Skip to content
This repository was archived by the owner on Jul 20, 2023. It is now read-only.

Commit 54419ef

Browse files
gcf-owl-bot[bot]gcf-owl-bot[bot]
authored
feat: add the TunnelDestGroup-related methods and types (#63)
feat: add the TunnelDestGroup-related methods and types feat: add ReauthSettings to the UpdateIapSettingsRequest PiperOrigin-RevId: 448510642 Source-Link: googleapis/googleapis@dd6f8df Source-Link: https://github.com/googleapis/googleapis-gen/commit/f94b4742c286a4e40c9f8c9c4c6071eea5d959da Copy-Tag: eyJwIjoiLmdpdGh1Yi8uT3dsQm90LnlhbWwiLCJoIjoiZjk0YjQ3NDJjMjg2YTRlNDBjOWY4YzljNGM2MDcxZWVhNWQ5NTlkYSJ9 See https://github.com/googleapis/repo-automation-bots/blob/main/packages/owl-bot/README.md Co-authored-by: Owl Bot <gcf-owl-bot[bot]@users.noreply.github.com>
1 parent 69c95c3 commit 54419ef

16 files changed

Lines changed: 7632 additions & 1038 deletions

‎protos/google/cloud/iap/v1/service.proto‎

Lines changed: 258 additions & 39 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
// Copyright 2021 Google LLC
1+
// Copyright 2022 Google LLC
22
//
33
// Licensed under the Apache License, Version 2.0 (the "License");
44
// you may not use this file except in compliance with the License.
@@ -17,20 +17,26 @@ syntax = "proto3";
1717
package google.cloud.iap.v1;
1818

1919
import "google/api/annotations.proto";
20+
import "google/api/client.proto";
2021
import "google/api/field_behavior.proto";
22+
import "google/api/resource.proto";
2123
import "google/iam/v1/iam_policy.proto";
2224
import "google/iam/v1/policy.proto";
25+
import "google/protobuf/duration.proto";
2326
import "google/protobuf/empty.proto";
2427
import "google/protobuf/field_mask.proto";
2528
import "google/protobuf/wrappers.proto";
26-
import "google/api/client.proto";
2729

2830
option csharp_namespace = "Google.Cloud.Iap.V1";
2931
option go_package = "google.golang.org/genproto/googleapis/cloud/iap/v1;iap";
3032
option java_multiple_files = true;
3133
option java_package = "com.google.cloud.iap.v1";
3234
option php_namespace = "Google\\Cloud\\Iap\\V1";
3335
option ruby_package = "Google::Cloud::Iap::V1";
36+
option (google.api.resource_definition) = {
37+
type: "iap.googleapis.com/TunnelLocation"
38+
pattern: "projects/{project}/iap_tunnel/locations/{location}"
39+
};
3440

3541
// APIs for Identity-Aware Proxy Admin configurations.
3642
service IdentityAwareProxyAdminService {
@@ -85,51 +91,169 @@ service IdentityAwareProxyAdminService {
8591
body: "iap_settings"
8692
};
8793
}
94+
95+
// Lists the existing TunnelDestGroups. To group across all locations, use a
96+
// `-` as the location ID. For example:
97+
// `/v1/projects/123/iap_tunnel/locations/-/destGroups`
98+
rpc ListTunnelDestGroups(ListTunnelDestGroupsRequest) returns (ListTunnelDestGroupsResponse) {
99+
option (google.api.http) = {
100+
get: "/v1/{parent=projects/*/iap_tunnel/locations/*}/destGroups"
101+
};
102+
option (google.api.method_signature) = "parent";
103+
}
104+
105+
// Creates a new TunnelDestGroup.
106+
rpc CreateTunnelDestGroup(CreateTunnelDestGroupRequest) returns (TunnelDestGroup) {
107+
option (google.api.http) = {
108+
post: "/v1/{parent=projects/*/iap_tunnel/locations/*}/destGroups"
109+
body: "tunnel_dest_group"
110+
};
111+
option (google.api.method_signature) = "parent,tunnel_dest_group,tunnel_dest_group_id";
112+
}
113+
114+
// Retrieves an existing TunnelDestGroup.
115+
rpc GetTunnelDestGroup(GetTunnelDestGroupRequest) returns (TunnelDestGroup) {
116+
option (google.api.http) = {
117+
get: "/v1/{name=projects/*/iap_tunnel/locations/*/destGroups/*}"
118+
};
119+
option (google.api.method_signature) = "name";
120+
}
121+
122+
// Deletes a TunnelDestGroup.
123+
rpc DeleteTunnelDestGroup(DeleteTunnelDestGroupRequest) returns (google.protobuf.Empty) {
124+
option (google.api.http) = {
125+
delete: "/v1/{name=projects/*/iap_tunnel/locations/*/destGroups/*}"
126+
};
127+
option (google.api.method_signature) = "name";
128+
}
129+
130+
// Updates a TunnelDestGroup.
131+
rpc UpdateTunnelDestGroup(UpdateTunnelDestGroupRequest) returns (TunnelDestGroup) {
132+
option (google.api.http) = {
133+
patch: "/v1/{tunnel_dest_group.name=projects/*/iap_tunnel/locations/*/destGroups/*}"
134+
body: "tunnel_dest_group"
135+
};
136+
option (google.api.method_signature) = "tunnel_dest_group,update_mask";
137+
}
88138
}
89139

