@googleapis/sts 15.1.0 → 16.0.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +20 -0
- package/build/tsconfig.tsbuildinfo +1 -1
- package/build/v1.d.ts +408 -2
- package/build/v1.js +228 -0
- package/build/v1.js.map +1 -1
- package/build/v1beta.d.ts +2 -2
- package/package.json +1 -1
- package/v1.ts +804 -2
- package/v1beta.ts +2 -2
package/build/v1.d.ts
CHANGED
|
@@ -67,6 +67,8 @@ export declare namespace sts_v1 {
|
|
|
67
67
|
*/
|
|
68
68
|
export class Sts {
|
|
69
69
|
context: APIRequestContext;
|
|
70
|
+
organizations: Resource$Organizations;
|
|
71
|
+
projects: Resource$Projects;
|
|
70
72
|
v1: Resource$V1;
|
|
71
73
|
constructor(options: GlobalOptions, google?: GoogleConfigurable);
|
|
72
74
|
}
|
|
@@ -177,7 +179,7 @@ export declare namespace sts_v1 {
|
|
|
177
179
|
*/
|
|
178
180
|
scope?: string | null;
|
|
179
181
|
/**
|
|
180
|
-
* Required. The input token. This token is either an external credential issued by a workload identity pool provider, or a short-lived access token issued by Google. If the token is an OIDC JWT, it must use the JWT format defined in [RFC 7523](https://tools.ietf.org/html/rfc7523), and the `subject_token_type` must be either `urn:ietf:params:oauth:token-type:jwt` or `urn:ietf:params:oauth:token-type:id_token`. The following headers are required: - `kid`: The identifier of the signing key securing the JWT. - `alg`: The cryptographic algorithm securing the JWT. Must be `RS256` or `ES256`. The following payload fields are required. For more information, see [RFC 7523, Section 3](https://tools.ietf.org/html/rfc7523#section-3): - `iss`: The issuer of the token. The issuer must provide a discovery document at the URL `/.well-known/openid-configuration`, where `` is the value of this field. The document must be formatted according to section 4.2 of the [OIDC 1.0 Discovery specification](https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderConfigurationResponse). - `iat`: The issue time, in seconds, since the Unix epoch.
|
|
182
|
+
* Required. The input token. This token is either an external credential issued by a workload identity pool provider, or a short-lived access token issued by Google. If the token is an OIDC JWT, it must use the JWT format defined in [RFC 7523](https://tools.ietf.org/html/rfc7523), and the `subject_token_type` must be either `urn:ietf:params:oauth:token-type:jwt` or `urn:ietf:params:oauth:token-type:id_token`. The following headers are required: - `kid`: The identifier of the signing key securing the JWT. - `alg`: The cryptographic algorithm securing the JWT. Must be `RS256` or `ES256`. The following payload fields are required. For more information, see [RFC 7523, Section 3](https://tools.ietf.org/html/rfc7523#section-3): - `iss`: The issuer of the token. The issuer must provide a discovery document at the URL `/.well-known/openid-configuration`, where `` is the value of this field. The document must be formatted according to section 4.2 of the [OIDC 1.0 Discovery specification](https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderConfigurationResponse). - `iat`: The issue time, in seconds, since the Unix epoch. This timestamp must be in the past and no more than 24 hours in the past, or the token will be rejected. Note that this implies the token is only acceptable within a time window of at most 24 hours. - `exp`: The expiration time, in seconds, since the Unix epoch. Shorter expiration times are more secure. If possible, we recommend setting an expiration time less than 6 hours. - `sub`: The identity asserted in the JWT. - `aud`: For workload identity pools, this must be a value specified in the allowed audiences for the workload identity pool provider, or one of the audiences allowed by default if no audiences were specified. See https://cloud.google.com/iam/docs/reference/rest/v1/projects.locations.workloadIdentityPools.providers#oidc. For workforce pools, this must match the client ID specified in the provider configuration. See https://cloud.google.com/iam/docs/reference/rest/v1/locations.workforcePools.providers#oidc. Example header: ``` { "alg": "RS256", "kid": "us-east-11" \} ``` Example payload: ``` { "iss": "https://accounts.google.com", "iat": 1517963104, "exp": 1517966704, "aud": "//iam.googleapis.com/projects/1234567890123/locations/global/workloadIdentityPools/my-pool/providers/my-provider", "sub": "113475438248934895348", "my_claims": { "additional_claim": "value" \} \} ``` If `subject_token` is for AWS, it must be a serialized `GetCallerIdentity` token. This token contains the same information as a request to the AWS [`GetCallerIdentity()`](https://docs.aws.amazon.com/STS/latest/APIReference/API_GetCallerIdentity) method, as well as the AWS [signature](https://docs.aws.amazon.com/general/latest/gr/signing_aws_api_requests.html) for the request information. Use Signature Version 4. Format the request as URL-encoded JSON, and set the `subject_token_type` parameter to `urn:ietf:params:aws:token-type:aws4_request`. The following parameters are