3838 "CorsSettings" ,
3939 "OAuthSettings" ,
4040 "ReauthSettings" ,
41+ "AllowedDomainsSettings" ,
4142 "ApplicationSettings" ,
4243 "CsmSettings" ,
4344 "AccessDeniedPageSettings" ,
45+ "AttributePropagationSettings" ,
4446 "ListBrandsRequest" ,
4547 "ListBrandsResponse" ,
4648 "CreateBrandRequest" ,
@@ -139,7 +141,7 @@ class CreateTunnelDestGroupRequest(proto.Message):
139141 becomes the final component of the resource name.
140142
141143 This value must be 4-63 characters, and valid characters are
142- ``[a-z][0-9] -``.
144+ ``[a-z]-``.
143145 """
144146
145147 parent : str = proto .Field (
@@ -222,13 +224,14 @@ class TunnelDestGroup(proto.Message):
222224 name (str):
223225 Required. Immutable. Identifier for the
224226 TunnelDestGroup. Must be unique within the
225- project.
227+ project and contain only lower case letters
228+ (a-z) and dashes (-).
226229 cidrs (MutableSequence[str]):
227- null List of CIDRs that this group applies
228- to.
230+ Unordered list. List of CIDRs that this group
231+ applies to.
229232 fqdns (MutableSequence[str]):
230- null List of FQDNs that this group applies
231- to.
233+ Unordered list. List of FQDNs that this group
234+ applies to.
232235 """
233236
234237 name : str = proto .Field (
@@ -334,6 +337,9 @@ class AccessSettings(proto.Message):
334337 reauth_settings (google.cloud.iap_v1.types.ReauthSettings):
335338 Settings to configure reauthentication
336339 policies in IAP.
340+ allowed_domains_settings (google.cloud.iap_v1.types.AllowedDomainsSettings):
341+ Settings to configure and enable allowed
342+ domains.
337343 """
338344
339345 gcip_settings : "GcipSettings" = proto .Field (
@@ -356,6 +362,11 @@ class AccessSettings(proto.Message):
356362 number = 6 ,
357363 message = "ReauthSettings" ,
358364 )
365+ allowed_domains_settings : "AllowedDomainsSettings" = proto .Field (
366+ proto .MESSAGE ,
367+ number = 7 ,
368+ message = "AllowedDomainsSettings" ,
369+ )
359370
360371
361372class GcipSettings (proto .Message ):
@@ -435,7 +446,7 @@ class ReauthSettings(proto.Message):
435446
436447 Attributes:
437448 method (google.cloud.iap_v1.types.ReauthSettings.Method):
438- Reauth method required by the policy .
449+ Reauth method requested .
439450 max_age (google.protobuf.duration_pb2.Duration):
440451 Reauth session lifetime, how long before a
441452 user has to reauthenticate again.
@@ -476,19 +487,50 @@ class PolicyType(proto.Enum):
476487 )
477488
478489
490+ class AllowedDomainsSettings (proto .Message ):
491+ r"""Configuration for IAP allowed domains. Lets you to restrict
492+ access to an app and allow access to only the domains that you
493+ list.
494+
495+
496+ .. _oneof: https://proto-plus-python.readthedocs.io/en/stable/fields.html#oneofs-mutually-exclusive-fields
497+
498+ Attributes:
499+ enable (bool):
500+ Configuration for customers to opt in for the
501+ feature.
502+
503+ This field is a member of `oneof`_ ``_enable``.
504+ domains (MutableSequence[str]):
505+ List of trusted domains.
506+ """
507+
508+ enable : bool = proto .Field (
509+ proto .BOOL ,
510+ number = 1 ,
511+ optional = True ,
512+ )
513+ domains : MutableSequence [str ] = proto .RepeatedField (
514+ proto .STRING ,
515+ number = 2 ,
516+ )
517+
518+
479519class ApplicationSettings (proto .Message ):
480520 r"""Wrapper over application specific settings for IAP.
481521
482522 Attributes:
483523 csm_settings (google.cloud.iap_v1.types.CsmSettings):
484524 Settings to configure IAP's behavior for a
485- CSM mesh.
525+ service mesh.
486526 access_denied_page_settings (google.cloud.iap_v1.types.AccessDeniedPageSettings):
487527 Customization for Access Denied page.
488528 cookie_domain (google.protobuf.wrappers_pb2.StringValue):
489529 The Domain value to set for cookies generated
490530 by IAP. This value is not validated by the API,
491531 but will be ignored at runtime if invalid.
532+ attribute_propagation_settings (google.cloud.iap_v1.types.AttributePropagationSettings):
533+ Settings to configure attribute propagation.
492534 """
493535
494536 csm_settings : "CsmSettings" = proto .Field (
@@ -506,14 +548,19 @@ class ApplicationSettings(proto.Message):
506548 number = 3 ,
507549 message = wrappers_pb2 .StringValue ,
508550 )
551+ attribute_propagation_settings : "AttributePropagationSettings" = proto .Field (
552+ proto .MESSAGE ,
553+ number = 4 ,
554+ message = "AttributePropagationSettings" ,
555+ )
509556
510557
511558class CsmSettings (proto .Message ):
512- r"""Configuration for RCTokens generated for CSM workloads
513- protected by IAP. RCTokens are IAP generated JWTs that can be
514- verified at the application. The RCToken is primarily used for
515- ISTIO deployments, and can be scoped to a single mesh by
516- configuring the audience field accordingly
559+ r"""Configuration for RCToken generated for service mesh
560+ workloads protected by IAP. RCToken are IAP generated JWTs that
561+ can be verified at the application. The RCToken is primarily
562+ used for service mesh deployments, and can be scoped to a single
563+ mesh by configuring the audience field accordingly.
