@alicloud/eiam20211201 2.19.0 → 2.19.2

package/src/models/SetApplicationSsoConfigRequest.ts

@@ -53,7 +53,7 @@ export class SetApplicationSsoConfigRequestOidcSsoConfig extends $dara.Model {
   accessTokenEffectiveTime?: number;
   /**
    * @remarks
-   * Specifies whether the application is allowed to act as a public client to request the IDaaS EIAM authorization server. Only the authorization code mode and device mode support this feature. Default value: false.
+   * Specifies whether the application is allowed to act as a public client to request the IDaaS EIAM authorization server. This parameter can be enabled only in authorization code mode and device mode. Default value: false.
    * 
    * @example
    * true
@@ -69,12 +69,12 @@ export class SetApplicationSsoConfigRequestOidcSsoConfig extends $dara.Model {
   codeEffectiveTime?: number;
   /**
    * @remarks
-   * The custom user information included in the ID token response.
+   * The custom user information included in the returned ID token.
    */
   customClaims?: SetApplicationSsoConfigRequestOidcSsoConfigCustomClaims[];
   /**
    * @remarks
-   * The OIDC standard parameter scope, which specifies the scope of user attributes that can be returned by the userinfo endpoint or the ID token.
+   * The OIDC standard parameter scope, which specifies the range of user attributes that can be returned by the userinfo endpoint or the id_token.
    * 
    * @example
    * profile，email
@@ -82,7 +82,7 @@ export class SetApplicationSsoConfigRequestOidcSsoConfig extends $dara.Model {
   grantScopes?: string[];
   /**
    * @remarks
-   * The list of supported OIDC protocol grant types.
+   * The list of supported OIDC grant types.
    * 
    * @example
    * authorization_code
@@ -98,7 +98,7 @@ export class SetApplicationSsoConfigRequestOidcSsoConfig extends $dara.Model {
   idTokenEffectiveTime?: number;
   /**
    * @remarks
-   * The ID of the identity authentication source used for the password mode. This parameter takes effect only when the GrantTypes of the OIDC application includes the password mode.
+   * The ID of the authentication source used in password mode. This parameter takes effect only when the GrantTypes specified for the OIDC application include the password mode.
    * 
    * @example
    * ia_password
@@ -106,7 +106,7 @@ export class SetApplicationSsoConfigRequestOidcSsoConfig extends $dara.Model {
   passwordAuthenticationSourceId?: string;
   /**
    * @remarks
-   * Specifies whether TOTP-based secondary authentication is required for the password mode. This parameter takes effect only when the GrantTypes of the OIDC application includes the password mode.
+   * Specifies whether TOTP-based secondary authentication is required for password mode. This parameter takes effect only when the GrantTypes specified for the OIDC application include the password mode.
    * 
    * @example
    * true
@@ -122,7 +122,7 @@ export class SetApplicationSsoConfigRequestOidcSsoConfig extends $dara.Model {
   pkceChallengeMethods?: string[];
   /**
    * @remarks
-   * Specifies whether the application SSO requires PKCE (RFC 7636).
+   * Specifies whether Proof Key for Code Exchange (PKCE) (RFC 7636) is required for application SSO.
    * 
    * @example
    * true
@@ -130,12 +130,12 @@ export class SetApplicationSsoConfigRequestOidcSsoConfig extends $dara.Model {
   pkceRequired?: boolean;
   /**
    * @remarks
-   * The list of logout callback addresses supported by the application.
+   * The list of logout callback URIs supported by the application.
    */
   postLogoutRedirectUris?: string[];
   /**
    * @remarks
-   * The list of RedirectUris supported by the application.
+   * The list of redirect URIs supported by the application.
    */
   redirectUris?: string[];
   /**
@@ -148,7 +148,7 @@ export class SetApplicationSsoConfigRequestOidcSsoConfig extends $dara.Model {
   refreshTokenEffective?: number;
   /**
    * @remarks
-   * The response types supported by the application when OidcSsoConfig.GrantTypes includes the implicit mode.
+   * The response types supported by the application when OidcSsoConfig.GrantTypes includes the implicit grant type.
    * 
    * @example
    * token id_token
@@ -156,7 +156,7 @@ export class SetApplicationSsoConfigRequestOidcSsoConfig extends $dara.Model {
   responseTypes?: string[];
   /**
    * @remarks
-   * The custom expression for the sub value returned in the ID token.
+   * The custom expression for the sub claim value returned in the ID token.
    * 
    * @example
    * user.userid
@@ -237,7 +237,7 @@ export class SetApplicationSsoConfigRequestOidcSsoConfig extends $dara.Model {
 export class SetApplicationSsoConfigRequestSamlSsoConfigAttributeStatements extends $dara.Model {
   /**
    * @remarks
-   * The Name of the attribute in the SAML assertion.
+   * The name of the attribute in the SAML assertion.
    * 
    * @example
    * https://www.aliyun.com/SAML-Role/Attributes/RoleSessionName
@@ -317,9 +317,9 @@ export class SetApplicationSsoConfigRequestSamlSsoConfigOptionalRelayStates exte
 export class SetApplicationSsoConfigRequestSamlSsoConfig extends $dara.Model {
   /**
    * @remarks