90-
// The request sent to GetIapSettings.
91-
message GetIapSettingsRequest {
92-
// Required. The resource name for which to retrieve the settings.
93-
// Authorization: Requires the `getSettings` permission for the associated
94-
// resource.
95-
string name = 1 [(google.api.field_behavior) = REQUIRED];
140+
// The request to ListTunnelDestGroups.
141+
message ListTunnelDestGroupsRequest {
142+
// Required. Google Cloud Project ID and location.
143+
// In the following format:
144+
// `projects/{project_number/id}/iap_tunnel/locations/{location}`.
145+
// A `-` can be used for the location to group across all locations.
146+
string parent = 1 [
147+
(google.api.field_behavior) = REQUIRED,
148+
(google.api.resource_reference) = {
149+
type: "iap.googleapis.com/TunnelLocation"
150+
}
151+
];
152+
153+
// The maximum number of groups to return. The service might return fewer than
154+
// this value.
155+
// If unspecified, at most 100 groups are returned.
156+
// The maximum value is 1000; values above 1000 are coerced to 1000.
157+
int32 page_size = 2;
158+
159+
// A page token, received from a previous `ListTunnelDestGroups`
160+
// call. Provide this to retrieve the subsequent page.
161+
//
162+
// When paginating, all other parameters provided to
163+
// `ListTunnelDestGroups` must match the call that provided the page
164+
// token.
165+
string page_token = 3;
96166
}
97167

98-
// The request sent to UpdateIapSettings.
99-
message UpdateIapSettingsRequest {
100-
// Required. The new values for the IAP settings to be updated.
101-
// Authorization: Requires the `updateSettings` permission for the associated
102-
// resource.
103-
IapSettings iap_settings = 1 [(google.api.field_behavior) = REQUIRED];
168+
// The response from ListTunnelDestGroups.
169+
message ListTunnelDestGroupsResponse {
170+
// TunnelDestGroup existing in the project.
171+
repeated TunnelDestGroup tunnel_dest_groups = 1;
104172

105-
// The field mask specifying which IAP settings should be updated.
106-
// If omitted, the all of the settings are updated. See
107-
// https://developers.google.com/protocol-buffers/docs/reference/google.protobuf#fieldmask
108-
google.protobuf.FieldMask update_mask = 2;
173+
// A token that you can send as `page_token` to retrieve the next page.
174+
// If this field is omitted, there are no subsequent pages.
175+
string next_page_token = 2;
109176
}
110177

111-
// The IAP configurable settings.
112-
message IapSettings {
113-
// Required. The resource name of the IAP protected resource.
114-
string name = 1 [(google.api.field_behavior) = REQUIRED];
178+
// The request to CreateTunnelDestGroup.
179+
message CreateTunnelDestGroupRequest {
180+
// Required. Google Cloud Project ID and location.
181+
// In the following format:
182+
// `projects/{project_number/id}/iap_tunnel/locations/{location}`.
183+
string parent = 1 [
184+
(google.api.field_behavior) = REQUIRED,
185+
(google.api.resource_reference) = {
186+
child_type: "iap.googleapis.com/TunnelDestGroup"
187+
}
188+
];
189+
190+
// Required. The TunnelDestGroup to create.
191+
TunnelDestGroup tunnel_dest_group = 2 [(google.api.field_behavior) = REQUIRED];
192+
193+
// Required. The ID to use for the TunnelDestGroup, which becomes the final component of
194+
// the resource name.
195+
//
196+
// This value must be 4-63 characters, and valid characters
197+
// are `[a-z][0-9]-`.
198+
string tunnel_dest_group_id = 3 [(google.api.field_behavior) = REQUIRED];
199+
}
115200

