Skip to content

Commit 2d1a732

Browse files
bryan0515zli82016
authored and
BBBmau
committed
Implement IapSettings resource. (GoogleCloudPlatform#12183)
Co-authored-by: Zhenhua Li <[email protected]>
1 parent cb1e8f8 commit 2d1a732

File tree

5 files changed

+603
-0
lines changed

5 files changed

+603
-0
lines changed

‎mmv1/products/iap/Settings.yaml

+301
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,301 @@
1+
# Copyright 2024 Google Inc.
2+
# Licensed under the Apache License, Version 2.0 (the "License");
3+
# you may not use this file except in compliance with the License.
4+
# You may obtain a copy of the License at
5+
#
6+
# http://www.apache.org/licenses/LICENSE-2.0
7+
#
8+
# Unless required by applicable law or agreed to in writing, software
9+
# distributed under the License is distributed on an "AS IS" BASIS,
10+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
11+
# See the License for the specific language governing permissions and
12+
# limitations under the License.
13+
14+
---
15+
name: 'Settings'
16+
description: |
17+
IAP settings - manage IAP settings
18+
references:
19+
guides:
20+
'Customizing IAP': 'https://cloud.google.com/iap/docs/customizing'
21+
api: 'https://cloud.google.com/iap/docs/reference/rest/v1/IapSettings'
22+
docs:
23+
id_format: '{{name}}/iapSettings'
24+
base_url: '{{name}}:iapSettings'
25+
self_link: '{{name}}:iapSettings'
26+
create_verb: 'PATCH'
27+
update_url: '{{name}}:iapSettings'
28+
update_verb: 'PATCH'
29+
import_format:
30+
- '{{name}}/iapSettings'
31+
timeouts:
32+
insert_minutes: 20
33+
update_minutes: 20
34+
delete_minutes: 20
35+
custom_code:
36+
custom_delete: 'templates/terraform/custom_delete/clear_iap_settings.go.tmpl'
37+
custom_import: 'templates/terraform/custom_import/iap_settings.go.tmpl'
38+
test_check_destroy: 'templates/terraform/custom_check_destroy/skip_delete_during_test.go.tmpl'
39+
# Skipping the sweeper because instances will be deleted during cluster sweeps
40+
exclude_sweeper: true
41+
examples:
42+
- name: 'iap_settings_basic'
43+
primary_resource_id: 'iap_settings'
44+
vars:
45+
backend_service_name: 'iap-settings-tf'
46+
health_check_name: 'iap-bs-health-check'
47+
parameters:
48+
properties:
49+
- name: 'name'
50+
type: String
51+
description: |
52+
The resource name of the IAP protected resource. Name can have below resources:
53+
* organizations/{organization_id}
54+
* folders/{folder_id}
55+
* projects/{projects_id}
56+
* projects/{projects_id}/iap_web
57+
* projects/{projects_id}/iap_web/compute
58+
* projects/{projects_id}/iap_web/compute-{region}
59+
* projects/{projects_id}/iap_web/compute/service/{service_id}
60+
* projects/{projects_id}/iap_web/compute-{region}/service/{service_id}
61+
* projects/{projects_id}/iap_web/appengine-{app_id}
62+
* projects/{projects_id}/iap_web/appengine-{app_id}/service/{service_id}
63+
* projects/{projects_id}/iap_web/appengine-{app_id}/service/{service_id}/version/{version_id}
64+
65+
required: true
66+
immutable: true
67+
ignore_read: true
68+
- name: 'accessSettings'
69+
type: NestedObject
70+
description: |
71+
Top level wrapper for all access related setting in IAP.
72+
properties:
73+
- name: 'gcipSettings'
74+
type: NestedObject
75+
description: |
76+
GCIP claims and endpoint configurations for 3p identity providers.
77+
properties:
78+
- name: 'tenantIds'
79+
type: Array
80+
description: |
81+
GCIP tenant ids that are linked to the IAP resource. tenantIds could be a string
82+
beginning with a number character to indicate authenticating with GCIP tenant flow,
83+
or in the format of _ to indicate authenticating with GCIP agent flow. If agent flow
84+
is used, tenantIds should only contain one single element, while for tenant flow,
85+
tenantIds can contain multiple elements.
86+
item_type:
87+
type: String
88+
- name: 'loginPageUri'
89+
type: String
90+
description: |
91+
Login page URI associated with the GCIP tenants. Typically, all resources within
92+
the same project share the same login page, though it could be overridden at the
93+
sub resource level.
94+
- name: 'corsSettings'
95+
type: NestedObject
96+
description: |
97+
Configuration to allow cross-origin requests via IAP.
98+
properties:
99+
- name: 'allowHttpOptions'
100+
type: Boolean
101+
description: |
102+
Configuration to allow HTTP OPTIONS calls to skip authorization.
103+
If undefined, IAP will not apply any special logic to OPTIONS requests.
104+
- name: 'oauthSettings'
105+
type: NestedObject
106+
description: |
107+
Settings to configure IAP's OAuth behavior.
108+
properties:
109+
- name: 'loginHint'
110+
type: String
111+
description: |
112+
Domain hint to send as hd=? parameter in OAuth request flow.
113+
Enables redirect to primary IDP by skipping Google's login screen.
114+
(https://developers.google.com/identity/protocols/OpenIDConnect#hd-param)
115+
Note: IAP does not verify that the id token's hd claim matches this value
116+
since access behavior is managed by IAM policies.
117+
- name: 'programmaticClients'
118+
type: Array
119+
description: |
120+
List of client ids allowed to use IAP programmatically.
121+
item_type:
122+
type: String
123+
- name: 'reauthSettings'
124+
type: NestedObject
125+
description: |
126+
Settings to configure reauthentication policies in IAP.
127+
properties:
128+
- name: 'method'
129+
type: Enum
130+
description: |
131+
Reauth method requested. The possible values are:
132+
133+
* `LOGIN`: Prompts the user to log in again.
134+
* `SECURE_KEY`: User must use their secure key 2nd factor device.
135+
* `ENROLLED_SECOND_FACTORS`: User can use any enabled 2nd factor.
136+
required: true
137+
enum_values:
138+
- 'LOGIN'
139+
- 'SECURE_KEY'
140+
- 'ENROLLED_SECOND_FACTORS'
141+
- name: 'maxAge'
142+
type: String
143+
description: |
144+