-   * Specifies whether the Assertion needs to be signed. ResponseSigned and AssertionSigned cannot both be set to false.
-   * - true: The Assertion is signed.
-   * - false: The Assertion is not signed.
+   * Specifies whether the assertion needs to be signed. ResponseSigned and AssertionSigned cannot both be set to false.
+   * - true: The assertion is signed.
+   * - false: The assertion is not signed.
    * 
    * @example
    * true
@@ -332,7 +332,7 @@ export class SetApplicationSsoConfigRequestSamlSsoConfig extends $dara.Model {
   attributeStatements?: SetApplicationSsoConfigRequestSamlSsoConfigAttributeStatements[];
   /**
    * @remarks
-   * The default RelayState value. When the single sign-on (SSO) request is initiated by EIAM, the SAML Response provided by EIAM specifies the RelayState as this value.
+   * The default RelayState value. When a single sign-on (SSO) logon request is initiated by EIAM, the SAML Response provided by EIAM specifies the RelayState as this value.
    * 
    * @example
    * https://home.console.aliyun.com
@@ -360,7 +360,7 @@ export class SetApplicationSsoConfigRequestSamlSsoConfig extends $dara.Model {
   nameIdFormat?: string;
   /**
    * @remarks
-   * The expression used to generate the actual NameID value for the SAML protocol.
+   * The expression used to generate the actual NameID value in the SAML protocol.
    * 
    * @example
    * user.email
@@ -373,9 +373,17 @@ export class SetApplicationSsoConfigRequestSamlSsoConfig extends $dara.Model {
   optionalRelayStates?: SetApplicationSsoConfigRequestSamlSsoConfigOptionalRelayStates[];
   /**
    * @remarks
-   * Specifies whether the Response needs to be signed. ResponseSigned and AssertionSigned cannot both be set to false.
-   * - true: The Response is signed.
-   * - false: The Response is not signed.
+   * Specifies whether SSO AuthnRequest signature verification is enabled. Default value: false. If set to true, spSigningCertificates must be configured (the array must not be empty).
+   * 
+   * @example
+   * false
+   */
+  requireAuthnRequestSigned?: boolean;
+  /**
+   * @remarks
+   * Specifies whether the response needs to be signed. ResponseSigned and AssertionSigned cannot both be set to false.
+   * - true: The response is signed.
+   * - false: The response is not signed.
    * 
    * @example
    * true
@@ -383,7 +391,7 @@ export class SetApplicationSsoConfigRequestSamlSsoConfig extends $dara.Model {
   responseSigned?: boolean;
   /**
    * @remarks
-   * The SAML assertion signature algorithm.
+   * The signature algorithm for the SAML assertion.
    * 
    * @example
    * RSA-SHA256
@@ -399,7 +407,23 @@ export class SetApplicationSsoConfigRequestSamlSsoConfig extends $dara.Model {
   spEntityId?: string;
   /**
    * @remarks
-   * The SAML assertion consumer service (ACS) URL of the application (SP).
+   * The array of SP signature verification certificates in PEM format. A maximum of two certificates are allowed and are shared by SSO and SLO. Each certificate is validated for format and validity upon write. Requests with more than two certificates are rejected.
+   * 
+   * @example
+   * -----BEGIN CERTIFICATE----- MIIC0jCCAbqgAwIBAgIQXXXXX -----END CERTIFICATE-----
+   */
+  spSigningCertificates?: string[];
+  /**
+   * @remarks
+   * The URL on the SP side that receives the LogoutResponse. This parameter is optional.
+   * 
+   * @example
+   * https://example.com/api/slo/response
+   */
+  spSloResponseUrl?: string;
+  /**
+   * @remarks
+   * The SAML assertion consumer service URL of the application (SP).
    * 
    * @example
    * https://signin.aliyun.com/saml-role/sso
@@ -414,9 +438,12 @@ export class SetApplicationSsoConfigRequestSamlSsoConfig extends $dara.Model {
       nameIdFormat: 'NameIdFormat',
       nameIdValueExpression: 'NameIdValueExpression',
       optionalRelayStates: 'OptionalRelayStates',
+      requireAuthnRequestSigned: 'RequireAuthnRequestSigned',
       responseSigned: 'ResponseSigned',
       signatureAlgorithm: 'SignatureAlgorithm',
       spEntityId: 'SpEntityId',
+      spSigningCertificates: 'SpSigningCertificates',
+      spSloResponseUrl: 'SpSloResponseUrl',
       spSsoAcsUrl: 'SpSsoAcsUrl',
     };
   }
@@ -430,9 +457,12 @@ export class SetApplicationSsoConfigRequestSamlSsoConfig extends $dara.Model {
       nameIdFormat: 'string',
       nameIdValueExpression: 'string',
       optionalRelayStates: { 'type': 'array', 'itemType': SetApplicationSsoConfigRequestSamlSsoConfigOptionalRelayStates },
+      requireAuthnRequestSigned: 'boolean',
       responseSigned: 'boolean',
       signatureAlgorithm: 'string',
       spEntityId: 'string',
+      spSigningCertificates: { 'type': 'array', 'itemType': 'string' },
+      spSloResponseUrl: 'string',
       spSsoAcsUrl: 'string',
     };
   }
@@ -444,6 +474,9 @@ export class SetApplicationSsoConfigRequestSamlSsoConfig extends $dara.Model {
     if(Array.isArray(this.optionalRelayStates)) {
       $dara.Model.validateArray(this.optionalRelayStates);
     }
+    if(Array.isArray(this.spSigningCertificates)) {
+      $dara.Model.validateArray(this.spSigningCertificates);
+    }
     super.validate();
   }
 
