As of January 1, 2020 this library no longer supports Python 2 on the latest released version. Library versions released prior to that date will continue to be available. For more information please visit Python 2 support on Google Cloud.

Types for Google Cloud Iap v1 API

class google.cloud.iap_v1.types.AccessDeniedPageSettings(mapping=None, *, ignore_unknown_fields=False, **kwargs)

Bases: proto.message.Message

Custom content configuration for access denied page. IAP allows customers to define a custom URI to use as the error page when access is denied to users. If IAP prevents access to this page, the default IAP error page will be displayed instead.

access_denied_page_uri

The URI to be redirected to when access is denied.

Type

google.protobuf.wrappers_pb2.StringValue

generate_troubleshooting_uri

Whether to generate a troubleshooting URL on access denied events to this application.

Type

google.protobuf.wrappers_pb2.BoolValue

remediation_token_generation_enabled

Whether to generate remediation token on access denied events to this application.

This field is a member of oneof _remediation_token_generation_enabled.

Type

google.protobuf.wrappers_pb2.BoolValue

class google.cloud.iap_v1.types.AccessSettings(mapping=None, *, ignore_unknown_fields=False, **kwargs)

Bases: proto.message.Message

Access related settings for IAP protected apps.

gcip_settings

GCIP claims and endpoint configurations for 3p identity providers.

Type

google.cloud.iap_v1.types.GcipSettings

cors_settings

Configuration to allow cross-origin requests via IAP.

Type

google.cloud.iap_v1.types.CorsSettings

oauth_settings

Settings to configure IAP’s OAuth behavior.

Type

google.cloud.iap_v1.types.OAuthSettings

reauth_settings

Settings to configure reauthentication policies in IAP.

Type

google.cloud.iap_v1.types.ReauthSettings

allowed_domains_settings

Settings to configure and enable allowed domains.

Type

google.cloud.iap_v1.types.AllowedDomainsSettings

class google.cloud.iap_v1.types.AllowedDomainsSettings(mapping=None, *, ignore_unknown_fields=False, **kwargs)

Bases: proto.message.Message

Configuration for IAP allowed domains. Lets you to restrict access to an app and allow access to only the domains that you list.

enable

Configuration for customers to opt in for the feature.

This field is a member of oneof _enable.

Type

bool

domains

List of trusted domains.

Type

MutableSequence[str]

class google.cloud.iap_v1.types.ApplicationSettings(mapping=None, *, ignore_unknown_fields=False, **kwargs)

Bases: proto.message.Message

Wrapper over application specific settings for IAP.

csm_settings

Settings to configure IAP’s behavior for a service mesh.

Type

google.cloud.iap_v1.types.CsmSettings

access_denied_page_settings

Customization for Access Denied page.

Type

google.cloud.iap_v1.types.AccessDeniedPageSettings

cookie_domain

The Domain value to set for cookies generated by IAP. This value is not validated by the API, but will be ignored at runtime if invalid.

Type

google.protobuf.wrappers_pb2.StringValue

attribute_propagation_settings

Settings to configure attribute propagation.

Type

google.cloud.iap_v1.types.AttributePropagationSettings

class google.cloud.iap_v1.types.AttributePropagationSettings(mapping=None, *, ignore_unknown_fields=False, **kwargs)

Bases: proto.message.Message

Configuration for propagating attributes to applications protected by IAP.

expression

Raw string CEL expression. Must return a list of attributes. A maximum of 45 attributes can be selected. Expressions can select different attribute types from attributes: attributes.saml_attributes, attributes.iap_attributes. The following functions are supported:

• filter <list>.filter(<iter_var>, <predicate>): Returns a subset of <list> where <predicate> is true for every item.

• in <var> in <list>: Returns true if <list> contains <var>.

• selectByName <list>.selectByName(<string>): Returns the attribute in <list> with the given <string> name, otherwise returns empty.

• emitAs <attribute>.emitAs(<string>): Sets the <attribute> name field to the given <string> for propagation in selected output credentials.

• strict <attribute>.strict(): Ignores the x-goog-iap-attr- prefix for the provided <attribute> when propagating with the HEADER output credential, such as request headers.

