3dsQm90LnlhbWwiLCJoIjoiNTUzMTg0YTdjZDdlMWM1ODI0OTVmYjFmOGNkMDBlYzBmNjZhZmY2ZCJ9 * 🦉 Updates from OwlBot post-processor See https://github.com/googleapis/repo-automation-bots/blob/main/packages/owl-bot/README.md --------- Co-authored-by: Owl Bot <gcf-owl-bot[bot]@users.noreply.github.com>
1 parent 2c5c68c commit 9e3878c

12 files changed

Lines changed: 3137 additions & 984 deletions

‎packages/google-cloud-iap/README.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -96,6 +96,7 @@ Samples are in the [`samples/`](https://github.com/googleapis/google-cloud-node/
9696
| Identity_aware_proxy_admin_service.test_iam_permissions | [source code](https://github.com/googleapis/google-cloud-node/blob/main/packages/google-cloud-iap/samples/generated/v1/identity_aware_proxy_admin_service.test_iam_permissions.js) | [![Open in Cloud Shell][shell_img]](https://console.cloud.google.com/cloudshell/open?git_repo=https://github.com/googleapis/google-cloud-node&page=editor&open_in_editor=packages/google-cloud-iap/samples/generated/v1/identity_aware_proxy_admin_service.test_iam_permissions.js,packages/google-cloud-iap/samples/README.md) |
9797
| Identity_aware_proxy_admin_service.update_iap_settings | [source code](https://github.com/googleapis/google-cloud-node/blob/main/packages/google-cloud-iap/samples/generated/v1/identity_aware_proxy_admin_service.update_iap_settings.js) | [![Open in Cloud Shell][shell_img]](https://console.cloud.google.com/cloudshell/open?git_repo=https://github.com/googleapis/google-cloud-node&page=editor&open_in_editor=packages/google-cloud-iap/samples/generated/v1/identity_aware_proxy_admin_service.update_iap_settings.js,packages/google-cloud-iap/samples/README.md) |
9898
| Identity_aware_proxy_admin_service.update_tunnel_dest_group | [source code](https://github.com/googleapis/google-cloud-node/blob/main/packages/google-cloud-iap/samples/generated/v1/identity_aware_proxy_admin_service.update_tunnel_dest_group.js) | [![Open in Cloud Shell][shell_img]](https://console.cloud.google.com/cloudshell/open?git_repo=https://github.com/googleapis/google-cloud-node&page=editor&open_in_editor=packages/google-cloud-iap/samples/generated/v1/identity_aware_proxy_admin_service.update_tunnel_dest_group.js,packages/google-cloud-iap/samples/README.md) |
99+
| Identity_aware_proxy_admin_service.validate_iap_attribute_expression | [source code](https://github.com/googleapis/google-cloud-node/blob/main/packages/google-cloud-iap/samples/generated/v1/identity_aware_proxy_admin_service.validate_iap_attribute_expression.js) | [![Open in Cloud Shell][shell_img]](https://console.cloud.google.com/cloudshell/open?git_repo=https://github.com/googleapis/google-cloud-node&page=editor&open_in_editor=packages/google-cloud-iap/samples/generated/v1/identity_aware_proxy_admin_service.validate_iap_attribute_expression.js,packages/google-cloud-iap/samples/README.md) |
99100
| Identity_aware_proxy_o_auth_service.create_brand | [source code](https://github.com/googleapis/google-cloud-node/blob/main/packages/google-cloud-iap/samples/generated/v1/identity_aware_proxy_o_auth_service.create_brand.js) | [![Open in Cloud Shell][shell_img]](https://console.cloud.google.com/cloudshell/open?git_repo=https://github.com/googleapis/google-cloud-node&page=editor&open_in_editor=packages/google-cloud-iap/samples/generated/v1/identity_aware_proxy_o_auth_service.create_brand.js,packages/google-cloud-iap/samples/README.md) |
100101
| Identity_aware_proxy_o_auth_service.create_identity_aware_proxy_client | [source code](https://github.com/googleapis/google-cloud-node/blob/main/packages/google-cloud-iap/samples/generated/v1/identity_aware_proxy_o_auth_service.create_identity_aware_proxy_client.js) | [![Open in Cloud Shell][shell_img]](https://console.cloud.google.com/cloudshell/open?git_repo=https://github.com/googleapis/google-cloud-node&page=editor&open_in_editor=packages/google-cloud-iap/samples/generated/v1/identity_aware_proxy_o_auth_service.create_identity_aware_proxy_client.js,packages/google-cloud-iap/samples/README.md) |
101102
| Identity_aware_proxy_o_auth_service.delete_identity_aware_proxy_client | [source code](https://github.com/googleapis/google-cloud-node/blob/main/packages/google-cloud-iap/samples/generated/v1/identity_aware_proxy_o_auth_service.delete_identity_aware_proxy_client.js) | [![Open in Cloud Shell][shell_img]](https://console.cloud.google.com/cloudshell/open?git_repo=https://github.com/googleapis/google-cloud-node&page=editor&open_in_editor=packages/google-cloud-iap/samples/generated/v1/identity_aware_proxy_o_auth_service.delete_identity_aware_proxy_client.js,packages/google-cloud-iap/samples/README.md) |

