Updates the IAP settings on a particular IAP protected resource. It replaces all fields unless the update_mask is set.

Scopes

You will need authorization for the https://www.googleapis.com/auth/cloud-platform scope to make a valid call.

If unset, the scope for this method defaults to https://www.googleapis.com/auth/cloud-platform. You can set the scope for this method like this: iap1 --scope <scope> methods update-iap-settings ...

Required Scalar Argument

• <name> (string)
  • Required. The resource name of the IAP protected resource.

Required Request Value

The request value is a data-structure with various fields. Each field may be a simple scalar or another data-structure. In the latter case it is advised to set the field-cursor to the data-structure's field to specify values more concisely.

For example, a structure like this:

IapSettings:
  access-settings:
    allowed-domains-settings:
      domains: [string]
      enable: boolean
    cors-settings:
      allow-http-options: boolean
    gcip-settings:
      login-page-uri: string
      tenant-ids: [string]
    oauth-settings:
      login-hint: string
      programmatic-clients: [string]
    policy-delegation-settings:
      iam-permission: string
      iam-service-name: string
      policy-name:
        id: string
        region: string
        type: string
      resource:
        labels: { string: string }
        name: string
        service: string
        type: string
    reauth-settings:
      max-age: string
      method: string
      policy-type: string
  application-settings:
    access-denied-page-settings:
      access-denied-page-uri: string
      generate-troubleshooting-uri: boolean
      remediation-token-generation-enabled: boolean
    attribute-propagation-settings:
      enable: boolean
      expression: string
      output-credentials: [string]
    cookie-domain: string
    csm-settings:
      rctoken-aud: string
  name: string

can be set completely with the following arguments which are assumed to be executed in the given order. Note how the cursor position is adjusted to the respective structures, allowing simple field names to be used most of the time.

• -r .access-settings.allowed-domains-settings domains=voluptua.
  • List of trusted domains.
  • Each invocation of this argument appends the given value to the array.

• enable=false

  • Configuration for customers to opt in for the feature.

• ..cors-settings allow-http-options=true

  • Configuration to allow HTTP OPTIONS calls to skip authorization. If undefined, IAP will not apply any special logic to OPTIONS requests.

• ..gcip-settings login-page-uri=amet.

  • Login page URI associated with the GCIP tenants. Typically, all resources within the same project share the same login page, though it could be overridden at the sub resource level.

• tenant-ids=duo

  • GCIP tenant ids that are linked to the IAP resource. tenant_ids could be a string beginning with a number character to indicate authenticating with GCIP tenant flow, or in the format of _ to indicate authenticating with GCIP agent flow. If agent flow is used, tenant_ids should only contain one single element, while for tenant flow, tenant_ids can contain multiple elements.
  • Each invocation of this argument appends the given value to the array.

• ..oauth-settings login-hint=ipsum

  • Domain hint to send as hd=? parameter in OAuth request flow. Enables redirect to primary IDP by skipping Google's login screen. https://developers.google.com/identity/protocols/OpenIDConnect#hd-param Note: IAP does not verify that the id token's hd claim matches this value since access behavior is managed by IAM policies.

• programmatic-clients=gubergren

  • List of client ids allowed to use IAP programmatically.
  • Each invocation of this argument appends the given value to the array.

• ..policy-delegation-settings iam-permission=lorem

  • Permission to check in IAM.
• iam-service-name=gubergren
  • The DNS name of the service (e.g. "resourcemanager.googleapis.com"). This should be the domain name part of the full resource names (see https://aip.dev/122#full-resource-names), which is usually the same as IamServiceSpec.service of the service where the resource type is defined.
• policy-name id=eos
  • Identifies an instance of the type. ID format varies by type. The ID format is defined in the IAM .service file that defines the type, either in path_mapping or in a comment.
• region=dolor
  • For Cloud IAM: The location of the Policy. Must be empty or "global" for Policies owned by global IAM. Must name a region from prodspec/cloud-iam-cloudspec for Regional IAM Policies, see go/iam-faq#where-is-iam-currently-deployed. For Local IAM: This field should be set to "local".

• type=ea

  • Resource type. Types are defined in IAM's .service files. Valid values for type might be 'gce', 'gcs', 'project', 'account' etc.

• ..resource labels=key=ipsum

  • The service defined labels of the resource on which the conditions will be evaluated. The semantics - including the key names - are vague to IAM. If the effective condition has a reference to a resource.labels[foo] construct, IAM consults with this map to retrieve the values associated with foo key for Conditions evaluation. If the provided key is not found in the labels map, the condition would evaluate to false. This field is in limited use. If your intended use case is not expected to express resource.labels attribute in IAM Conditions, leave this field empty. Before planning on using this attribute please: * Read go/iam-conditions-labels-comm and ensure your service can meet the data availability and management requirements. * Talk to iam-conditions-eng@ about your use case.
  • the value will be associated with the given key
• name=invidunt
  • Name of the resource on which conditions will be evaluated. Must use the Relative Resource Name of the resource, which is the URI path of the resource without the leading "/". Examples are "projects/_/buckets/[BUCKET-ID]" for storage buckets or "projects/[PROJECT-ID]/global/firewalls/[FIREWALL-ID]" for a firewall. This field is required for evaluating conditions with rules on resource names. For a list permission check, the resource.name value must be set to the parent resource. If the parent resource is a project, this field should be left unset.
• service=amet
  • The name of the service this resource belongs to. It is configured using the official_service_name of the Service as defined in service configurations under //configs/cloud/resourcetypes. For example, the official_service_name of cloud resource manager service is set as 'cloudresourcemanager.googleapis.com' according to //configs/cloud/resourcetypes/google/cloud/resourcemanager/prod.yaml