• append <target_list>.append(<attribute>) OR <target_list>.append(<list>): Appends the provided <attribute> or <list> to the end of <target_list>.

Example expression: attributes.saml_attributes.filter(x, x.name in ['test']).append(attributes.iap_attributes.selectByName('exact').emitAs('custom').strict())

This field is a member of oneof _expression.

Type

str

output_credentials

Which output credentials attributes selected by the CEL expression should be propagated in. All attributes will be fully duplicated in each selected output credential.

Type

MutableSequence[google.cloud.iap_v1.types.AttributePropagationSettings.OutputCredentials]

enable

Whether the provided attribute propagation settings should be evaluated on user requests. If set to true, attributes returned from the expression will be propagated in the set output credentials.

This field is a member of oneof _enable.

Type

bool

class OutputCredentials(value)

Bases: proto.enums.Enum

Supported output credentials for attribute propagation. Each output credential maps to a “field” in the response. For example, selecting JWT will propagate all attributes in the IAP JWT, header in the headers, etc.

Values:

OUTPUT_CREDENTIALS_UNSPECIFIED (0):

An output credential is required.

HEADER (1):

Propagate attributes in the headers with “x-goog-iap-attr-” prefix.

JWT (2):

Propagate attributes in the JWT of the form: "additional_claims": { "my_attribute": ["value1", "value2"] }

RCTOKEN (3):

Propagate attributes in the RCToken of the form: "additional_claims": { "my_attribute": ["value1", "value2"] }

class google.cloud.iap_v1.types.Brand(mapping=None, *, ignore_unknown_fields=False, **kwargs)

Bases: proto.message.Message

OAuth brand data. NOTE: Only contains a portion of the data that describes a brand.

name

Output only. Identifier of the brand. NOTE: GCP project number achieves the same brand identification purpose as only one brand per project can be created.

Type

str

support_email

Support email displayed on the OAuth consent screen.

Type

str

application_title

Application name displayed on OAuth consent screen.

Type

str

org_internal_only

Output only. Whether the brand is only intended for usage inside the G Suite organization only.

Type

bool

class google.cloud.iap_v1.types.CorsSettings(mapping=None, *, ignore_unknown_fields=False, **kwargs)

Bases: proto.message.Message

Allows customers to configure HTTP request paths that’ll allow HTTP OPTIONS call to bypass authentication and authorization.

allow_http_options

Configuration to allow HTTP OPTIONS calls to skip authorization. If undefined, IAP will not apply any special logic to OPTIONS requests.

Type

google.protobuf.wrappers_pb2.BoolValue

class google.cloud.iap_v1.types.CreateBrandRequest(mapping=None, *, ignore_unknown_fields=False, **kwargs)

Bases: proto.message.Message

The request sent to CreateBrand.

parent

Required. GCP Project number/id under which the brand is to be created. In the following format: projects/{project_number/id}.

Type

str

brand

Required. The brand to be created.

Type

google.cloud.iap_v1.types.Brand

class google.cloud.iap_v1.types.CreateIdentityAwareProxyClientRequest(mapping=None, *, ignore_unknown_fields=False, **kwargs)

Bases: proto.message.Message

The request sent to CreateIdentityAwareProxyClient.

parent

Required. Path to create the client in. In the following format: projects/{project_number/id}/brands/{brand}. The project must belong to a G Suite account.

Type

str

identity_aware_proxy_client

Required. Identity Aware Proxy Client to be created.

Type

google.cloud.iap_v1.types.IdentityAwareProxyClient

class google.cloud.iap_v1.types.CreateTunnelDestGroupRequest(mapping=None, *, ignore_unknown_fields=False, **kwargs)

Bases: proto.message.Message

The request to CreateTunnelDestGroup.

parent

Required. Google Cloud Project ID and location. In the following format: projects/{project_number/id}/iap_tunnel/locations/{location}.

Type

str

tunnel_dest_group

Required. The TunnelDestGroup to create.

Type

google.cloud.iap_v1.types.TunnelDestGroup

tunnel_dest_group_id

Required. The ID to use for the TunnelDestGroup, which becomes the final component of the resource name.