‎packages/google-cloud-iap/protos/google/cloud/iap/v1/service.proto‎

Lines changed: 143 additions & 60 deletions
Original file line numberDiff line numberDiff line change
@@ -98,6 +98,14 @@ service IdentityAwareProxyAdminService {
9898
};
9999
}
100100

101+
// Validates that a given CEL expression conforms to IAP restrictions.
102+
rpc ValidateIapAttributeExpression(ValidateIapAttributeExpressionRequest)
103+
returns (ValidateIapAttributeExpressionResponse) {
104+
option (google.api.http) = {
105+
post: "/v1/{name=**}:validateAttributeExpression"
106+
};
107+
}
108+
101109
// Lists the existing TunnelDestGroups. To group across all locations, use a
102110
// `-` as the location ID. For example:
103111
// `/v1/projects/123/iap_tunnel/locations/-/destGroups`
@@ -342,19 +350,21 @@ message TunnelDestGroup {
342350
pattern: "projects/{project}/iap_tunnel/locations/{location}/destGroups/{dest_group}"
343351
};
344352

345-
// Required. Immutable. Identifier for the TunnelDestGroup. Must be unique
346-
// within the project and contain only lower case letters (a-z) and dashes
347-
// (-).
348-
string name = 1 [
349-
(google.api.field_behavior) = REQUIRED,
350-
(google.api.field_behavior) = IMMUTABLE
351-
];
353+
// Identifier. Identifier for the TunnelDestGroup. Must be unique within the
354+
// project and contain only lower case letters (a-z) and dashes (-).
355+
string name = 1 [(google.api.field_behavior) = IDENTIFIER];
352356

353-
// Unordered list. List of CIDRs that this group applies to.
354-
repeated string cidrs = 2 [(google.api.field_behavior) = UNORDERED_LIST];
357+
// Optional. Unordered list. List of CIDRs that this group applies to.
358+
repeated string cidrs = 2 [
359+
(google.api.field_behavior) = UNORDERED_LIST,
360+
(google.api.field_behavior) = OPTIONAL
361+
];
355362

356-
// Unordered list. List of FQDNs that this group applies to.
357-
repeated string fqdns = 3 [(google.api.field_behavior) = UNORDERED_LIST];
363+
// Optional. Unordered list. List of FQDNs that this group applies to.
364+
repeated string fqdns = 3 [
365+
(google.api.field_behavior) = UNORDERED_LIST,
366+
(google.api.field_behavior) = OPTIONAL
367+
];
358368
}
359369

360370
// The request sent to GetIapSettings.
@@ -386,40 +396,67 @@ message IapSettings {
386396
// Required. The resource name of the IAP protected resource.
387397
string name = 1 [(google.api.field_behavior) = REQUIRED];
388398