required: - `url`: The URL of the AWS STS endpoint for `GetCallerIdentity()`, such as `https://sts.amazonaws.com?Action=GetCallerIdentity&Version=2011-06-15`. Regional endpoints are also supported. - `method`: The HTTP request method: `POST`. - `headers`: The HTTP request headers, which must include: - `Authorization`: The request signature. - `x-amz-date`: The time you will send the request, formatted as an [ISO8601 Basic](https://docs.aws.amazon.com/general/latest/gr/sigv4_elements.html#sigv4_elements_date) string. This value is typically set to the current time and is used to help prevent replay attacks. - `host`: The hostname of the `url` field; for example, `sts.amazonaws.com`. - `x-goog-cloud-target-resource`: The full, canonical resource name of the workload identity pool provider, with or without an `https:` prefix. To help ensure data integrity, we recommend including this header in the `SignedHeaders` field of the signed request. For example: //iam.googleapis.com/projects//locations/global/workloadIdentityPools//providers/ https://iam.googleapis.com/projects//locations/global/workloadIdentityPools//providers/ If you are using temporary security credentials provided by AWS, you must also include the header `x-amz-security-token`, with the value set to the session token. The following example shows a `GetCallerIdentity` token: ``` { "headers": [ {"key": "x-amz-date", "value": "20200815T015049Z"\}, {"key": "Authorization", "value": "AWS4-HMAC-SHA256+Credential=$credential,+SignedHeaders=host;x-amz-date;x-goog-cloud-target-resource,+Signature=$signature"\}, {"key": "x-goog-cloud-target-resource", "value": "//iam.googleapis.com/projects//locations/global/workloadIdentityPools//providers/"\}, {"key": "host", "value": "sts.amazonaws.com"\} . ], "method": "POST", "url": "https://sts.amazonaws.com?Action=GetCallerIdentity&Version=2011-06-15" \} ``` If the token is a SAML 2.0 assertion, it must use the format defined in [the SAML 2.0 spec](https://docs.oasis-open.org/security/saml/Post2.0/sstc-saml-tech-overview-2.0-cd-02.pdf), and the `subject_token_type` must be `urn:ietf:params:oauth:token-type:saml2`. See [Verification of external credentials](https://cloud.google.com/iam/docs/using-workload-identity-federation#verification_of_external_credentials) for details on how SAML 2.0 assertions are validated during token exchanges. You can also use a Google-issued OAuth 2.0 access token with this field to obtain an access token with new security attributes applied, such as a Credential Access Boundary. In this case, set `subject_token_type` to `urn:ietf:params:oauth:token-type:access_token`. If an access token already contains security attributes, you cannot apply additional security attributes. If the request is for X.509 certificate-based authentication, the `subject_token` must be a JSON-formatted list of X.509 certificates in DER format, as defined in [RFC 7515](https://www.rfc-editor.org/rfc/rfc7515#section-4.1.6). `subject_token_type` must be `urn:ietf:params:oauth:token-type:mtls`. The following example shows a JSON-formatted list of X.509 certificate in DER format: ``` [\"MIIEYDCCA0i...\", \"MCIFFGAGTT0...\"] ```
|
|
181
183
|
*/
|
|
182
184
|
subjectToken?: string | null;
|
|
183
185
|
/**
|
|
@@ -210,6 +212,77 @@ export declare namespace sts_v1 {
|
|
|
210
212
|
*/
|
|
211
213
|
token_type?: string | null;
|
|
212
214
|
}
|
|
215
|
+
/**
|
|
216
|
+
* A JSON web key set (JWK) See also https://datatracker.ietf.org/doc/html/rfc7517 and https://github.com/spiffe/spiffe/blob/main/standards/JWT-SVID.md#6-representation-in-the-spiffe-bundle
|
|
217
|
+
*/
|
|
218
|
+
export interface Schema$GoogleIdentityStsV1Jwk {
|
|
219
|
+
/**
|
|
220
|
+
* Algorithm intended for use with the key. Currently "RS256".
|
|
221
|
+
*/
|
|
222
|
+
alg?: string | null;
|
|
223
|
+
/**
|
|
224
|
+
* Exponent value for kty="RSA".
|
|
225
|
+
*/
|
|
226
|
+
e?: string | null;
|
|
227
|
+
/**
|
|
228
|
+
* Key ID.
|
|
229
|
+
*/
|
|
230
|
+
kid?: string | null;
|
|
231
|
+
/**
|
|
232
|
+
* Key type. Currently "RSA".
|
|
233
|
+
*/
|
|
234
|
+
kty?: string | null;
|
|
235
|
+
/**
|
|
236
|
+
* Modulus value for kty="RSA".
|
|
237
|
+
*/
|
|
238
|
+
n?: string | null;
|
|
239
|
+
/**
|
|
240
|
+
* Public key use. Currently "sig".
|
|
241
|
+
*/
|
|
242
|
+
use?: string | null;
|
|
243
|
+
}
|
|
244
|
+
/**
|
|
245
|
+
* Response message for GetJwks.
|
|
246
|
+
*/
|
|
247
|
+
export interface Schema$GoogleIdentityStsV1Jwks {
|
|
248
|
+
/**
|
|
249
|
+
* The JWKS for this OP.
|
|
250
|
+
*/
|
|
251
|
+
keys?: Schema$GoogleIdentityStsV1Jwk[];
|
|
252
|
+
}
|
|
253
|
+
/**
|
|
254
|
+
* Response message for GetOpenIdProviderConfig. Message fields are defined in https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderConfigurationResponse
|
|
255
|
+
*/
|
|
256
|
+
export interface Schema$GoogleIdentityStsV1OpenIdProviderConfig {
|
|
257
|
+
/**
|
|
258
|
+
* URL pointing to an authorization endpoint under this issuer. Note: Currently this endpoint returns a 404.