This value must be 4-63 characters, and valid characters are [a-z]-.

Type

str

class google.cloud.iap_v1.types.CsmSettings(mapping=None, *, ignore_unknown_fields=False, **kwargs)

Bases: proto.message.Message

Configuration for RCToken generated for service mesh workloads protected by IAP. RCToken are IAP generated JWTs that can be verified at the application. The RCToken is primarily used for service mesh deployments, and can be scoped to a single mesh by configuring the audience field accordingly.

rctoken_aud

Audience claim set in the generated RCToken. This value is not validated by IAP.

Type

google.protobuf.wrappers_pb2.StringValue

class google.cloud.iap_v1.types.DeleteIdentityAwareProxyClientRequest(mapping=None, *, ignore_unknown_fields=False, **kwargs)

Bases: proto.message.Message

The request sent to DeleteIdentityAwareProxyClient.

name

Required. Name of the Identity Aware Proxy client to be deleted. In the following format: projects/{project_number/id}/brands/{brand}/identityAwareProxyClients/{client_id}.

Type

str

class google.cloud.iap_v1.types.DeleteTunnelDestGroupRequest(mapping=None, *, ignore_unknown_fields=False, **kwargs)

Bases: proto.message.Message

The request to DeleteTunnelDestGroup.

name

Required. Name of the TunnelDestGroup to delete. In the following format: projects/{project_number/id}/iap_tunnel/locations/{location}/destGroups/{dest_group}.

Type

str

class google.cloud.iap_v1.types.GcipSettings(mapping=None, *, ignore_unknown_fields=False, **kwargs)

Bases: proto.message.Message

Allows customers to configure tenant_id for GCIP instance per-app.

tenant_ids

GCIP tenant ids that are linked to the IAP resource. tenant_ids could be a string beginning with a number character to indicate authenticating with GCIP tenant flow, or in the format of _ to indicate authenticating with GCIP agent flow. If agent flow is used, tenant_ids should only contain one single element, while for tenant flow, tenant_ids can contain multiple elements.

Type

MutableSequence[str]

login_page_uri

Login page URI associated with the GCIP tenants. Typically, all resources within the same project share the same login page, though it could be overridden at the sub resource level.

Type

google.protobuf.wrappers_pb2.StringValue

class google.cloud.iap_v1.types.GetBrandRequest(mapping=None, *, ignore_unknown_fields=False, **kwargs)

Bases: proto.message.Message

The request sent to GetBrand.

name

Required. Name of the brand to be fetched. In the following format: projects/{project_number/id}/brands/{brand}.

Type

str

class google.cloud.iap_v1.types.GetIapSettingsRequest(mapping=None, *, ignore_unknown_fields=False, **kwargs)

Bases: proto.message.Message

The request sent to GetIapSettings.

name

Required. The resource name for which to retrieve the settings. Authorization: Requires the getSettings permission for the associated resource.

Type

str

class google.cloud.iap_v1.types.GetIdentityAwareProxyClientRequest(mapping=None, *, ignore_unknown_fields=False, **kwargs)

Bases: proto.message.Message

The request sent to GetIdentityAwareProxyClient.

name

Required. Name of the Identity Aware Proxy client to be fetched. In the following format: projects/{project_number/id}/brands/{brand}/identityAwareProxyClients/{client_id}.

Type

str

class google.cloud.iap_v1.types.GetTunnelDestGroupRequest(mapping=None, *, ignore_unknown_fields=False, **kwargs)

Bases: proto.message.Message

The request to GetTunnelDestGroup.

name

Required. Name of the TunnelDestGroup to be fetched. In the following format: projects/{project_number/id}/iap_tunnel/locations/{location}/destGroups/{dest_group}.

Type

str

class google.cloud.iap_v1.types.IapSettings(mapping=None, *, ignore_unknown_fields=False, **kwargs)

Bases: proto.message.Message

The IAP configurable settings.

name

Required. The resource name of the IAP protected resource.