Reauth session lifetime, how long before a user has to reauthenticate again.
145+
A duration in seconds with up to nine fractional digits, ending with 's'.
146+
Example: "3.5s".
147+
required: true
148+
- name: 'policyType'
149+
type: Enum
150+
description: |
151+
How IAP determines the effective policy in cases of hierarchical policies.
152+
Policies are merged from higher in the hierarchy to lower in the hierarchy.
153+
The possible values are:
154+
155+
* `MINIMUM`: This policy acts as a minimum to other policies, lower in the hierarchy.
156+
Effective policy may only be the same or stricter.
157+
* `DEFAULT`: This policy acts as a default if no other reauth policy is set.
158+
required: true
159+
enum_values:
160+
- 'MINIMUM'
161+
- 'DEFAULT'
162+
- name: 'allowedDomainsSettings'
163+
type: NestedObject
164+
description: |
165+
Settings to configure and enable allowed domains.
166+
properties:
167+
- name: 'domains'
168+
type: Array
169+
description: |
170+
List of trusted domains.
171+
item_type:
172+
type: String
173+
- name: 'enable'
174+
type: Boolean
175+
description: |
176+
Configuration for customers to opt in for the feature.
177+
- name: 'workforceIdentitySettings'
178+
type: NestedObject
179+
description: |
180+
Settings to configure the workforce identity federation, including workforce pools
181+
and OAuth 2.0 settings.
182+
properties:
183+
- name: 'workforcePools'
184+
type: Array
185+
description: |
186+
The workforce pool resources. Only one workforce pool is accepted.
187+
item_type:
188+
type: String
189+
max_size: 1
190+
- name: 'oauth2'
191+
type: NestedObject
192+
description: |
193+
OAuth 2.0 settings for IAP to perform OIDC flow with workforce identity
194+
federation services.
195+
properties:
196+
- name: 'clientId'
197+
type: String
198+
description: |
199+
The OAuth 2.0 client ID registered in the workforce identity
200+
federation OAuth 2.0 Server.
201+
- name: 'clientSecret'
202+
type: String
203+
description: |
204+
Input only. The OAuth 2.0 client secret created while registering
205+
the client ID.
206+
ignore_read: true
207+
sensitive: true
208+
- name: 'clientSecretSha256'
209+
type: String
210+
description: |
211+
Output only. SHA256 hash value for the client secret. This field
212+
is returned by IAP when the settings are retrieved.
213+
output: true
214+
- name: 'identitySources'
215+
type: Array
216+
description: |
217+
Identity sources that IAP can use to authenticate the end user. Only one identity source
218+
can be configured. The possible values are:
219+
220+
* `WORKFORCE_IDENTITY_FEDERATION`: Use external identities set up on Google Cloud Workforce
221+
Identity Federation.
222+
item_type:
223+
type: Enum
224+
description: |
225+
Identity sources Enum
226+
enum_values:
227+
- 'WORKFORCE_IDENTITY_FEDERATION'
228+
- name: 'applicationSettings'
229+
type: NestedObject
230+
description: |
231+
Top level wrapper for all application related settings in IAP.
232+
properties:
233+
- name: 'csmSettings'
234+
type: NestedObject
235+
description: |
236+
Settings to configure IAP's behavior for a service mesh.
237+
properties:
238+
- name: 'rctokenAud'
239+
type: String
240+
description: |
241+
Audience claim set in the generated RCToken. This value is not validated by IAP.
242+
- name: 'accessDeniedPageSettings'
243+
type: NestedObject
244+
description: |
245+
Customization for Access Denied page. IAP allows customers to define a custom URI
246+
to use as the error page when access is denied to users. If IAP prevents access
247+
to this page, the default IAP error page will be displayed instead.
248+
properties:
249+
- name: 'accessDeniedPageUri'
250+
type: String
251+
description: |
252+
The URI to be redirected to when access is denied.
253+
- name: 'generateTroubleshootingUri'
254+
type: Boolean
255+
description: |
256+
Whether to generate a troubleshooting URL on access denied events to this application.
257+
- name: 'remediationTokenGenerationEnabled'
258+
type: Boolean
259+
description: |
260+
Whether to generate remediation token on access denied events to this application.
261+
- name: 'cookieDomain'
262+
type: String
263+
description: |
264+
The Domain value to set for cookies generated by IAP. This value is not validated by the API,
265+
but will be ignored at runtime if invalid.
266+
- name: 'attributePropagationSettings'
267+
type: NestedObject
268+
description: |
269+
Settings to configure attribute propagation.
270+
properties:
271+
- name: 'outputCredentials'
272+
type: Array
273+
description: |
274+
Which output credentials attributes selected by the CEL expression should be propagated in.
275+
All attributes will be fully duplicated in each selected output credential.
276+
Possible values are:
277+
278+
* `HEADER`: Propagate attributes in the headers with "x-goog-iap-attr-" prefix.
279+
* `JWT`: Propagate attributes in the JWT of the form:
280+
"additional_claims": { "my_attribute": ["value1", "value2"] }
281+
* `RCTOKEN`: Propagate attributes in the RCToken of the form: "
282+
additional_claims": { "my_attribute": ["value1", "value2"] }
283+
item_type:
284+
type: Enum
285+
description: |
286+
Output credentials attributes selected by the CEL expression
287+
enum_values:
288+
- 'HEADER'
289+
- 'JWT'
290+
- 'RCTOKEN'
291+
- name: 'expression'
292+
type: String
293+
description: |
294+
Raw string CEL expression. Must return a list of attributes. A maximum of 45 attributes can
295+
be selected. Expressions can select different attribute types from attributes:
296+
attributes.saml_attributes, attributes.iap_attributes.
297+
- name: 'enable'
298+
type: Boolean
299+
description: |
300+
Whether the provided attribute propagation settings should be evaluated on user requests.
301+
If set to true, attributes returned from the expression will be propagated in the set output credentials.

