Skip to content

Commit d2d07fc

Browse files
Google APIscopybara-github
Google APIs
authored and
copybara-github
committed
feat: add an enum ENROLLED_SECOND_FACTORS under IapSettings
 docs: update doc description for field_mask PiperOrigin-RevId: 516408359
1 parent 197c82f commit d2d07fc

1 file changed

Lines changed: 95 additions & 89 deletions

File tree

‎google/cloud/iap/v1/service.proto‎

Lines changed: 95 additions & 89 deletions
Original file line numberDiff line numberDiff line change
@@ -148,6 +148,93 @@ service IdentityAwareProxyAdminService {
148148
}
149149
}
150150

151+
// API to programmatically create, list and retrieve Identity Aware Proxy (IAP)
152+
// OAuth brands; and create, retrieve, delete and reset-secret of IAP OAuth
153+
// clients.
154+
service IdentityAwareProxyOAuthService {
155+
option (google.api.default_host) = "iap.googleapis.com";
156+
option (google.api.oauth_scopes) =
157+
"https://www.googleapis.com/auth/cloud-platform";
158+
159+
// Lists the existing brands for the project.
160+
rpc ListBrands(ListBrandsRequest) returns (ListBrandsResponse) {
161+
option (google.api.http) = {
162+
get: "/v1/{parent=projects/*}/brands"
163+
};
164+
}
165+
166+
// Constructs a new OAuth brand for the project if one does not exist.
167+
// The created brand is "internal only", meaning that OAuth clients created
168+
// under it only accept requests from users who belong to the same Google
169+
// Workspace organization as the project. The brand is created in an
170+
// un-reviewed status. NOTE: The "internal only" status can be manually
171+
// changed in the Google Cloud Console. Requires that a brand does not already
172+
// exist for the project, and that the specified support email is owned by the
173+
// caller.
174+
rpc CreateBrand(CreateBrandRequest) returns (Brand) {
175+
option (google.api.http) = {
176+
post: "/v1/{parent=projects/*}/brands"
177+
body: "brand"
178+
};
179+
}
180+
181+
// Retrieves the OAuth brand of the project.
182+
rpc GetBrand(GetBrandRequest) returns (Brand) {
183+
option (google.api.http) = {
184+
get: "/v1/{name=projects/*/brands/*}"
185+
};
186+
}
187+
188+
// Creates an Identity Aware Proxy (IAP) OAuth client. The client is owned
189+
// by IAP. Requires that the brand for the project exists and that it is
190+
// set for internal-only use.
191+
rpc CreateIdentityAwareProxyClient(CreateIdentityAwareProxyClientRequest)
192+
returns (IdentityAwareProxyClient) {
193+
option (google.api.http) = {
194+
post: "/v1/{parent=projects/*/brands/*}/identityAwareProxyClients"
195+
body: "identity_aware_proxy_client"
196+
};
197+
}
198+
199+
// Lists the existing clients for the brand.
200+
rpc ListIdentityAwareProxyClients(ListIdentityAwareProxyClientsRequest)
201+
returns (ListIdentityAwareProxyClientsResponse) {
202+
option (google.api.http) = {
203+
get: "/v1/{parent=projects/*/brands/*}/identityAwareProxyClients"
204+
};
205+
}
206+
207+
// Retrieves an Identity Aware Proxy (IAP) OAuth client.
208+
// Requires that the client is owned by IAP.
209+
rpc GetIdentityAwareProxyClient(GetIdentityAwareProxyClientRequest)
210+
returns (IdentityAwareProxyClient) {
211+
option (google.api.http) = {
212+
get: "/v1/{name=projects/*/brands/*/identityAwareProxyClients/*}"
213+
};
214+
}
215+
216+
// Resets an Identity Aware Proxy (IAP) OAuth client secret. Useful if the
217+
// secret was compromised. Requires that the client is owned by IAP.
218+
rpc ResetIdentityAwareProxyClientSecret(
219+
ResetIdentityAwareProxyClientSecretRequest)
220+
returns (IdentityAwareProxyClient) {
221+
option (google.api.http) = {
222+
post: "/v1/{name=projects/*/brands/*/identityAwareProxyClients/*}:resetSecret"
223+
body: "*"
224+
};
225+
}
226+
227+
// Deletes an Identity Aware Proxy (IAP) OAuth client. Useful for removing
228+
// obsolete clients, managing the number of clients in a given project, and
229+
// cleaning up after tests. Requires that the client is owned by IAP.
230+
rpc DeleteIdentityAwareProxyClient(DeleteIdentityAwareProxyClientRequest)
231+
returns (google.protobuf.Empty) {
232+
option (google.api.http) = {
233+
delete: "/v1/{name=projects/*/brands/*/identityAwareProxyClients/*}"
234+
};
235+
}
236+
}
237+
151238
// The request to ListTunnelDestGroups.
152239
message ListTunnelDestGroupsRequest {
153240
// Required. Google Cloud Project ID and location.
@@ -286,8 +373,11 @@ message UpdateIapSettingsRequest {
286373
IapSettings iap_settings = 1 [(google.api.field_behavior) = REQUIRED];
287374