517564
518565 Attributes:
519566 rctoken_aud (google.protobuf.wrappers_pb2.StringValue):
@@ -534,13 +581,21 @@ class AccessDeniedPageSettings(proto.Message):
534581 page when access is denied to users. If IAP prevents access to
535582 this page, the default IAP error page will be displayed instead.
536583
584+
585+ .. _oneof: https://proto-plus-python.readthedocs.io/en/stable/fields.html#oneofs-mutually-exclusive-fields
586+
537587 Attributes:
538588 access_denied_page_uri (google.protobuf.wrappers_pb2.StringValue):
539589 The URI to be redirected to when access is
540590 denied.
541591 generate_troubleshooting_uri (google.protobuf.wrappers_pb2.BoolValue):
542592 Whether to generate a troubleshooting URL on
543593 access denied events to this application.
594+ remediation_token_generation_enabled (google.protobuf.wrappers_pb2.BoolValue):
595+ Whether to generate remediation token on
596+ access denied events to this application.
597+
598+ This field is a member of `oneof`_ ``_remediation_token_generation_enabled``.
544599 """
545600
546601 access_denied_page_uri : wrappers_pb2 .StringValue = proto .Field (
@@ -553,6 +608,95 @@ class AccessDeniedPageSettings(proto.Message):
553608 number = 2 ,
554609 message = wrappers_pb2 .BoolValue ,
555610 )
611+ remediation_token_generation_enabled : wrappers_pb2 .BoolValue = proto .Field (
612+ proto .MESSAGE ,
613+ number = 3 ,
614+ optional = True ,
615+ message = wrappers_pb2 .BoolValue ,
616+ )
617+
618+
619+ class AttributePropagationSettings (proto .Message ):
620+ r"""Configuration for propagating attributes to applications
621+ protected by IAP.
622+
623+
624+ .. _oneof: https://proto-plus-python.readthedocs.io/en/stable/fields.html#oneofs-mutually-exclusive-fields
625+
626+ Attributes:
627+ expression (str):
628+ Raw string CEL expression. Must return a list of attributes.
629+ Maximum of 45 attributes can be selected. Expressions can
630+ select different attribute types from ``attributes``:
631+ ``attributes.saml_attributes``,
632+ ``attributes.iap_attributes``. Limited functions are
633+ supported:
634+
635+ - ``filter: <list>.filter(<iter_var>, <predicate>)`` ->
636+ returns a subset of ``<list>`` where ``<predicate>`` is
637+ true for every item.
638+ - ``in: <var> in <list>`` -> returns true if ``<list>``
639+ contains ``<var>``
640+ - ``selectByName: <list>.selectByName(<string>)`` ->
641+ returns the attribute in ``<list>`` with the given
642+ ``<string>`` name, otherwise returns empty.
643+ - ``emitAs: <attribute>.emitAs(<string>)`` -> sets the
644+ ``<attribute>`` name field to the given ``<string>`` for
645+ propagation in selected output credentials.
646+ - ``strict: <attribute>.strict()`` -> ignore the
647+ ``x-goog-iap-attr-`` prefix for the provided
648+ ``<attribute>`` when propagating via the ``HEADER``
649+ output credential, i.e. request headers.
650+ - ``append: <target_list>.append(<attribute>)`` OR
651+ ``<target_list>.append(<list>)`` -> append the provided
652+ ``<attribute>`` or ``<list>`` onto the end of
653+ ``<target_list>``.
654+
655+ Example expression:
656+ ``attributes.saml_attributes.filter(x, x.name in ['test']).append(attributes.iap_attributes.selectByName('exact').emitAs('custom').strict())``
657+
658+ This field is a member of `oneof`_ ``_expression``.
659+ output_credentials (MutableSequence[google.cloud.iap_v1.types.AttributePropagationSettings.OutputCredentials]):
660+ Which output credentials attributes selected
661+ by the CEL expression should be propagated in.
662+ All attributes will be fully duplicated in each
663+ selected output credential.
664+ enable (bool):
665+ Whether the provided attribute propagation
666+ settings should be evaluated on user requests.
667+ If set to true, attributes returned from the
668+ expression will be propagated in the set output
669+ credentials.
670+
671+ This field is a member of `oneof`_ ``_enable``.
672+ """
673+
674+ class OutputCredentials (proto .Enum ):
675+ r"""Supported output credentials for attribute propagation. Each
676+ output credential maps to a "field" in the response. For
677+ example, selecting JWT will propagate all attributes in the IAP
678+ JWT, header in the headers, etc.
679+ """
680+ OUTPUT_CREDENTIALS_UNSPECIFIED = 0
681+ HEADER = 1
682+ JWT = 2
683+ RCTOKEN = 3
684+
685+ expression : str = proto .Field (
686+ proto .STRING ,
687+ number = 1 ,
688+ optional = True ,
689+ )
690+ output_credentials : MutableSequence [OutputCredentials ] = proto .RepeatedField (
691+ proto .ENUM ,
692+ number = 2 ,
693+ enum = OutputCredentials ,
694+ )
695+ enable : bool = proto .Field (
696+ proto .BOOL ,
697+ number = 3 ,
698+ optional = True ,
699+ )
556700
557701
558702class ListBrandsRequest (proto .Message ):
0 commit comments