|
|
259
|
+
*/
|
|
260
|
+
authorization_endpoint?: string | null;
|
|
261
|
+
/**
|
|
262
|
+
* JSON array containing a list of the JWS signing algorithms (alg values) supported by the OP for the ID token to encode the claims in a JWT [JWT]. Note: Currently always "["RS256"]".
|
|
263
|
+
*/
|
|
264
|
+
id_token_signing_alg_values_supported?: string[] | null;
|
|
265
|
+
/**
|
|
266
|
+
* URL using the https scheme with no query or fragment components that the OP asserts as its issuer identifier.
|
|
267
|
+
*/
|
|
268
|
+
issuer?: string | null;
|
|
269
|
+
/**
|
|
270
|
+
* URL of the OP's JWK Set [JWK] document, which MUST use the https scheme.
|
|
271
|
+
*/
|
|
272
|
+
jwks_uri?: string | null;
|
|
273
|
+
/**
|
|
274
|
+
* JSON array containing a list of the OAuth 2.0 response_type values that this OP supports. Note: Currently always "["id_token"]".
|
|
275
|
+
*/
|
|
276
|
+
response_types_supported?: string[] | null;
|
|
277
|
+
/**
|
|
278
|
+
* JSON array containing a list of the subject identifier types that this OP supports. Note: Currently always "["public"]".
|
|
279
|
+
*/
|
|
280
|
+
subject_types_supported?: string[] | null;
|
|
281
|
+
/**
|
|
282
|
+
* URL pointing to a token endpoint under this issuer. Note: Currently this endpoint returns a 404.
|
|
283
|
+
*/
|
|
284
|
+
token_endpoint?: string | null;
|
|
285
|
+
}
|
|
213
286
|
/**
|
|
214
287
|
* An `Options` object configures features that the Security Token Service supports, but that are not supported by standard OAuth 2.0 token exchange endpoints, as defined in https://tools.ietf.org/html/rfc8693.
|
|
215
288
|
*/
|
|
@@ -219,7 +292,7 @@ export declare namespace sts_v1 {
|
|
|
219
292
|
*/
|
|
220
293
|
accessBoundary?: Schema$GoogleIdentityStsV1AccessBoundary;
|
|
221
294
|
/**
|
|
222
|
-
* The unpadded,
|
|
295
|
+
* The unpadded, url-escaped, base64-encoded SHA-256 hash of the certificate's DER encoding. It must be 43 characters long. The resulting token will be bound to this value.
|
|
223
296
|
*/
|
|
224
297
|
bindCertFingerprint?: string | null;
|
|
225
298
|
/**
|
|
@@ -248,6 +321,339 @@ export declare namespace sts_v1 {
|
|
|
248
321
|
*/
|
|
249
322
|
title?: string | null;
|
|
250
323
|
}
|
|
324
|
+
export class Resource$Organizations {
|
|
325
|
+
context: APIRequestContext;
|
|
326
|
+
locations: Resource$Organizations$Locations;
|
|
327
|
+
constructor(context: APIRequestContext);
|
|
328
|
+
}
|
|
329
|
+
export class Resource$Organizations$Locations {
|
|
330
|
+
context: APIRequestContext;
|
|
331
|
+
workloadIdentityPools: Resource$Organizations$Locations$Workloadidentitypools;
|
|
332
|
+
constructor(context: APIRequestContext);
|
|
333
|
+
}
|
|
334
|
+
export class Resource$Organizations$Locations$Workloadidentitypools {
|
|
335
|
+
context: APIRequestContext;
|
|
336
|
+
openid: Resource$Organizations$Locations$Workloadidentitypools$Openid;
|
|
337
|
+
wellKnown: Resource$Organizations$Locations$Workloadidentitypools$WellKnown;
|
|
338
|
+
constructor(context: APIRequestContext);
|
|
339
|
+
}
|
|
340
|
+
export class Resource$Organizations$Locations$Workloadidentitypools$Openid {
|
|
341
|
+
context: APIRequestContext;
|
|
342
|
+
constructor(context: APIRequestContext);
|
|
343
|
+
/**
|
|
344
|
+
* Fetches the signing keys for an agentic or managed workload identity pool and returns them in JWKs format, defined in [RFC 7517](https://tools.ietf.org/html/rfc7517). For now, only agentic system pools are supported. **Preview** This feature is subject to the "Pre-GA Offerings Terms" in the General Service Terms section of the [Service Specific Terms](https://cloud.google.com/terms/service-terms#1). Pre-GA features are available "as is" and might have limited support. For more information, see the [launch stage descriptions](https://cloud.google.com/products#product-launch-stages).
|
|
345
|
+
* @example
|
|
346
|
+
* ```js
|
|
347
|
+
* // Before running the sample:
|
|
348
|
+
* // - Enable the API at:
|
|
349
|
+
* // https://console.developers.google.com/apis/api/sts.googleapis.com
|
|
350
|
+
* // - Login into gcloud by running:
|
|
351
|
+
* // ```sh
|
|
352
|
+
* // $ gcloud auth application-default login
|
|
353
|
+
* // ```
|
|
354
|
+
* // - Install the npm module by running:
|
|
355
|
+
* // ```sh
|
|
356
|
+
* // $ npm install googleapis
|
|
357
|
+
* // ```
|
|
358
|
+
*
|
|
359
|
+
* const {google} = require('googleapis');
|
|
360
|
+
* const sts = google.sts('v1');
|
|
361
|
+
*
|
|
362
|
+
* async function main() {
|
|
363
|
+
* const auth = new google.auth.GoogleAuth({
|
|
364
|
+
* // Scopes can be specified either as an array or as a single, space-delimited string.