‎mmv1/templates/terraform/custom_delete/clear_iap_settings.go.tmpl

+35
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
url, err := tpgresource.ReplaceVars(d, config, "{{"{{"}}IapBasePath{{"}}"}}{{"{{"}}name{{"}}"}}:iapSettings")
2+
if err != nil {
3+
return err
4+
}
5+
6+
project, err := tpgresource.GetProject(d, config)
7+
if err != nil {
8+
return fmt.Errorf("Error fetching project for Settings: %s", err)
9+
}
10+
11+
headers := make(http.Header)
12+
13+
obj := make(map[string]interface{})
14+
15+
log.Printf("[DEBUG] Updating Settings %q: %#v", d.Id(), obj)
16+
17+
res, err := transport_tpg.SendRequest(transport_tpg.SendRequestOptions{
18+
Config: config,
19+
Method: "PATCH",
20+
Project: project,
21+
RawURL: url,
22+
UserAgent: userAgent,
23+
Body: obj,
24+
Timeout: d.Timeout(schema.TimeoutUpdate),
25+
Headers: headers,
26+
})
27+
28+
if err != nil {
29+
return fmt.Errorf("Error updating Settings %q: %s", d.Id(), err)
30+
} else {
31+
log.Printf("[DEBUG] Finished updating Settings %q: %#v", d.Id(), res)
32+
}
33+
34+
return nil
35+

‎mmv1/templates/terraform/custom_import/iap_settings.go.tmpl

+17
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
config := meta.(*transport_tpg.Config)
2+
if err := tpgresource.ParseImportId([]string{
3+
"^(?P<name>.+)/iapSettings$",
4+
"^(?P<name>.+)$",
5+
}, d, config); err != nil {
6+
return nil, err
7+
}
8+
9+
// Replace import id for the resource id
10+
id, err := tpgresource.ReplaceVars(d, config, "{{"{{"}}name{{"}}"}}/iapSettings")
11+
if err != nil {
12+
return nil, fmt.Errorf("Error constructing id: %s", err)
13+
}
14+
d.SetId(id)
15+
16+
return []*schema.ResourceData{d}, nil
17+

0 commit comments

Comments
 (0)