389-
// Top level wrapper for all access related setting in IAP
390-
AccessSettings access_settings = 5;
399+
// Optional. Top level wrapper for all access related setting in IAP
400+
AccessSettings access_settings = 5 [(google.api.field_behavior) = OPTIONAL];
391401

392-
// Top level wrapper for all application related settings in IAP
393-
ApplicationSettings application_settings = 6;
402+
// Optional. Top level wrapper for all application related settings in IAP
403+
ApplicationSettings application_settings = 6
404+
[(google.api.field_behavior) = OPTIONAL];
394405
}
395406

396407
// Access related settings for IAP protected apps.
397408
message AccessSettings {
398-
// GCIP claims and endpoint configurations for 3p identity providers.
399-
GcipSettings gcip_settings = 1;
409+
// Types of identity source supported by IAP.
410+
enum IdentitySource {
411+
// IdentitySource Unspecified.
412+
// When selected, IAP relies on which identity settings are fully configured
413+
// to redirect the traffic to. The precedence order is
414+
// WorkforceIdentitySettings > GcipSettings. If none is set, default to use
415+
// Google identity.
416+
IDENTITY_SOURCE_UNSPECIFIED = 0;
417+
418+
// Use external identities set up on Google Cloud Workforce Identity
419+
// Federation.
420+
WORKFORCE_IDENTITY_FEDERATION = 3;
421+
}
422+
423+
// Optional. GCIP claims and endpoint configurations for 3p identity
424+
// providers.
425+
GcipSettings gcip_settings = 1 [(google.api.field_behavior) = OPTIONAL];
426+
427+
// Optional. Configuration to allow cross-origin requests via IAP.
428+
CorsSettings cors_settings = 2 [(google.api.field_behavior) = OPTIONAL];
429+
430+
// Optional. Settings to configure IAP's OAuth behavior.
431+
OAuthSettings oauth_settings = 3 [(google.api.field_behavior) = OPTIONAL];
400432

401-
// Configuration to allow cross-origin requests via IAP.
402-
CorsSettings cors_settings = 2;
433+
// Optional. Settings to configure reauthentication policies in IAP.
434+
ReauthSettings reauth_settings = 6 [(google.api.field_behavior) = OPTIONAL];
403435

404-
// Settings to configure IAP's OAuth behavior.
405-
OAuthSettings oauth_settings = 3;
436+
// Optional. Settings to configure and enable allowed domains.
437+
AllowedDomainsSettings allowed_domains_settings = 7
438+
[(google.api.field_behavior) = OPTIONAL];
406439

407-
// Settings to configure reauthentication policies in IAP.
408-
ReauthSettings reauth_settings = 6;
440+
// Optional. Settings to configure the workforce identity federation,
441+
// including workforce pools and OAuth 2.0 settings.
442+
WorkforceIdentitySettings workforce_identity_settings = 9
443+
[(google.api.field_behavior) = OPTIONAL];
409444

410-
// Settings to configure and enable allowed domains.
411-
AllowedDomainsSettings allowed_domains_settings = 7;
445+
// Optional. Identity sources that IAP can use to authenticate the end user.
446+
// Only one identity source can be configured.
447+
repeated IdentitySource identity_sources = 10
448+
[(google.api.field_behavior) = OPTIONAL];
412449
}
413450

414451
// Allows customers to configure tenant_id for GCIP instance per-app.
415452
message GcipSettings {
416-
// GCIP tenant ids that are linked to the IAP resource.
453+
// Optional. GCIP tenant ids that are linked to the IAP resource.
417454
// tenant_ids could be a string beginning with a number character to indicate
418455
// authenticating with GCIP tenant flow, or in the format of _<ProjectNumber>
419456
// to indicate authenticating with GCIP agent flow.
420457
// If agent flow is used, tenant_ids should only contain one single element,
421458
// while for tenant flow, tenant_ids can contain multiple elements.
422-
repeated string tenant_ids = 1;
459+
repeated string tenant_ids = 1 [(google.api.field_behavior) = OPTIONAL];
423460