@@ -465,7 +498,7 @@ export class SetApplicationSsoConfigRequest extends $dara.Model {
   applicationId?: string;
   /**
    * @remarks
-   * The client token that is used to ensure the idempotence of the request. You can use the client to generate the token, but you must make sure that the token is unique among different requests. The token can contain only ASCII characters and cannot exceed 64 characters in length. For more information, see How to ensure idempotence.
+   * The client token that is used to ensure the idempotence of the request. Generate a unique value from your client. The value can contain only ASCII characters and cannot exceed 64 characters in length. For more information, see How to ensure idempotence.
    * 
    * @example
    * client-examplexxx
@@ -473,9 +506,9 @@ export class SetApplicationSsoConfigRequest extends $dara.Model {
   clientToken?: string;
   /**
    * @remarks
-   * The initialization single sign-on (SSO) method. Valid values:
-   * - only_app_init_sso: Only application-initiated SSO. This is the default value for OIDC protocol applications. When a SAML application specifies this method, InitLoginUrl must be specified.
-   * - idaas_or_app_init_sso: SSO initiated from the IDaaS portal or the application. This is the default value for SAML protocol applications. When an OIDC protocol application specifies this method, InitLoginUrl must be specified.
+   * The initial single sign-on (SSO) logon method. Valid values:
+   * - only_app_init_sso: Only application-initiated SSO is supported. This is the default value for OIDC protocol applications. When a SAML application uses this method, InitLoginUrl must be specified.
+   * - idaas_or_app_init_sso: Both IDaaS portal-initiated and application-initiated SSO are supported. This is the default value for SAML protocol applications. When an OIDC protocol application uses this method, InitLoginUrl must be specified.
    * 
    * @example
    * only_app_init_sso
@@ -483,9 +516,9 @@ export class SetApplicationSsoConfigRequest extends $dara.Model {
   initLoginType?: string;
   /**
    * @remarks
-   * The URL that triggers the initialization single sign-on (SSO).
-   * When an OIDC protocol application sets InitLoginType to idaas_or_app_init_sso, this parameter is required.
-   * When a SAML protocol application sets InitLoginType to only_app_init_sso, this parameter is required.
+   * The initial single sign-on (SSO) logon trigger URL.
+   * This parameter is required when an OIDC protocol application sets InitLoginType to idaas_or_app_init_sso.
+   * This parameter is required when a SAML protocol application sets InitLoginType to only_app_init_sso.
    * 
    * @example
    * http://127.0.0.1:8000/start_login?enterprise_code=ABCDEF
@@ -503,12 +536,12 @@ export class SetApplicationSsoConfigRequest extends $dara.Model {
   instanceId?: string;
   /**
    * @remarks
-   * The SSO configuration parameters for an OIDC protocol-based application.
+   * The SSO configuration parameters for an OIDC-based application.
    */
   oidcSsoConfig?: SetApplicationSsoConfigRequestOidcSsoConfig;
   /**
    * @remarks
-   * The SSO configuration parameters for a SAML protocol-based application.
+   * The SSO configuration parameters for a SAML-based application.
    */
   samlSsoConfig?: SetApplicationSsoConfigRequestSamlSsoConfig;
   static names(): { [key: string]: string } {

package/src/models/UpdateApplicationFederatedCredentialRequest.ts

@@ -43,9 +43,34 @@ export class UpdateApplicationFederatedCredentialRequestAttributeMappings extend
 }
 