116-
// Top level wrapper for all access related setting in IAP
117-
AccessSettings access_settings = 5;
201+
// The request to GetTunnelDestGroup.
202+
message GetTunnelDestGroupRequest {
203+
// Required. Name of the TunnelDestGroup to be fetched.
204+
// In the following format:
205+
// `projects/{project_number/id}/iap_tunnel/locations/{location}/destGroups/{dest_group}`.
206+
string name = 1 [
207+
(google.api.field_behavior) = REQUIRED,
208+
(google.api.resource_reference) = {
209+
type: "iap.googleapis.com/TunnelDestGroup"
210+
}
211+
];
212+
}
118213

119-
// Top level wrapper for all application related settings in IAP
120-
ApplicationSettings application_settings = 6;
214+
// The request to DeleteTunnelDestGroup.
215+
message DeleteTunnelDestGroupRequest {
216+
// Required. Name of the TunnelDestGroup to delete.
217+
// In the following format:
218+
// `projects/{project_number/id}/iap_tunnel/locations/{location}/destGroups/{dest_group}`.
219+
string name = 1 [
220+
(google.api.field_behavior) = REQUIRED,
221+
(google.api.resource_reference) = {
222+
type: "iap.googleapis.com/TunnelDestGroup"
223+
}
224+
];
121225
}
122226

123-
// Access related settings for IAP protected apps.
124-
message AccessSettings {
125-
// GCIP claims and endpoint configurations for 3p identity providers.
126-
GcipSettings gcip_settings = 1;
227+
// The request to UpdateTunnelDestGroup.
228+
message UpdateTunnelDestGroupRequest {
229+
// Required. The new values for the TunnelDestGroup.
230+
TunnelDestGroup tunnel_dest_group = 1 [(google.api.field_behavior) = REQUIRED];
127231

128-
// Configuration to allow cross-origin requests via IAP.
129-
CorsSettings cors_settings = 2;
232+
// A field mask that specifies which IAP settings to update.
233+
// If omitted, then all of the settings are updated. See
234+
// https://developers.google.com/protocol-buffers/docs/reference/google.protobuf#fieldmask
235+
google.protobuf.FieldMask update_mask = 2;
236+
}
130237

131-
// Settings to configure IAP's OAuth behavior.
132-
OAuthSettings oauth_settings = 3;
238+
// A TunnelDestGroup.
239+
message TunnelDestGroup {
240+
option (google.api.resource) = {
241+
type: "iap.googleapis.com/TunnelDestGroup"
242+
pattern: "projects/{project}/iap_tunnel/locations/{location}/destGroups/{dest_group}"
243+
};
244+
245+
// Required. Immutable. Identifier for the TunnelDestGroup. Must be unique within the
246+
// project.
247+
string name = 1 [
248+
(google.api.field_behavior) = REQUIRED,
249+
(google.api.field_behavior) = IMMUTABLE
250+
];
251+
252+
// null List of CIDRs that this group applies to.
253+
repeated string cidrs = 2 [(google.api.field_behavior) = UNORDERED_LIST];
254+
255+
// null List of FQDNs that this group applies to.
256+
repeated string fqdns = 3 [(google.api.field_behavior) = UNORDERED_LIST];
133257
}
134258

135259
// API to programmatically create, list and retrieve Identity Aware Proxy (IAP)
@@ -148,11 +272,12 @@ service IdentityAwareProxyOAuthService {
148272

149273
// Constructs a new OAuth brand for the project if one does not exist.
150274
// The created brand is "internal only", meaning that OAuth clients created
151-
// under it only accept requests from users who belong to the same G Suite
152-
// organization as the project. The brand is created in an un-reviewed status.
153-
// NOTE: The "internal only" status can be manually changed in the Google
154-
// Cloud console. Requires that a brand does not already exist for the
155-
// project, and that the specified support email is owned by the caller.
275+
// under it only accept requests from users who belong to the same Google
276+
// Workspace organization as the project. The brand is created in an
277+
// un-reviewed status. NOTE: The "internal only" status can be manually
278+
// changed in the Google Cloud Console. Requires that a brand does not already
279+
// exist for the project, and that the specified support email is owned by the
280+
// caller.
156281
rpc CreateBrand(CreateBrandRequest) returns (Brand) {
157282
option (google.api.http) = {
158283
post: "/v1/{parent=projects/*}/brands"
@@ -211,6 +336,54 @@ service IdentityAwareProxyOAuthService {
211336
}
212337
}
213338