|
|
365
|
+
* scopes: [],
|
|
366
|
+
* });
|
|
367
|
+
*
|
|
368
|
+
* // Acquire an auth client, and bind it to all future calls
|
|
369
|
+
* const authClient = await auth.getClient();
|
|
370
|
+
* google.options({auth: authClient});
|
|
371
|
+
*
|
|
372
|
+
* // Do the magic
|
|
373
|
+
* const res =
|
|
374
|
+
* await sts.organizations.locations.workloadIdentityPools.openid.getJwks({
|
|
375
|
+
* // Required. The name of the pool whose JWKS needs to be retrieved. Format: 'organizations/{ORGANIZATION_NUMBER\}/locations/global/workloadIdentityPools/{POOL_ID\}' 'projects/{PROJECT_NUMBER\}/locations/global/workloadIdentityPools/{POOL_ID\}' Example(s): 'organizations/1234/locations/global/workloadIdentityPools/agents.global.org-1234.system.id.goog' 'projects/12345678/locations/global/workloadIdentityPools/agents.global.proj-12345678.system.id.goog'
|
|
376
|
+
* name: 'organizations/my-organization/locations/my-location/workloadIdentityPools/my-workloadIdentityPool',
|
|
377
|
+
* });
|
|
378
|
+
* console.log(res.data);
|
|
379
|
+
*
|
|
380
|
+
* // Example response
|
|
381
|
+
* // {
|
|
382
|
+
* // "keys": []
|
|
383
|
+
* // }
|
|
384
|
+
* }
|
|
385
|
+
*
|
|
386
|
+
* main().catch(e => {
|
|
387
|
+
* console.error(e);
|
|
388
|
+
* throw e;
|
|
389
|
+
* });
|
|
390
|
+
*
|
|
391
|
+
* ```
|
|
392
|
+
*
|
|
393
|
+
* @param params - Parameters for request
|
|
394
|
+
* @param options - Optionally override request options, such as `url`, `method`, and `encoding`.
|
|
395
|
+
* @param callback - Optional callback that handles the response.
|
|
396
|
+
* @returns A promise if used with async/await, or void if used with a callback.
|
|
397
|
+
*/
|
|
398
|
+
getJwks(params: Params$Resource$Organizations$Locations$Workloadidentitypools$Openid$Getjwks, options: StreamMethodOptions): Promise<GaxiosResponseWithHTTP2<Readable>>;
|
|
399
|
+
getJwks(params?: Params$Resource$Organizations$Locations$Workloadidentitypools$Openid$Getjwks, options?: MethodOptions): Promise<GaxiosResponseWithHTTP2<Schema$GoogleIdentityStsV1Jwks>>;
|
|
400
|
+
getJwks(params: Params$Resource$Organizations$Locations$Workloadidentitypools$Openid$Getjwks, options: StreamMethodOptions | BodyResponseCallback<Readable>, callback: BodyResponseCallback<Readable>): void;
|
|
401
|
+
getJwks(params: Params$Resource$Organizations$Locations$Workloadidentitypools$Openid$Getjwks, options: MethodOptions | BodyResponseCallback<Schema$GoogleIdentityStsV1Jwks>, callback: BodyResponseCallback<Schema$GoogleIdentityStsV1Jwks>): void;
|
|
402
|
+
getJwks(params: Params$Resource$Organizations$Locations$Workloadidentitypools$Openid$Getjwks, callback: BodyResponseCallback<Schema$GoogleIdentityStsV1Jwks>): void;
|
|
403
|
+
getJwks(callback: BodyResponseCallback<Schema$GoogleIdentityStsV1Jwks>): void;
|
|
404
|
+
}
|
|
405
|
+
export interface Params$Resource$Organizations$Locations$Workloadidentitypools$Openid$Getjwks extends StandardParameters {
|
|
406
|
+
/**
|
|
407
|
+
* Required. The name of the pool whose JWKS needs to be retrieved. Format: 'organizations/{ORGANIZATION_NUMBER\}/locations/global/workloadIdentityPools/{POOL_ID\}' 'projects/{PROJECT_NUMBER\}/locations/global/workloadIdentityPools/{POOL_ID\}' Example(s): 'organizations/1234/locations/global/workloadIdentityPools/agents.global.org-1234.system.id.goog' 'projects/12345678/locations/global/workloadIdentityPools/agents.global.proj-12345678.system.id.goog'
|
|
408
|
+
*/
|
|
409
|
+
name?: string;
|
|
410
|
+
}
|
|
411
|
+
export class Resource$Organizations$Locations$Workloadidentitypools$WellKnown {
|
|
412
|
+
context: APIRequestContext;
|
|
413
|
+
constructor(context: APIRequestContext);
|
|
414
|
+
/**
|
|
415
|
+
* Gets the OIDC provider configuration for an agentic or managed workload identity pool following [the OIDC 1.0 discovery specification](https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderConfigurationResponse). For now, only agentic system pools are supported. **Preview** This feature is subject to the "Pre-GA Offerings Terms" in the General Service Terms section of the [Service Specific Terms](https://cloud.google.com/terms/service-terms#1). Pre-GA features are available "as is" and might have limited support. For more information, see the [launch stage descriptions](https://cloud.google.com/products#product-launch-stages).