Type

str

access_settings

Top level wrapper for all access related setting in IAP

Type

google.cloud.iap_v1.types.AccessSettings

application_settings

Top level wrapper for all application related settings in IAP

Type

google.cloud.iap_v1.types.ApplicationSettings

class google.cloud.iap_v1.types.IdentityAwareProxyClient(mapping=None, *, ignore_unknown_fields=False, **kwargs)

Bases: proto.message.Message

Contains the data that describes an Identity Aware Proxy owned client.

name

Output only. Unique identifier of the OAuth client.

Type

str

secret

Output only. Client secret of the OAuth client.

Type

str

display_name

Human-friendly name given to the OAuth client.

Type

str

class google.cloud.iap_v1.types.ListBrandsRequest(mapping=None, *, ignore_unknown_fields=False, **kwargs)

Bases: proto.message.Message

The request sent to ListBrands.

parent

Required. GCP Project number/id. In the following format: projects/{project_number/id}.

Type

str

class google.cloud.iap_v1.types.ListBrandsResponse(mapping=None, *, ignore_unknown_fields=False, **kwargs)

Bases: proto.message.Message

Response message for ListBrands.

brands

Brands existing in the project.

Type

MutableSequence[google.cloud.iap_v1.types.Brand]

class google.cloud.iap_v1.types.ListIdentityAwareProxyClientsRequest(mapping=None, *, ignore_unknown_fields=False, **kwargs)

Bases: proto.message.Message

The request sent to ListIdentityAwareProxyClients.

parent

Required. Full brand path. In the following format: projects/{project_number/id}/brands/{brand}.

Type

str

page_size

The maximum number of clients to return. The service may return fewer than this value. If unspecified, at most 100 clients will be returned. The maximum value is 1000; values above 1000 will be coerced to 1000.

Type

int

page_token

A page token, received from a previous ListIdentityAwareProxyClients call. Provide this to retrieve the subsequent page.

When paginating, all other parameters provided to ListIdentityAwareProxyClients must match the call that provided the page token.

Type

str

class google.cloud.iap_v1.types.ListIdentityAwareProxyClientsResponse(mapping=None, *, ignore_unknown_fields=False, **kwargs)

Bases: proto.message.Message

Response message for ListIdentityAwareProxyClients.

identity_aware_proxy_clients

Clients existing in the brand.

Type

MutableSequence[google.cloud.iap_v1.types.IdentityAwareProxyClient]

next_page_token

A token, which can be send as page_token to retrieve the next page. If this field is omitted, there are no subsequent pages.

Type

str

class google.cloud.iap_v1.types.ListTunnelDestGroupsRequest(mapping=None, *, ignore_unknown_fields=False, **kwargs)

Bases: proto.message.Message

The request to ListTunnelDestGroups.

parent

Required. Google Cloud Project ID and location. In the following format: projects/{project_number/id}/iap_tunnel/locations/{location}. A - can be used for the location to group across all locations.

Type

str

page_size

The maximum number of groups to return. The service might return fewer than this value. If unspecified, at most 100 groups are returned. The maximum value is 1000; values above 1000 are coerced to 1000.

Type

int

page_token

A page token, received from a previous ListTunnelDestGroups call. Provide this to retrieve the subsequent page.

When paginating, all other parameters provided to ListTunnelDestGroups must match the call that provided the page token.

Type

str

class google.cloud.iap_v1.types.ListTunnelDestGroupsResponse(mapping=None, *, ignore_unknown_fields=False, **kwargs)

Bases: proto.message.Message

The response from ListTunnelDestGroups.

tunnel_dest_groups

TunnelDestGroup existing in the project.

Type

MutableSequence[google.cloud.iap_v1.types.TunnelDestGroup]

next_page_token

A token that you can send as page_token to retrieve the next page. If this field is omitted, there are no subsequent pages.

Type

str

class google.cloud.iap_v1.types.OAuthSettings(mapping=None, *, ignore_unknown_fields=False, **kwargs)

Bases: proto.message.Message

Configuration for OAuth login&consent flow behavior as well as for OAuth Credentials.

login_hint

Domain hint to send as hd=? parameter in OAuth request flow. Enables redirect to primary IDP by skipping Google’s login screen. https://developers.google.com/identity/protocols/OpenIDConnect#hd-param Note: IAP does not verify that the id token’s hd claim matches this value since access behavior is managed by IAM policies.

