Skip to content

Commit 161d4ea

Browse files
crwilcoxcrwilcox
authored
Add protos as an artifact to library (#7205)
1 parent 841d526 commit 161d4ea

File tree

4 files changed

+314
-8
lines changed

4 files changed

+314
-8
lines changed

‎packages/google-cloud-iam/google/cloud/iam_credentials_v1/proto/common.proto‎

Lines changed: 224 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,224 @@
1+
// Copyright 2018 Google LLC
2+
//
3+
// Licensed under the Apache License, Version 2.0 (the "License");
4+
// you may not use this file except in compliance with the License.
5+
// You may obtain a copy of the License at
6+
//
7+
// http://www.apache.org/licenses/LICENSE-2.0
8+
//
9+
// Unless required by applicable law or agreed to in writing, software
10+
// distributed under the License is distributed on an "AS IS" BASIS,
11+
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
// See the License for the specific language governing permissions and
13+
// limitations under the License.
14+
15+
syntax = "proto3";
16+
17+
package google.iam.credentials.v1;
18+
19+
import "google/protobuf/duration.proto";
20+
import "google/protobuf/timestamp.proto";
21+
22+
option cc_enable_arenas = true;
23+
option go_package = "google.golang.org/genproto/googleapis/iam/credentials/v1;credentials";
24+
option java_multiple_files = true;
25+
option java_outer_classname = "IAMCredentialsCommonProto";
26+
option java_package = "com.google.cloud.iam.credentials.v1";
27+
28+
29+
message GenerateAccessTokenRequest {
30+
// The resource name of the service account for which the credentials
31+
// are requested, in the following format:
32+
// `projects/-/serviceAccounts/{ACCOUNT_EMAIL_OR_UNIQUEID}`.
33+
string name = 1;
34+
35+
// The sequence of service accounts in a delegation chain. Each service
36+
// account must be granted the `roles/iam.serviceAccountTokenCreator` role
37+
// on its next service account in the chain. The last service account in the
38+
// chain must be granted the `roles/iam.serviceAccountTokenCreator` role
39+
// on the service account that is specified in the `name` field of the
40+
// request.
41+
//
42+
// The delegates must have the following format:
43+
// `projects/-/serviceAccounts/{ACCOUNT_EMAIL_OR_UNIQUEID}`
44+
repeated string delegates = 2;
45+
46+
// Code to identify the scopes to be included in the OAuth 2.0 access token.
47+
// See https://developers.google.com/identity/protocols/googlescopes for more
48+
// information.
49+
// At least one value required.
50+
repeated string scope = 4;
51+
52+
// The desired lifetime duration of the access token in seconds.
53+
// Must be set to a value less than or equal to 3600 (1 hour). If a value is
54+
// not specified, the token's lifetime will be set to a default value of one
55+
// hour.
56+
google.protobuf.Duration lifetime = 7;
57+
}
58+
59+
message GenerateAccessTokenResponse {
60+
// The OAuth 2.0 access token.
61+
string access_token = 1;
62+
63+
// Token expiration time.
64+
// The expiration time is always set.
65+
google.protobuf.Timestamp expire_time = 3;
66+
}
67+
68+
message SignBlobRequest {
69+
// The resource name of the service account for which the credentials
70+
// are requested, in the following format:
71+
// `projects/-/serviceAccounts/{ACCOUNT_EMAIL_OR_UNIQUEID}`.
72+
string name = 1;
73+
74+
// The sequence of service accounts in a delegation chain. Each service
75+
// account must be granted the `roles/iam.serviceAccountTokenCreator` role
76+
// on its next service account in the chain. The last service account in the
77+
// chain must be granted the `roles/iam.serviceAccountTokenCreator` role
78+
// on the service account that is specified in the `name` field of the
79+
// request.
80+
//
81+
// The delegates must have the following format:
82+
// `projects/-/serviceAccounts/{ACCOUNT_EMAIL_OR_UNIQUEID}`
83+
repeated string delegates = 3;
84+
85+
// The bytes to sign.
86+
bytes payload = 5;
87+
}
88+
89+
message SignBlobResponse {
90+
// The ID of the key used to sign the blob.
91+
string key_id = 1;
92+
93+
// The signed blob.
94+
bytes signed_blob = 4;
95+
}
96+
97+
message SignJwtRequest {
98+
// The resource name of the service account for which the credentials
99+
// are requested, in the following format:
100+
// `projects/-/serviceAccounts/{ACCOUNT_EMAIL_OR_UNIQUEID}`.
101+
string name = 1;
102+
103+
// The sequence of service accounts in a delegation chain. Each service
104+
// account must be granted the `roles/iam.serviceAccountTokenCreator` role
105+
// on its next service account in the chain. The last service account in the
106+
// chain must be granted the `roles/iam.serviceAccountTokenCreator` role
107+
// on the service account that is specified in the `name` field of the