|
|
416
|
+
* @example
|
|
417
|
+
* ```js
|
|
418
|
+
* // Before running the sample:
|
|
419
|
+
* // - Enable the API at:
|
|
420
|
+
* // https://console.developers.google.com/apis/api/sts.googleapis.com
|
|
421
|
+
* // - Login into gcloud by running:
|
|
422
|
+
* // ```sh
|
|
423
|
+
* // $ gcloud auth application-default login
|
|
424
|
+
* // ```
|
|
425
|
+
* // - Install the npm module by running:
|
|
426
|
+
* // ```sh
|
|
427
|
+
* // $ npm install googleapis
|
|
428
|
+
* // ```
|
|
429
|
+
*
|
|
430
|
+
* const {google} = require('googleapis');
|
|
431
|
+
* const sts = google.sts('v1');
|
|
432
|
+
*
|
|
433
|
+
* async function main() {
|
|
434
|
+
* const auth = new google.auth.GoogleAuth({
|
|
435
|
+
* // Scopes can be specified either as an array or as a single, space-delimited string.
|
|
436
|
+
* scopes: [],
|
|
437
|
+
* });
|
|
438
|
+
*
|
|
439
|
+
* // Acquire an auth client, and bind it to all future calls
|
|
440
|
+
* const authClient = await auth.getClient();
|
|
441
|
+
* google.options({auth: authClient});
|
|
442
|
+
*
|
|
443
|
+
* // Do the magic
|
|
444
|
+
* const res =
|
|
445
|
+
* (await sts.organizations.locations.workloadIdentityPools.well) -
|
|
446
|
+
* known.getOpenid -
|
|
447
|
+
* configuration({
|
|
448
|
+
* // Required. The name of the pool whose OpenID provider configuration to retrieve. Format: 'organizations/{ORGANIZATION_NUMBER\}/locations/global/workloadIdentityPools/{POOL_ID\}' 'projects/{PROJECT_NUMBER\}/locations/global/workloadIdentityPools/{POOL_ID\}' Example: 'organizations/1234/locations/global/workloadIdentityPools/agents.global.org-1234.system.id.goog' 'projects/12345678/locations/global/workloadIdentityPools/agents.global.proj-12345678.system.id.goog'
|
|
449
|
+
* name: 'organizations/my-organization/locations/my-location/workloadIdentityPools/my-workloadIdentityPool',
|
|
450
|
+
* });
|
|
451
|
+
* console.log(res.data);
|
|
452
|
+
*
|
|
453
|
+
* // Example response
|
|
454
|
+
* // {
|
|
455
|
+
* // "authorization_endpoint": "my_authorization_endpoint",
|
|
456
|
+
* // "id_token_signing_alg_values_supported": [],
|
|
457
|
+
* // "issuer": "my_issuer",
|
|
458
|
+
* // "jwks_uri": "my_jwks_uri",
|
|
459
|
+
* // "response_types_supported": [],
|
|
460
|
+
* // "subject_types_supported": [],
|
|
461
|
+
* // "token_endpoint": "my_token_endpoint"
|
|
462
|
+
* // }
|
|
463
|
+
* }
|
|
464
|
+
*
|
|
465
|
+
* main().catch(e => {
|
|
466
|
+
* console.error(e);
|
|
467
|
+
* throw e;
|
|
468
|
+
* });
|
|
469
|
+
*
|
|
470
|
+
* ```
|
|
471
|
+
*
|
|
472
|
+
* @param params - Parameters for request
|
|
473
|
+
* @param options - Optionally override request options, such as `url`, `method`, and `encoding`.
|
|
474
|
+
* @param callback - Optional callback that handles the response.
|
|
475
|
+
* @returns A promise if used with async/await, or void if used with a callback.