339+
// The request sent to GetIapSettings.
340+
message GetIapSettingsRequest {
341+
// Required. The resource name for which to retrieve the settings.
342+
// Authorization: Requires the `getSettings` permission for the associated
343+
// resource.
344+
string name = 1 [(google.api.field_behavior) = REQUIRED];
345+
}
346+
347+
// The request sent to UpdateIapSettings.
348+
message UpdateIapSettingsRequest {
349+
// Required. The new values for the IAP settings to be updated.
350+
// Authorization: Requires the `updateSettings` permission for the associated
351+
// resource.
352+
IapSettings iap_settings = 1 [(google.api.field_behavior) = REQUIRED];
353+
354+
// The field mask specifying which IAP settings should be updated.
355+
// If omitted, the all of the settings are updated. See
356+
// https://developers.google.com/protocol-buffers/docs/reference/google.protobuf#fieldmask
357+
google.protobuf.FieldMask update_mask = 2;
358+
}
359+
360+
// The IAP configurable settings.
361+
message IapSettings {
362+
// Required. The resource name of the IAP protected resource.
363+
string name = 1 [(google.api.field_behavior) = REQUIRED];
364+
365+
// Top level wrapper for all access related setting in IAP
366+
AccessSettings access_settings = 5;
367+
368+
// Top level wrapper for all application related settings in IAP
369+
ApplicationSettings application_settings = 6;
370+
}
371+
372+
// Access related settings for IAP protected apps.
373+
message AccessSettings {
374+
// GCIP claims and endpoint configurations for 3p identity providers.
375+
GcipSettings gcip_settings = 1;
376+
377+
// Configuration to allow cross-origin requests via IAP.
378+
CorsSettings cors_settings = 2;
379+
380+
// Settings to configure IAP's OAuth behavior.
381+
OAuthSettings oauth_settings = 3;
382+
383+
// Settings to configure reauthentication policies in IAP.
384+
ReauthSettings reauth_settings = 6;
385+
}
386+
214387
// Allows customers to configure tenant_id for GCIP instance per-app.
215388
message GcipSettings {
216389
// GCIP tenant ids that are linked to the IAP resource.
@@ -246,6 +419,52 @@ message OAuthSettings {
246419
google.protobuf.StringValue login_hint = 2;
247420
}
248421

422+
// Configuration for IAP reauthentication policies.
423+
message ReauthSettings {
424+
// Types of reauthentication methods supported by IAP.
425+
enum Method {
426+
// Reauthentication disabled.
427+
METHOD_UNSPECIFIED = 0;
428+
429+
// Mimics the behavior as if the user had logged out and tried to log in
430+
// again. Users with 2SV (2-step verification) enabled see their 2SV
431+
// challenges if they did not opt to have their second factor responses
432+
// saved. Apps Core (GSuites) admins can configure settings to disable 2SV
433+
// cookies and require 2SV for all Apps Core users in their domains.
434+
LOGIN = 1;
435+
436+
// User must type their password.
437+
PASSWORD = 2;
438+
439+
// User must use their secure key 2nd factor device.
440+
SECURE_KEY = 3;
441+
}
442+
443+
// Type of policy in the case of hierarchial policies.
444+
enum PolicyType {
445+
// Default value. This value is unused.
446+
POLICY_TYPE_UNSPECIFIED = 0;
447+
448+
// This policy acts as a minimum to other policies, lower in the hierarchy.
449+
// Effective policy may only be the same or stricter.
450+
MINIMUM = 1;
451+
452+
// This policy acts as a default if no other reauth policy is set.
453+
DEFAULT = 2;
454+
}
455+
456+
// Reauth method required by the policy.
457+
Method method = 1;
458+
459+
// Reauth session lifetime, how long before a user has to reauthenticate
460+
// again.
461+
google.protobuf.Duration max_age = 2;
462+
463+
// How IAP determines the effective policy in cases of hierarchial policies.
464+
// Policies are merged from higher in the hierarchy to lower in the hierarchy.
465+
PolicyType policy_type = 3;
466+
}
467+
249468
// Wrapper over application specific settings for IAP.
250469
message ApplicationSettings {
251470
// Settings to configure IAP's behavior for a CSM mesh.

0 commit comments

Comments
 (0)