424461
// Login page URI associated with the GCIP tenants.
425462
// Typically, all resources within the same project share the same login page,
@@ -445,8 +482,36 @@ message OAuthSettings {
445482
// since access behavior is managed by IAM policies.
446483
google.protobuf.StringValue login_hint = 2;
447484

448-
// List of OAuth client IDs allowed to programmatically authenticate with IAP.
449-
repeated string programmatic_clients = 5;
485+
// Optional. List of client ids allowed to use IAP programmatically.
486+
repeated string programmatic_clients = 5
487+
[(google.api.field_behavior) = OPTIONAL];
488+
}
489+
490+
// WorkforceIdentitySettings allows customers to configure workforce pools and
491+
// OAuth 2.0 settings to gate their applications using a third-party IdP with
492+
// access control.
493+
message WorkforceIdentitySettings {
494+
// The workforce pool resources. Only one workforce pool is accepted.
495+
repeated string workforce_pools = 1;
496+
497+
// OAuth 2.0 settings for IAP to perform OIDC flow with workforce identity
498+
// federation services.
499+
OAuth2 oauth2 = 2;
500+
}
501+
502+
// The OAuth 2.0 Settings
503+
message OAuth2 {
504+
// The OAuth 2.0 client ID registered in the workforce identity federation
505+
// OAuth 2.0 Server.
506+
string client_id = 1;
507+
508+
// Input only. The OAuth 2.0 client secret created while registering the
509+
// client ID.
510+
string client_secret = 2 [(google.api.field_behavior) = INPUT_ONLY];
511+
512+
// Output only. SHA256 hash value for the client secret. This field is
513+
// returned by IAP when the settings are retrieved.
514+
string client_secret_sha256 = 3 [(google.api.field_behavior) = OUTPUT_ONLY];
450515
}
451516

452517
// Configuration for IAP reauthentication policies.
@@ -468,7 +533,7 @@ message ReauthSettings {
468533
ENROLLED_SECOND_FACTORS = 4;
469534
}
470535

471-
// Type of policy in the case of hierarchial policies.
536+
// Type of policy in the case of hierarchical policies.
472537
enum PolicyType {
473538
// Default value. This value is unused.
474539
POLICY_TYPE_UNSPECIFIED = 0;
@@ -481,42 +546,45 @@ message ReauthSettings {
481546
DEFAULT = 2;
482547
}
483548

484-
// Reauth method requested.
485-
Method method = 1;
549+
// Optional. Reauth method requested.
550+
Method method = 1 [(google.api.field_behavior) = OPTIONAL];
486551

487-
// Reauth session lifetime, how long before a user has to reauthenticate
488-
// again.
489-
google.protobuf.Duration max_age = 2;
552+
// Optional. Reauth session lifetime, how long before a user has to
553+
// reauthenticate again.
554+
google.protobuf.Duration max_age = 2 [(google.api.field_behavior) = OPTIONAL];
490555

491-
// How IAP determines the effective policy in cases of hierarchial policies.
492-
// Policies are merged from higher in the hierarchy to lower in the hierarchy.
493-
PolicyType policy_type = 3;
556+
// Optional. How IAP determines the effective policy in cases of hierarchical
557+
// policies. Policies are merged from higher in the hierarchy to lower in the
558+
// hierarchy.
559+
PolicyType policy_type = 3 [(google.api.field_behavior) = OPTIONAL];
494560
}
495561

496562
// Configuration for IAP allowed domains. Lets you to restrict access to an app
497563
// and allow access to only the domains that you list.
498564
message AllowedDomainsSettings {
499-
// Configuration for customers to opt in for the feature.
500-
optional bool enable = 1;
565+
// Optional. Configuration for customers to opt in for the feature.
566+
optional bool enable = 1 [(google.api.field_behavior) = OPTIONAL];
501567

502-
// List of trusted domains.
503-
repeated string domains = 2;
568+
// Optional. List of trusted domains.
569+
repeated string domains = 2 [(google.api.field_behavior) = OPTIONAL];
504570
}
505571