|
|
476
|
+
*/
|
|
477
|
+
getOpenidConfiguration(params: Params$Resource$Organizations$Locations$Workloadidentitypools$WellKnown$Getopenidconfiguration, options: StreamMethodOptions): Promise<GaxiosResponseWithHTTP2<Readable>>;
|
|
478
|
+
getOpenidConfiguration(params?: Params$Resource$Organizations$Locations$Workloadidentitypools$WellKnown$Getopenidconfiguration, options?: MethodOptions): Promise<GaxiosResponseWithHTTP2<Schema$GoogleIdentityStsV1OpenIdProviderConfig>>;
|
|
479
|
+
getOpenidConfiguration(params: Params$Resource$Organizations$Locations$Workloadidentitypools$WellKnown$Getopenidconfiguration, options: StreamMethodOptions | BodyResponseCallback<Readable>, callback: BodyResponseCallback<Readable>): void;
|
|
480
|
+
getOpenidConfiguration(params: Params$Resource$Organizations$Locations$Workloadidentitypools$WellKnown$Getopenidconfiguration, options: MethodOptions | BodyResponseCallback<Schema$GoogleIdentityStsV1OpenIdProviderConfig>, callback: BodyResponseCallback<Schema$GoogleIdentityStsV1OpenIdProviderConfig>): void;
|
|
481
|
+
getOpenidConfiguration(params: Params$Resource$Organizations$Locations$Workloadidentitypools$WellKnown$Getopenidconfiguration, callback: BodyResponseCallback<Schema$GoogleIdentityStsV1OpenIdProviderConfig>): void;
|
|
482
|
+
getOpenidConfiguration(callback: BodyResponseCallback<Schema$GoogleIdentityStsV1OpenIdProviderConfig>): void;
|
|
483
|
+
}
|
|
484
|
+
export interface Params$Resource$Organizations$Locations$Workloadidentitypools$WellKnown$Getopenidconfiguration extends StandardParameters {
|
|
485
|
+
/**
|
|
486
|
+
* Required. The name of the pool whose OpenID provider configuration to retrieve. Format: 'organizations/{ORGANIZATION_NUMBER\}/locations/global/workloadIdentityPools/{POOL_ID\}' 'projects/{PROJECT_NUMBER\}/locations/global/workloadIdentityPools/{POOL_ID\}' Example: 'organizations/1234/locations/global/workloadIdentityPools/agents.global.org-1234.system.id.goog' 'projects/12345678/locations/global/workloadIdentityPools/agents.global.proj-12345678.system.id.goog'
|
|
487
|
+
*/
|
|
488
|
+
name?: string;
|
|
489
|
+
}
|
|
490
|
+
export class Resource$Projects {
|
|
491
|
+
context: APIRequestContext;
|
|
492
|
+
locations: Resource$Projects$Locations;
|
|
493
|
+
constructor(context: APIRequestContext);
|
|
494
|
+
}
|
|
495
|
+
export class Resource$Projects$Locations {
|
|
496
|
+
context: APIRequestContext;
|
|
497
|
+
workloadIdentityPools: Resource$Projects$Locations$Workloadidentitypools;
|
|
498
|
+
constructor(context: APIRequestContext);
|
|
499
|
+
}
|
|
500
|
+
export class Resource$Projects$Locations$Workloadidentitypools {
|
|
501
|
+
context: APIRequestContext;
|
|
502
|
+
openid: Resource$Projects$Locations$Workloadidentitypools$Openid;
|
|
503
|
+
wellKnown: Resource$Projects$Locations$Workloadidentitypools$WellKnown;
|
|
504
|
+
constructor(context: APIRequestContext);
|
|
505
|
+
}
|
|
506
|
+
export class Resource$Projects$Locations$Workloadidentitypools$Openid {
|
|
507
|
+
context: APIRequestContext;
|
|
508
|
+
constructor(context: APIRequestContext);
|
|
509
|
+
/**
|
|
510
|
+
* Fetches the signing keys for an agentic or managed workload identity pool and returns them in JWKs format, defined in [RFC 7517](https://tools.ietf.org/html/rfc7517). For now, only agentic system pools are supported. **Preview** This feature is subject to the "Pre-GA Offerings Terms" in the General Service Terms section of the [Service Specific Terms](https://cloud.google.com/terms/service-terms#1). Pre-GA features are available "as is" and might have limited support. For more information, see the [launch stage descriptions](https://cloud.google.com/products#product-launch-stages).
|
|
511
|
+
* @example
|
|
512
|
+
* ```js
|
|
513
|
+
* // Before running the sample:
|
|
514
|
+
* // - Enable the API at:
|
|
515
|
+
* // https://console.developers.google.com/apis/api/sts.googleapis.com
|
|
516
|
+
* // - Login into gcloud by running:
|
|
517
|
+
* // ```sh
|
|
518
|
+
* // $ gcloud auth application-default login
|
|
519
|
+
* // ```
|
|
520
|
+
* // - Install the npm module by running:
|
|
521
|
+
* // ```sh
|
|
522
|
+
* // $ npm install googleapis
|
|
523
|
+
* // ```
|
|
524
|
+
*
|
|
525
|
+
* const {google} = require('googleapis');
|
|
526
|
+
* const sts = google.sts('v1');
|
|
527
|
+
*
|
|
528
|
+
* async function main() {
|
|
529
|
+
* const auth = new google.auth.GoogleAuth({
|
|
530
|
+
* // Scopes can be specified either as an array or as a single, space-delimited string.
|
|
531
|
+
* scopes: [],
|
|
532
|
+
* });
|
|
533
|
+
*
|
|
534
|
+
* // Acquire an auth client, and bind it to all future calls
|
|
535
|
+
* const authClient = await auth.getClient();
|
|
536
|
+
* google.options({auth: authClient});
|
|
537
|
+
*
|
|
538
|
+
* // Do the magic
|
|
539
|
+
* const res = await sts.projects.locations.workloadIdentityPools.openid.getJwks(
|
|
540
|
+
* {
|
|
541
|
+
* // Required. The name of the pool whose JWKS needs to be retrieved. Format: 'organizations/{ORGANIZATION_NUMBER\}/locations/global/workloadIdentityPools/{POOL_ID\}' 'projects/{PROJECT_NUMBER\}/locations/global/workloadIdentityPools/{POOL_ID\}' Example(s): 'organizations/1234/locations/global/workloadIdentityPools/agents.global.org-1234.system.id.goog' 'projects/12345678/locations/global/workloadIdentityPools/agents.global.proj-12345678.system.id.goog'
|
|
542
|
+
* name: 'projects/my-project/locations/my-location/workloadIdentityPools/my-workloadIdentityPool',
|
|
543
|
+
* },
|
|
544
|
+
* );
|
|
545
|
+
* console.log(res.data);
|
|
546
|
+
*
|
|
547
|
+
* // Example response
|
|
548
|
+
* // {
|
|
549
|
+
* // "keys": []
|
|
550
|
+
* // }
|
|
551
|
+
* }
|
|
552
|
+
*
|
|
553
|
+
* main().catch(e => {
|
|
554
|
+
* console.error(e);
|
|
555
|
+
* throw e;
|
|
556
|
+
* });
|
|
557
|
+
*
|
|
558
|
+
* ```
|
|
559
|
+
*
|
|
560
|
+
* @param params - Parameters for request
|
|
561
|
+
* @param options - Optionally override request options, such as `url`, `method`, and `encoding`.