288375
// The field mask specifying which IAP settings should be updated.
289-
// If omitted, the all of the settings are updated. See
290-
// https://developers.google.com/protocol-buffers/docs/reference/google.protobuf#fieldmask
376+
// If omitted, then all of the settings are updated. See
377+
// https://developers.google.com/protocol-buffers/docs/reference/google.protobuf#fieldmask.
378+
//
379+
// Note: All IAP reauth settings must always be set together, using the
380+
// field mask: `iapSettings.accessSettings.reauthSettings`.
291381
google.protobuf.FieldMask update_mask = 2;
292382
}
293383

@@ -371,6 +461,9 @@ message ReauthSettings {
371461

372462
// User must use their secure key 2nd factor device.
373463
SECURE_KEY = 3;
464+
465+
// User can use any enabled 2nd factor.
466+
ENROLLED_SECOND_FACTORS = 4;
374467
}
375468

376469
// Type of policy in the case of hierarchial policies.
@@ -508,93 +601,6 @@ message AttributePropagationSettings {
508601
optional bool enable = 3;
509602
}
510603

511-
// API to programmatically create, list and retrieve Identity Aware Proxy (IAP)
512-
// OAuth brands; and create, retrieve, delete and reset-secret of IAP OAuth
513-
// clients.
514-
service IdentityAwareProxyOAuthService {
515-
option (google.api.default_host) = "iap.googleapis.com";
516-
option (google.api.oauth_scopes) =
517-
"https://www.googleapis.com/auth/cloud-platform";
518-
519-
// Lists the existing brands for the project.
520-
rpc ListBrands(ListBrandsRequest) returns (ListBrandsResponse) {
521-
option (google.api.http) = {
522-
get: "/v1/{parent=projects/*}/brands"
523-
};
524-
}
525-
526-
// Constructs a new OAuth brand for the project if one does not exist.
527-
// The created brand is "internal only", meaning that OAuth clients created
528-
// under it only accept requests from users who belong to the same Google
529-
// Workspace organization as the project. The brand is created in an
530-
// un-reviewed status. NOTE: The "internal only" status can be manually
531-
// changed in the Google Cloud Console. Requires that a brand does not already
532-
// exist for the project, and that the specified support email is owned by the
533-
// caller.
534-
rpc CreateBrand(CreateBrandRequest) returns (Brand) {
535-
option (google.api.http) = {
536-
post: "/v1/{parent=projects/*}/brands"
537-
body: "brand"
538-
};
539-
}
540-
541-
// Retrieves the OAuth brand of the project.
542-
rpc GetBrand(GetBrandRequest) returns (Brand) {
543-
option (google.api.http) = {
544-
get: "/v1/{name=projects/*/brands/*}"
545-
};
546-
}
547-
548-
// Creates an Identity Aware Proxy (IAP) OAuth client. The client is owned
549-
// by IAP. Requires that the brand for the project exists and that it is
550-
// set for internal-only use.
551-
rpc CreateIdentityAwareProxyClient(CreateIdentityAwareProxyClientRequest)
552-
returns (IdentityAwareProxyClient) {
553-
option (google.api.http) = {
554-
post: "/v1/{parent=projects/*/brands/*}/identityAwareProxyClients"
555-
body: "identity_aware_proxy_client"
556-
};
557-
}
558-
559-
// Lists the existing clients for the brand.
560-
rpc ListIdentityAwareProxyClients(ListIdentityAwareProxyClientsRequest)
561-
returns (ListIdentityAwareProxyClientsResponse) {
562-
option (google.api.http) = {
563-
get: "/v1/{parent=projects/*/brands/*}/identityAwareProxyClients"
564-
};
565-
}
566-
567-
// Retrieves an Identity Aware Proxy (IAP) OAuth client.
568-
// Requires that the client is owned by IAP.
569-
rpc GetIdentityAwareProxyClient(GetIdentityAwareProxyClientRequest)
570-
returns (IdentityAwareProxyClient) {
571-
option (google.api.http) = {
572-
get: "/v1/{name=projects/*/brands/*/identityAwareProxyClients/*}"
573-
};
574-
}
575-
576-
// Resets an Identity Aware Proxy (IAP) OAuth client secret. Useful if the
577-
// secret was compromised. Requires that the client is owned by IAP.
578-
rpc ResetIdentityAwareProxyClientSecret(
579-
ResetIdentityAwareProxyClientSecretRequest)
580-
returns (IdentityAwareProxyClient) {
581-
option (google.api.http) = {
582-
post: "/v1/{name=projects/*/brands/*/identityAwareProxyClients/*}:resetSecret"
583-
body: "*"
584-
};
585-
}
586-
587-
// Deletes an Identity Aware Proxy (IAP) OAuth client. Useful for removing
588-
// obsolete clients, managing the number of clients in a given project, and
589-
// cleaning up after tests. Requires that the client is owned by IAP.
590-
rpc DeleteIdentityAwareProxyClient(DeleteIdentityAwareProxyClientRequest)
591-
returns (google.protobuf.Empty) {
592-
option (google.api.http) = {
593-
delete: "/v1/{name=projects/*/brands/*/identityAwareProxyClients/*}"
594-
};
595-
}
596-
}
597-
598604
// The request sent to ListBrands.
599605
message ListBrandsRequest {
600606
// Required. GCP Project number/id.

0 commit comments

Comments
 (0)