506572
// Wrapper over application specific settings for IAP.
507573
message ApplicationSettings {
508-
// Settings to configure IAP's behavior for a service mesh.
509-
CsmSettings csm_settings = 1;
574+
// Optional. Settings to configure IAP's behavior for a service mesh.
575+
CsmSettings csm_settings = 1 [(google.api.field_behavior) = OPTIONAL];
510576

511-
// Customization for Access Denied page.
512-
AccessDeniedPageSettings access_denied_page_settings = 2;
577+
// Optional. Customization for Access Denied page.
578+
AccessDeniedPageSettings access_denied_page_settings = 2
579+
[(google.api.field_behavior) = OPTIONAL];
513580

514581
// The Domain value to set for cookies generated by IAP. This value is not
515582
// validated by the API, but will be ignored at runtime if invalid.
516583
google.protobuf.StringValue cookie_domain = 3;
517584

518-
// Settings to configure attribute propagation.
519-
AttributePropagationSettings attribute_propagation_settings = 4;
585+
// Optional. Settings to configure attribute propagation.
586+
AttributePropagationSettings attribute_propagation_settings = 4
587+
[(google.api.field_behavior) = OPTIONAL];
520588
}
521589

522590
// Configuration for RCToken generated for service mesh workloads protected by
@@ -568,9 +636,9 @@ message AttributePropagationSettings {
568636
RCTOKEN = 3;
569637
}
570638

571-
// Raw string CEL expression. Must return a list of attributes. A maximum of
572-
// 45 attributes can be selected. Expressions can select different attribute
573-
// types from `attributes`: `attributes.saml_attributes`,
639+
// Optional. Raw string CEL expression. Must return a list of attributes. A
640+
// maximum of 45 attributes can be selected. Expressions can select different
641+
// attribute types from `attributes`: `attributes.saml_attributes`,
574642
// `attributes.iap_attributes`. The following functions are supported:
575643
//
576644
// - filter `<list>.filter(<iter_var>, <predicate>)`: Returns a subset of
@@ -596,19 +664,34 @@ message AttributePropagationSettings {
596664
//
597665
// Example expression: `attributes.saml_attributes.filter(x, x.name in
598666
// ['test']).append(attributes.iap_attributes.selectByName('exact').emitAs('custom').strict())`
599-
optional string expression = 1;
667+
optional string expression = 1 [(google.api.field_behavior) = OPTIONAL];
600668

601-
// Which output credentials attributes selected by the CEL expression should
602-
// be propagated in. All attributes will be fully duplicated in each selected
603-
// output credential.
604-
repeated OutputCredentials output_credentials = 2;
669+
// Optional. Which output credentials attributes selected by the CEL
670+
// expression should be propagated in. All attributes will be fully duplicated
671+
// in each selected output credential.
672+
repeated OutputCredentials output_credentials = 2
673+
[(google.api.field_behavior) = OPTIONAL];
605674

606-
// Whether the provided attribute propagation settings should be evaluated on
607-
// user requests. If set to true, attributes returned from the expression will
608-
// be propagated in the set output credentials.
609-
optional bool enable = 3;
675+
// Optional. Whether the provided attribute propagation settings should be
676+
// evaluated on user requests. If set to true, attributes returned from the
677+
// expression will be propagated in the set output credentials.
678+
optional bool enable = 3 [(google.api.field_behavior) = OPTIONAL];
610679
}
611680

681+
// Request sent to IAP Expression Linter endpoint.
682+
message ValidateIapAttributeExpressionRequest {
683+
// Required. The resource name of the IAP protected resource.
684+
string name = 1 [(google.api.field_behavior) = REQUIRED];
685+
686+
// Required. User input string expression. Should be of the form
687+
// `attributes.saml_attributes.filter(attribute, attribute.name in
688+
// ['{attribute_name}', '{attribute_name}'])`
689+
string expression = 2 [(google.api.field_behavior) = REQUIRED];
690+
}
691+
692+
// IAP Expression Linter endpoint returns empty response body.
693+
message ValidateIapAttributeExpressionResponse {}
694+
612695
// The request sent to ListBrands.
613696
message ListBrandsRequest {
614697
// Required. GCP Project number/id.

0 commit comments

Comments
 (0)