|
|
562
|
+
* @param callback - Optional callback that handles the response.
|
|
563
|
+
* @returns A promise if used with async/await, or void if used with a callback.
|
|
564
|
+
*/
|
|
565
|
+
getJwks(params: Params$Resource$Projects$Locations$Workloadidentitypools$Openid$Getjwks, options: StreamMethodOptions): Promise<GaxiosResponseWithHTTP2<Readable>>;
|
|
566
|
+
getJwks(params?: Params$Resource$Projects$Locations$Workloadidentitypools$Openid$Getjwks, options?: MethodOptions): Promise<GaxiosResponseWithHTTP2<Schema$GoogleIdentityStsV1Jwks>>;
|
|
567
|
+
getJwks(params: Params$Resource$Projects$Locations$Workloadidentitypools$Openid$Getjwks, options: StreamMethodOptions | BodyResponseCallback<Readable>, callback: BodyResponseCallback<Readable>): void;
|
|
568
|
+
getJwks(params: Params$Resource$Projects$Locations$Workloadidentitypools$Openid$Getjwks, options: MethodOptions | BodyResponseCallback<Schema$GoogleIdentityStsV1Jwks>, callback: BodyResponseCallback<Schema$GoogleIdentityStsV1Jwks>): void;
|
|
569
|
+
getJwks(params: Params$Resource$Projects$Locations$Workloadidentitypools$Openid$Getjwks, callback: BodyResponseCallback<Schema$GoogleIdentityStsV1Jwks>): void;
|
|
570
|
+
getJwks(callback: BodyResponseCallback<Schema$GoogleIdentityStsV1Jwks>): void;
|
|
571
|
+
}
|
|
572
|
+
export interface Params$Resource$Projects$Locations$Workloadidentitypools$Openid$Getjwks extends StandardParameters {
|
|
573
|
+
/**
|
|
574
|
+
* Required. The name of the pool whose JWKS needs to be retrieved. Format: 'organizations/{ORGANIZATION_NUMBER\}/locations/global/workloadIdentityPools/{POOL_ID\}' 'projects/{PROJECT_NUMBER\}/locations/global/workloadIdentityPools/{POOL_ID\}' Example(s): 'organizations/1234/locations/global/workloadIdentityPools/agents.global.org-1234.system.id.goog' 'projects/12345678/locations/global/workloadIdentityPools/agents.global.proj-12345678.system.id.goog'
|
|
575
|
+
*/
|
|
576
|
+
name?: string;
|
|
577
|
+
}
|
|
578
|
+
export class Resource$Projects$Locations$Workloadidentitypools$WellKnown {
|
|
579
|
+
context: APIRequestContext;
|
|
580
|
+
constructor(context: APIRequestContext);
|
|
581
|
+
/**
|
|
582
|
+
* Gets the OIDC provider configuration for an agentic or managed workload identity pool following [the OIDC 1.0 discovery specification](https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderConfigurationResponse). For now, only agentic system pools are supported. **Preview** This feature is subject to the "Pre-GA Offerings Terms" in the General Service Terms section of the [Service Specific Terms](https://cloud.google.com/terms/service-terms#1). Pre-GA features are available "as is" and might have limited support. For more information, see the [launch stage descriptions](https://cloud.google.com/products#product-launch-stages).
|
|
583
|
+
* @example
|
|
584
|
+
* ```js
|
|
585
|
+
* // Before running the sample:
|
|
586
|
+
* // - Enable the API at:
|
|
587
|
+
* // https://console.developers.google.com/apis/api/sts.googleapis.com
|
|
588
|
+
* // - Login into gcloud by running:
|
|
589
|
+
* // ```sh
|
|
590
|
+
* // $ gcloud auth application-default login
|
|
591
|
+
* // ```
|
|
592
|
+
* // - Install the npm module by running:
|
|
593
|
+
* // ```sh
|
|
594
|
+
* // $ npm install googleapis
|
|
595
|
+
* // ```
|
|
596
|
+
*
|
|
597
|
+
* const {google} = require('googleapis');
|
|
598
|
+
* const sts = google.sts('v1');
|
|
599
|
+
*
|
|
600
|
+
* async function main() {
|
|
601
|
+
* const auth = new google.auth.GoogleAuth({
|
|
602
|
+
* // Scopes can be specified either as an array or as a single, space-delimited string.