 export class UpdateApplicationFederatedCredentialRequestOidcVerificationConfigAzureVmConfig extends $dara.Model {
+  /**
+   * @remarks
+   * The principal ID.
+   * 
+   * @example
+   * 5dee234a-1b4c-4ad7-a19f-fxxxxx
+   */
   principalId?: string;
+  /**
+   * @remarks
+   * The Azure resource group name.
+   * 
+   * @example
+   * user_default
+   */
   resourceGroupName?: string;
+  /**
+   * @remarks
+   * The subscription ID.
+   * 
+   * @example
+   * 4342a1f4-7e5d-4371-97dc-d4f33f4xxxx
+   */
   subscriptionId?: string;
+  /**
+   * @remarks
+   * The list of virtual machine names.
+   */
   vmNames?: string[];
   static names(): { [key: string]: string } {
     return {
@@ -78,11 +103,22 @@ export class UpdateApplicationFederatedCredentialRequestOidcVerificationConfigAz
 }
 
 export class UpdateApplicationFederatedCredentialRequestOidcVerificationConfigGcpVmConfig extends $dara.Model {
+  /**
+   * @remarks
+   * The list of VM instance IDs.
+   */
   instanceIds?: string[];
+  /**
+   * @remarks
+   * The GCP project ID.
+   * 
+   * @example
+   * turnkey-axiom-475109-xx
+   */
   projectId?: string;
   /**
    * @remarks
-   * The sub value corresponding to the service account.
+   * The sub claim corresponding to the service account.
    * 
    * @example
    * 123456789
@@ -117,6 +153,13 @@ export class UpdateApplicationFederatedCredentialRequestOidcVerificationConfigGc
 }
 
 export class UpdateApplicationFederatedCredentialRequestOidcVerificationConfigGenericConfig extends $dara.Model {
+  /**
+   * @remarks
+   * The subject identifier.
+   * 
+   * @example
+   * test_subject
+   */
   subject?: string;
   static names(): { [key: string]: string } {
     return {
@@ -142,7 +185,7 @@ export class UpdateApplicationFederatedCredentialRequestOidcVerificationConfigGe
 export class UpdateApplicationFederatedCredentialRequestOidcVerificationConfigKubernetesConfig extends $dara.Model {
   /**
    * @remarks
-   * The Kubernetes namespace.
+   * The K8s namespace.
    * 
    * @example
    * default
@@ -158,7 +201,7 @@ export class UpdateApplicationFederatedCredentialRequestOidcVerificationConfigKu
   podNamePrefix?: string;
   /**
    * @remarks
-   * The Kubernetes service account name.
+   * The K8s service account name.
    * 
    * @example
    * my-sa
@@ -200,6 +243,10 @@ export class UpdateApplicationFederatedCredentialRequestOidcVerificationConfig e
    * The GCP VM scenario configuration.
    */
   gcpVmConfig?: UpdateApplicationFederatedCredentialRequestOidcVerificationConfigGcpVmConfig;
+  /**
+   * @remarks
+   * The generic scenario configuration.
+   */
   genericConfig?: UpdateApplicationFederatedCredentialRequestOidcVerificationConfigGenericConfig;
   /**
    * @remarks
@@ -208,7 +255,11 @@ export class UpdateApplicationFederatedCredentialRequestOidcVerificationConfig e
   kubernetesConfig?: UpdateApplicationFederatedCredentialRequestOidcVerificationConfigKubernetesConfig;
   /**
    * @remarks
-   * The OIDC scenario profile. Valid values: generic, kubernetes, gcp_vm, and azure_vm.
+   * The OIDC scenario profile. Different profiles correspond to different configurations. Valid values:
+   * - generic
+   * - kubernetes
+   * - gcp_vm
+   * - azure_vm
    * 
    * @example
    * kubernetes
@@ -256,6 +307,10 @@ export class UpdateApplicationFederatedCredentialRequestOidcVerificationConfig e
 }
 
 export class UpdateApplicationFederatedCredentialRequestPkcs7VerificationConfig extends $dara.Model {
+  /**
+   * @remarks
+   * The list of VM instance IDs.
+   */
   instanceIds?: string[];
   static names(): { [key: string]: string } {
     return {
@@ -319,12 +374,12 @@ export class UpdateApplicationFederatedCredentialRequest extends $dara.Model {
   instanceId?: string;
   /**
    * @remarks
-   * The OIDC structured configuration (structured mode + oidc type).
+   * The OIDC structured configuration.
    */
   oidcVerificationConfig?: UpdateApplicationFederatedCredentialRequestOidcVerificationConfig;
   /**
    * @remarks
-   * The PKCS#7 structured configuration (structured mode + pkcs7 type).
+   * The PKCS#7 structured configuration.
    */
   pkcs7VerificationConfig?: UpdateApplicationFederatedCredentialRequestPkcs7VerificationConfig;
   /**