108+
// request.
109+
//
110+
// The delegates must have the following format:
111+
// `projects/-/serviceAccounts/{ACCOUNT_EMAIL_OR_UNIQUEID}`
112+
repeated string delegates = 3;
113+
114+
// The JWT payload to sign: a JSON object that contains a JWT Claims Set.
115+
string payload = 5;
116+
}
117+
118+
message SignJwtResponse {
119+
// The ID of the key used to sign the JWT.
120+
string key_id = 1;
121+
122+
// The signed JWT.
123+
string signed_jwt = 2;
124+
}
125+
126+
message GenerateIdTokenRequest {
127+
// The resource name of the service account for which the credentials
128+
// are requested, in the following format:
129+
// `projects/-/serviceAccounts/{ACCOUNT_EMAIL_OR_UNIQUEID}`.
130+
string name = 1;
131+
132+
// The sequence of service accounts in a delegation chain. Each service
133+
// account must be granted the `roles/iam.serviceAccountTokenCreator` role
134+
// on its next service account in the chain. The last service account in the
135+
// chain must be granted the `roles/iam.serviceAccountTokenCreator` role
136+
// on the service account that is specified in the `name` field of the
137+
// request.
138+
//
139+
// The delegates must have the following format:
140+
// `projects/-/serviceAccounts/{ACCOUNT_EMAIL_OR_UNIQUEID}`
141+
repeated string delegates = 2;
142+
143+
// The audience for the token, such as the API or account that this token
144+
// grants access to.
145+
string audience = 3;
146+
147+
// Include the service account email in the token. If set to `true`, the
148+
// token will contain `email` and `email_verified` claims.
149+
bool include_email = 4;
150+
}
151+
152+
message GenerateIdTokenResponse {
153+
// The OpenId Connect ID token.
154+
string token = 1;
155+
}
156+
157+
message GenerateIdentityBindingAccessTokenRequest {
158+
// The resource name of the service account for which the credentials
159+
// are requested, in the following format:
160+
// `projects/-/serviceAccounts/{ACCOUNT_EMAIL_OR_UNIQUEID}`.
161+
string name = 1;
162+
163+
// Code to identify the scopes to be included in the OAuth 2.0 access token.
164+
// See https://developers.google.com/identity/protocols/googlescopes for more
165+
// information.
166+
// At least one value required.
167+
repeated string scope = 2;
168+
169+
// Required. Input token.
170+
// Must be in JWT format according to
171+
// RFC7523 (https://tools.ietf.org/html/rfc7523)
172+
// and must have 'kid' field in the header.
173+
// Supported signing algorithms: RS256 (RS512, ES256, ES512 coming soon).
174+
// Mandatory payload fields (along the lines of RFC 7523, section 3):
175+
// - iss: issuer of the token. Must provide a discovery document at
176+
// $iss/.well-known/openid-configuration . The document needs to be
177+
// formatted according to section 4.2 of the OpenID Connect Discovery
178+
// 1.0 specification.
179+
// - iat: Issue time in seconds since epoch. Must be in the past.
180+
// - exp: Expiration time in seconds since epoch. Must be less than 48 hours
181+
// after iat. We recommend to create tokens that last shorter than 6
182+
// hours to improve security unless business reasons mandate longer
183+
// expiration times. Shorter token lifetimes are generally more secure
184+
// since tokens that have been exfiltrated by attackers can be used for
185+
// a shorter time. you can configure the maximum lifetime of the
186+
// incoming token in the configuration of the mapper.
187+
// The resulting Google token will expire within an hour or at "exp",
188+
// whichever is earlier.
189+
// - sub: JWT subject, identity asserted in the JWT.
190+
// - aud: Configured in the mapper policy. By default the service account
191+
// email.
192+
//
193+
// Claims from the incoming token can be transferred into the output token
194+
// accoding to the mapper configuration. The outgoing claim size is limited.
195+
// Outgoing claims size must be less than 4kB serialized as JSON without
196+
// whitespace.
197+
//
198+
// Example header:
199+
// {
200+
// "alg": "RS256",
201+
// "kid": "92a4265e14ab04d4d228a48d10d4ca31610936f8"
202+
// }
203+
// Example payload:
204+
// {
205+
// "iss": "https://accounts.google.com",
206+
// "iat": 1517963104,
207+
// "exp": 1517966704,
208+
// "aud": "https://iamcredentials.googleapis.com/",
209+
// "sub": "113475438248934895348",
210+
// "my_claims": {
211+
// "additional_claim": "value"
212+
// }
213+
// }
214+
string jwt = 3;
215+
}
216+
217+
message GenerateIdentityBindingAccessTokenResponse {
218+
// The OAuth 2.0 access token.
219+
string access_token = 1;
220+
221+
// Token expiration time.
222+
// The expiration time is always set.
223+
google.protobuf.Timestamp expire_time = 2;
224+
}