|
|
603
|
+
* scopes: [],
|
|
604
|
+
* });
|
|
605
|
+
*
|
|
606
|
+
* // Acquire an auth client, and bind it to all future calls
|
|
607
|
+
* const authClient = await auth.getClient();
|
|
608
|
+
* google.options({auth: authClient});
|
|
609
|
+
*
|
|
610
|
+
* // Do the magic
|
|
611
|
+
* const res =
|
|
612
|
+
* (await sts.projects.locations.workloadIdentityPools.well) -
|
|
613
|
+
* known.getOpenid -
|
|
614
|
+
* configuration({
|
|
615
|
+
* // Required. The name of the pool whose OpenID provider configuration to retrieve. Format: 'organizations/{ORGANIZATION_NUMBER\}/locations/global/workloadIdentityPools/{POOL_ID\}' 'projects/{PROJECT_NUMBER\}/locations/global/workloadIdentityPools/{POOL_ID\}' Example: 'organizations/1234/locations/global/workloadIdentityPools/agents.global.org-1234.system.id.goog' 'projects/12345678/locations/global/workloadIdentityPools/agents.global.proj-12345678.system.id.goog'
|
|
616
|
+
* name: 'projects/my-project/locations/my-location/workloadIdentityPools/my-workloadIdentityPool',
|
|
617
|
+
* });
|
|
618
|
+
* console.log(res.data);
|
|
619
|
+
*
|
|
620
|
+
* // Example response
|
|
621
|
+
* // {
|
|
622
|
+
* // "authorization_endpoint": "my_authorization_endpoint",
|
|
623
|
+
* // "id_token_signing_alg_values_supported": [],
|
|
624
|
+
* // "issuer": "my_issuer",
|
|
625
|
+
* // "jwks_uri": "my_jwks_uri",
|
|
626
|
+
* // "response_types_supported": [],
|
|
627
|
+
* // "subject_types_supported": [],
|
|
628
|
+
* // "token_endpoint": "my_token_endpoint"
|
|
629
|
+
* // }
|
|
630
|
+
* }
|
|
631
|
+
*
|
|
632
|
+
* main().catch(e => {
|
|
633
|
+
* console.error(e);
|
|
634
|
+
* throw e;
|
|
635
|
+
* });
|
|
636
|
+
*
|
|
637
|
+
* ```
|
|
638
|
+
*
|
|
639
|
+
* @param params - Parameters for request
|
|
640
|
+
* @param options - Optionally override request options, such as `url`, `method`, and `encoding`.
|
|
641
|
+
* @param callback - Optional callback that handles the response.
|
|
642
|
+
* @returns A promise if used with async/await, or void if used with a callback.
|
|
643
|
+
*/
|
|
644
|
+
getOpenidConfiguration(params: Params$Resource$Projects$Locations$Workloadidentitypools$WellKnown$Getopenidconfiguration, options: StreamMethodOptions): Promise<GaxiosResponseWithHTTP2<Readable>>;
|
|
645
|
+
getOpenidConfiguration(params?: Params$Resource$Projects$Locations$Workloadidentitypools$WellKnown$Getopenidconfiguration, options?: MethodOptions): Promise<GaxiosResponseWithHTTP2<Schema$GoogleIdentityStsV1OpenIdProviderConfig>>;
|
|
646
|
+
getOpenidConfiguration(params: Params$Resource$Projects$Locations$Workloadidentitypools$WellKnown$Getopenidconfiguration, options: StreamMethodOptions | BodyResponseCallback<Readable>, callback: BodyResponseCallback<Readable>): void;
|
|
647
|
+
getOpenidConfiguration(params: Params$Resource$Projects$Locations$Workloadidentitypools$WellKnown$Getopenidconfiguration, options: MethodOptions | BodyResponseCallback<Schema$GoogleIdentityStsV1OpenIdProviderConfig>, callback: BodyResponseCallback<Schema$GoogleIdentityStsV1OpenIdProviderConfig>): void;
|
|
648
|
+
getOpenidConfiguration(params: Params$Resource$Projects$Locations$Workloadidentitypools$WellKnown$Getopenidconfiguration, callback: BodyResponseCallback<Schema$GoogleIdentityStsV1OpenIdProviderConfig>): void;
|
|
649
|
+
getOpenidConfiguration(callback: BodyResponseCallback<Schema$GoogleIdentityStsV1OpenIdProviderConfig>): void;
|
|
650
|
+
}
|
|
651
|
+
export interface Params$Resource$Projects$Locations$Workloadidentitypools$WellKnown$Getopenidconfiguration extends StandardParameters {
|
|
652
|
+
/**
|
|
653
|
+
* Required. The name of the pool whose OpenID provider configuration to retrieve. Format: 'organizations/{ORGANIZATION_NUMBER\}/locations/global/workloadIdentityPools/{POOL_ID\}' 'projects/{PROJECT_NUMBER\}/locations/global/workloadIdentityPools/{POOL_ID\}' Example: 'organizations/1234/locations/global/workloadIdentityPools/agents.global.org-1234.system.id.goog' 'projects/12345678/locations/global/workloadIdentityPools/agents.global.proj-12345678.system.id.goog'
|
|
654
|
+
*/
|
|
655
|
+
name?: string;
|
|
656
|
+
}
|
|
251
657
|
export class Resource$V1 {
|
|
252
658
|
context: APIRequestContext;
|
|
253
659
|
constructor(context: APIRequestContext);
|