• type=duo

  • The public resource type name of the resource on which conditions will be evaluated. It is configured using the official_name of the ResourceType as defined in service configurations under //configs/cloud/resourcetypes. For example, the official_name for GCP projects is set as 'cloudresourcemanager.googleapis.com/Project' according to //configs/cloud/resourcetypes/google/cloud/resourcemanager/prod.yaml For details see go/iam-conditions-integration-guide.

• ...reauth-settings max-age=ipsum

  • Reauth session lifetime, how long before a user has to reauthenticate again.
• method=sed
  • Reauth method requested.

• policy-type=ut

  • How IAP determines the effective policy in cases of hierarchical policies. Policies are merged from higher in the hierarchy to lower in the hierarchy.

• ...application-settings.access-denied-page-settings access-denied-page-uri=gubergren

  • The URI to be redirected to when access is denied.
• generate-troubleshooting-uri=true
  • Whether to generate a troubleshooting URL on access denied events to this application.

• remediation-token-generation-enabled=true

  • Whether to generate remediation token on access denied events to this application.

• ..attribute-propagation-settings enable=true

  • Whether the provided attribute propagation settings should be evaluated on user requests. If set to true, attributes returned from the expression will be propagated in the set output credentials.
• expression=est
  • Raw string CEL expression. Must return a list of attributes. A maximum of 45 attributes can be selected. Expressions can select different attribute types from attributes: attributes.saml_attributes, attributes.iap_attributes. The following functions are supported: - filter .filter(, ): Returns a subset of where is true for every item. - in in: Returns true if contains. - selectByName .selectByName(): Returns the attribute in with the given name, otherwise returns empty. - emitAs .emitAs(): Sets the name field to the given for propagation in selected output credentials. - strict .strict(): Ignores the x-goog-iap-attr- prefix for the provided when propagating with the `HEADER` output credential, such as request headers. - append `.append()` OR `.append()`: Appends the provided or to the end of. Example expression: attributes.saml_attributes.filter(x, x.name in ['test']).append(attributes.iap_attributes.selectByName('exact').emitAs('custom').strict())

• output-credentials=gubergren

  • Which output credentials attributes selected by the CEL expression should be propagated in. All attributes will be fully duplicated in each selected output credential.
  • Each invocation of this argument appends the given value to the array.

• .. cookie-domain=ea

  • The Domain value to set for cookies generated by IAP. This value is not validated by the API, but will be ignored at runtime if invalid.

• csm-settings rctoken-aud=dolor

  • Audience claim set in the generated RCToken. This value is not validated by IAP.

• ... name=lorem

  • Required. The resource name of the IAP protected resource.

About Cursors

The cursor position is key to comfortably set complex nested structures. The following rules apply:

• The cursor position is always set relative to the current one, unless the field name starts with the . character. Fields can be nested such as in -r f.s.o .
• The cursor position is set relative to the top-level structure if it starts with ., e.g. -r .s.s
• You can also set nested fields without setting the cursor explicitly. For example, to set a value relative to the current cursor position, you would specify -r struct.sub_struct=bar.
• You can move the cursor one level up by using ... Each additional . moves it up one additional level. E.g. ... would go three levels up.

Optional Output Flags

The method's return value a JSON encoded structure, which will be written to standard output by default.

• -o out
  • out specifies the destination to which to write the server's result to. It will be a JSON-encoded structure. The destination may be - to indicate standard output, or a filepath that is to contain the received bytes. If unset, it defaults to standard output.

Optional Method Properties

You may set the following properties to further configure the call. Please note that -p is followed by one or more key-value-pairs, and is called like this -p k1=v1 k2=v2 even though the listing below repeats the -p for completeness.

• -p update-mask=string
  • The field mask specifying which IAP settings should be updated. If omitted, then all of the settings are updated. See https://developers.google.com/protocol-buffers/docs/reference/google.protobuf#fieldmask. Note: All IAP reauth settings must always be set together, using the field mask: iapSettings.accessSettings.reauthSettings.

Optional General Properties

The following properties can configure any call, and are not specific to this method.

• -p $-xgafv=string

  • V1 error format.

• -p access-token=string

  • OAuth access token.

• -p alt=string

  • Data format for response.

• -p callback=string

  • JSONP

• -p fields=string

  • Selector specifying which fields to include in a partial response.

• -p key=string

  • API key. Your API key identifies your project and provides you with API access, quota, and reports. Required unless you provide an OAuth 2.0 token.

• -p oauth-token=string

  • OAuth 2.0 token for the current user.

• -p pretty-print=boolean

  • Returns response with indentations and line breaks.

• -p quota-user=string

  • Available to use for quota purposes for server-side applications. Can be any arbitrary string assigned to a user, but should not exceed 40 characters.

• -p upload-type=string

  • Legacy upload protocol for media (e.g. "media", "multipart").

• -p upload-protocol=string

  • Upload protocol for media (e.g. "raw", "multipart").