‎packages/google-cloud-iam/google/cloud/iam_credentials_v1/proto/iamcredentials.proto‎

Lines changed: 81 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,81 @@
1+
// Copyright 2018 Google LLC
2+
//
3+
// Licensed under the Apache License, Version 2.0 (the "License");
4+
// you may not use this file except in compliance with the License.
5+
// You may obtain a copy of the License at
6+
//
7+
// http://www.apache.org/licenses/LICENSE-2.0
8+
//
9+
// Unless required by applicable law or agreed to in writing, software
10+
// distributed under the License is distributed on an "AS IS" BASIS,
11+
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
// See the License for the specific language governing permissions and
13+
// limitations under the License.
14+
15+
syntax = "proto3";
16+
17+
package google.iam.credentials.v1;
18+
19+
import "google/api/annotations.proto";
20+
import "google/iam/credentials/v1/common.proto";
21+
22+
option cc_enable_arenas = true;
23+
option go_package = "google.golang.org/genproto/googleapis/iam/credentials/v1;credentials";
24+
option java_multiple_files = true;
25+
option java_outer_classname = "IAMCredentialsProto";
26+
option java_package = "com.google.cloud.iam.credentials.v1";
27+
28+
29+
// A service account is a special type of Google account that belongs to your
30+
// application or a virtual machine (VM), instead of to an individual end user.
31+
// Your application assumes the identity of the service account to call Google
32+
// APIs, so that the users aren't directly involved.
33+
//
34+
// Service account credentials are used to temporarily assume the identity
35+
// of the service account. Supported credential types include OAuth 2.0 access
36+
// tokens, OpenID Connect ID tokens, self-signed JSON Web Tokens (JWTs), and
37+
// more.
38+
service IAMCredentials {
39+
// Generates an OAuth 2.0 access token for a service account.
40+
rpc GenerateAccessToken(GenerateAccessTokenRequest) returns (GenerateAccessTokenResponse) {
41+
option (google.api.http) = {
42+
post: "/v1/{name=projects/*/serviceAccounts/*}:generateAccessToken"
43+
body: "*"
44+
};
45+
}
46+
47+
// Generates an OpenID Connect ID token for a service account.
48+
rpc GenerateIdToken(GenerateIdTokenRequest) returns (GenerateIdTokenResponse) {
49+
option (google.api.http) = {
50+
post: "/v1/{name=projects/*/serviceAccounts/*}:generateIdToken"
51+
body: "*"
52+
};
53+
}
54+
55+
// Signs a blob using a service account's system-managed private key.
56+
rpc SignBlob(SignBlobRequest) returns (SignBlobResponse) {
57+
option (google.api.http) = {
58+
post: "/v1/{name=projects/*/serviceAccounts/*}:signBlob"
59+
body: "*"
60+
};
61+
}
62+
63+
// Signs a JWT using a service account's system-managed private key.
64+
rpc SignJwt(SignJwtRequest) returns (SignJwtResponse) {
65+
option (google.api.http) = {
66+
post: "/v1/{name=projects/*/serviceAccounts/*}:signJwt"
67+
body: "*"
68+
};
69+
}
70+
71+
// Exchange a JWT signed by third party identity provider to an OAuth 2.0
72+
// access token
73+
rpc GenerateIdentityBindingAccessToken(
74+
GenerateIdentityBindingAccessTokenRequest)
75+
returns (GenerateIdentityBindingAccessTokenResponse) {
76+
option (google.api.http) = {
77+
post: "/v1/{name=projects/*/serviceAccounts/*}:generateIdentityBindingAccessToken"
78+
body: "*"
79+
};
80+
}
81+
}

‎packages/google-cloud-iam/synth.metadata‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,19 +1,19 @@
11
{
2-
"updateTime": "2019-01-17T13:19:36.096921Z",
2+
"updateTime": "2019-01-24T05:39:59.371229Z",
33
"sources": [
44
{
55
"generator": {
66
"name": "artman",
7-
"version": "0.16.6",
8-
"dockerImage": "googleapis/artman@sha256:12722f2ca3fbc3b53cc6aa5f0e569d7d221b46bd876a2136497089dec5e3634e"
7+
"version": "0.16.7",
8+
"dockerImage": "googleapis/artman@sha256:d6c8ced606eb49973ca95d2af7c55a681acc042db0f87d135968349e7bf6dd80"
99
}
1010
},
1111
{
1212
"git": {
1313
"name": "googleapis",
1414
"remote": "https://github.com/googleapis/googleapis.git",
15-
"sha": "0ac60e21a1aa86c07c1836865b35308ba8178b05",
16-
"internalRef": "229626798"
15+
"sha": "9aac88a22468b1e291937f55fa1ef237adfdc63e",
16+
"internalRef": "230568136"
1717
}
1818
},
1919
{
@@ -28,7 +28,7 @@
2828
{
2929
"client": {
3030
"source": "googleapis",
31-
"apiName": "iam",
31+
"apiName": "iam_credentials",
3232
"apiVersion": "v1",
3333
"language": "python",
3434
"generator": "gapic",

‎packages/google-cloud-iam/synth.py‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -24,10 +24,11 @@
2424
# Generate automl GAPIC layer
2525
# ----------------------------------------------------------------------------
2626
library = gapic.py_library(
27-
"iam",
27+
"iam_credentials",
2828
"v1",
2929
config_path="/google/iam/credentials/artman_iamcredentials_v1.yaml",
30-
artman_output_name="iamcredentials-v1"
30+
artman_output_name="iamcredentials-v1",
31+
include_protos=True,
3132
)
3233

3334
excludes = [

0 commit comments

Comments
 (0)