Type

google.protobuf.wrappers_pb2.StringValue

programmatic_clients

List of OAuth client IDs allowed to programmatically authenticate with IAP.

Type

MutableSequence[str]

class google.cloud.iap_v1.types.ReauthSettings(mapping=None, *, ignore_unknown_fields=False, **kwargs)

Bases: proto.message.Message

Configuration for IAP reauthentication policies.

method

Reauth method requested.

Type

google.cloud.iap_v1.types.ReauthSettings.Method

max_age

Reauth session lifetime, how long before a user has to reauthenticate again.

Type

google.protobuf.duration_pb2.Duration

policy_type

How IAP determines the effective policy in cases of hierarchial policies. Policies are merged from higher in the hierarchy to lower in the hierarchy.

Type

google.cloud.iap_v1.types.ReauthSettings.PolicyType

class Method(value)

Bases: proto.enums.Enum

Types of reauthentication methods supported by IAP.

Values:

METHOD_UNSPECIFIED (0):

Reauthentication disabled.

LOGIN (1):

Prompts the user to log in again.

PASSWORD (2):

No description available.

SECURE_KEY (3):

User must use their secure key 2nd factor device.

ENROLLED_SECOND_FACTORS (4):

User can use any enabled 2nd factor.

class PolicyType(value)

Bases: proto.enums.Enum

Type of policy in the case of hierarchial policies.

Values:

POLICY_TYPE_UNSPECIFIED (0):

Default value. This value is unused.

MINIMUM (1):

This policy acts as a minimum to other policies, lower in the hierarchy. Effective policy may only be the same or stricter.

DEFAULT (2):

This policy acts as a default if no other reauth policy is set.

class google.cloud.iap_v1.types.ResetIdentityAwareProxyClientSecretRequest(mapping=None, *, ignore_unknown_fields=False, **kwargs)

Bases: proto.message.Message

The request sent to ResetIdentityAwareProxyClientSecret.

name

Required. Name of the Identity Aware Proxy client to that will have its secret reset. In the following format: projects/{project_number/id}/brands/{brand}/identityAwareProxyClients/{client_id}.

Type

str

class google.cloud.iap_v1.types.TunnelDestGroup(mapping=None, *, ignore_unknown_fields=False, **kwargs)

Bases: proto.message.Message

A TunnelDestGroup.

name

Required. Immutable. Identifier for the TunnelDestGroup. Must be unique within the project and contain only lower case letters (a-z) and dashes (-).

Type

str

cidrs

Unordered list. List of CIDRs that this group applies to.

Type

MutableSequence[str]

fqdns

Unordered list. List of FQDNs that this group applies to.

Type

MutableSequence[str]

class google.cloud.iap_v1.types.UpdateIapSettingsRequest(mapping=None, *, ignore_unknown_fields=False, **kwargs)

Bases: proto.message.Message

The request sent to UpdateIapSettings.

iap_settings

Required. The new values for the IAP settings to be updated. Authorization: Requires the updateSettings permission for the associated resource.

Type

google.cloud.iap_v1.types.IapSettings

update_mask

The field mask specifying which IAP settings should be updated. If omitted, then all of the settings are updated. See https://developers.google.com/protocol-buffers/docs/reference/google.protobuf#fieldmask.

Note: All IAP reauth settings must always be set together, using the field mask: iapSettings.accessSettings.reauthSettings.

Type

google.protobuf.field_mask_pb2.FieldMask

class google.cloud.iap_v1.types.UpdateTunnelDestGroupRequest(mapping=None, *, ignore_unknown_fields=False, **kwargs)

Bases: proto.message.Message

The request to UpdateTunnelDestGroup.

tunnel_dest_group

Required. The new values for the TunnelDestGroup.

Type

google.cloud.iap_v1.types.TunnelDestGroup

update_mask

A field mask that specifies which IAP settings to update. If omitted, then all of the settings are updated. See https://developers.google.com/protocol-buffers/docs/reference/google.protobuf#fieldmask

Type

google.protobuf.field_mask_pb2.FieldMask