--- /dev/null
+// Copyright 2018 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+syntax = "proto3";
+
+package google.iam.credentials.v1;
+
+import "google/protobuf/duration.proto";
+import "google/protobuf/timestamp.proto";
+
+option cc_enable_arenas = true;
+option go_package = "google.golang.org/genproto/googleapis/iam/credentials/v1;credentials";
+option java_multiple_files = true;
+option java_outer_classname = "IAMCredentialsCommonProto";
+option java_package = "com.google.cloud.iam.credentials.v1";
+
+message GenerateAccessTokenRequest {
+ // The resource name of the service account for which the credentials
+ // are requested, in the following format:
+ // `projects/-/serviceAccounts/{ACCOUNT_EMAIL_OR_UNIQUEID}`.
+ string name = 1;
+
+ // The sequence of service accounts in a delegation chain. Each service
+ // account must be granted the `roles/iam.serviceAccountTokenCreator` role
+ // on its next service account in the chain. The last service account in the
+ // chain must be granted the `roles/iam.serviceAccountTokenCreator` role
+ // on the service account that is specified in the `name` field of the
+ // request.
+ //
+ // The delegates must have the following format:
+ // `projects/-/serviceAccounts/{ACCOUNT_EMAIL_OR_UNIQUEID}`
+ repeated string delegates = 2;
+
+ // Code to identify the scopes to be included in the OAuth 2.0 access token.
+ // See https://developers.google.com/identity/protocols/googlescopes for more
+ // information.
+ // At least one value required.
+ repeated string scope = 4;
+
+ // The desired lifetime duration of the access token in seconds.
+ // Must be set to a value less than or equal to 3600 (1 hour). If a value is
+ // not specified, the token's lifetime will be set to a default value of one
+ // hour.
+ google.protobuf.Duration lifetime = 7;
+}
+
+message GenerateAccessTokenResponse {
+ // The OAuth 2.0 access token.
+ string access_token = 1;
+
+ // Token expiration time.
+ // The expiration time is always set.
+ google.protobuf.Timestamp expire_time = 3;
+}
+
+message SignBlobRequest {
+ // The resource name of the service account for which the credentials
+ // are requested, in the following format:
+ // `projects/-/serviceAccounts/{ACCOUNT_EMAIL_OR_UNIQUEID}`.
+ string name = 1;
+
+ // The sequence of service accounts in a delegation chain. Each service
+ // account must be granted the `roles/iam.serviceAccountTokenCreator` role
+ // on its next service account in the chain. The last service account in the
+ // chain must be granted the `roles/iam.serviceAccountTokenCreator` role
+ // on the service account that is specified in the `name` field of the
+ // request.
+ //
+ // The delegates must have the following format:
+ // `projects/-/serviceAccounts/{ACCOUNT_EMAIL_OR_UNIQUEID}`
+ repeated string delegates = 3;
+
+ // The bytes to sign.
+ bytes payload = 5;
+}
+
+message SignBlobResponse {
+ // The ID of the key used to sign the blob.
+ string key_id = 1;
+
+ // The signed blob.
+ bytes signed_blob = 4;
+}
+
+message SignJwtRequest {
+ // The resource name of the service account for which the credentials
+ // are requested, in the following format:
+ // `projects/-/serviceAccounts/{ACCOUNT_EMAIL_OR_UNIQUEID}`.
+ string name = 1;
+
+ // The sequence of service accounts in a delegation chain. Each service
+ // account must be granted the `roles/iam.serviceAccountTokenCreator` role
+ // on its next service account in the chain. The last service account in the
+ // chain must be granted the `roles/iam.serviceAccountTokenCreator` role
+ // on the service account that is specified in the `name` field of the
+ // request.
+ //
+ // The delegates must have the following format:
+ // `projects/-/serviceAccounts/{ACCOUNT_EMAIL_OR_UNIQUEID}`
+ repeated string delegates = 3;
+
+ // The JWT payload to sign: a JSON object that contains a JWT Claims Set.
+ string payload = 5;
+}
+
+message SignJwtResponse {
+ // The ID of the key used to sign the JWT.
+ string key_id = 1;
+
+ // The signed JWT.
+ string signed_jwt = 2;
+}
+
+message GenerateIdTokenRequest {
+ // The resource name of the service account for which the credentials
+ // are requested, in the following format:
+ // `projects/-/serviceAccounts/{ACCOUNT_EMAIL_OR_UNIQUEID}`.
+ string name = 1;
+
+ // The sequence of service accounts in a delegation chain. Each service
+ // account must be granted the `roles/iam.serviceAccountTokenCreator` role
+ // on its next service account in the chain. The last service account in the
+ // chain must be granted the `roles/iam.serviceAccountTokenCreator` role
+ // on the service account that is specified in the `name` field of the
+ // request.
+ //
+ // The delegates must have the following format:
+ // `projects/-/serviceAccounts/{ACCOUNT_EMAIL_OR_UNIQUEID}`
+ repeated string delegates = 2;
+
+ // The audience for the token, such as the API or account that this token
+ // grants access to.
+ string audience = 3;
+
+ // Include the service account email in the token. If set to `true`, the
+ // token will contain `email` and `email_verified` claims.
+ bool include_email = 4;
+}
+
+message GenerateIdTokenResponse {
+ // The OpenId Connect ID token.
+ string token = 1;
+}
+
+message GenerateIdentityBindingAccessTokenRequest {
+ // The resource name of the service account for which the credentials
+ // are requested, in the following format:
+ // `projects/-/serviceAccounts/{ACCOUNT_EMAIL_OR_UNIQUEID}`.
+ string name = 1;
+
+ // Code to identify the scopes to be included in the OAuth 2.0 access token.
+ // See https://developers.google.com/identity/protocols/googlescopes for more
+ // information.
+ // At least one value required.
+ repeated string scope = 2;
+
+ // Required. Input token.
+ // Must be in JWT format according to
+ // RFC7523 (https://tools.ietf.org/html/rfc7523)
+ // and must have 'kid' field in the header.
+ // Supported signing algorithms: RS256 (RS512, ES256, ES512 coming soon).
+ // Mandatory payload fields (along the lines of RFC 7523, section 3):
+ // - iss: issuer of the token. Must provide a discovery document at
+ // $iss/.well-known/openid-configuration . The document needs to be
+ // formatted according to section 4.2 of the OpenID Connect Discovery
+ // 1.0 specification.
+ // - iat: Issue time in seconds since epoch. Must be in the past.
+ // - exp: Expiration time in seconds since epoch. Must be less than 48 hours
+ // after iat. We recommend to create tokens that last shorter than 6
+ // hours to improve security unless business reasons mandate longer
+ // expiration times. Shorter token lifetimes are generally more secure
+ // since tokens that have been exfiltrated by attackers can be used for
+ // a shorter time. you can configure the maximum lifetime of the
+ // incoming token in the configuration of the mapper.
+ // The resulting Google token will expire within an hour or at "exp",
+ // whichever is earlier.
+ // - sub: JWT subject, identity asserted in the JWT.
+ // - aud: Configured in the mapper policy. By default the service account
+ // email.
+ //
+ // Claims from the incoming token can be transferred into the output token
+ // accoding to the mapper configuration. The outgoing claim size is limited.
+ // Outgoing claims size must be less than 4kB serialized as JSON without
+ // whitespace.
+ //
+ // Example header:
+ // {
+ // "alg": "RS256",
+ // "kid": "92a4265e14ab04d4d228a48d10d4ca31610936f8"
+ // }
+ // Example payload:
+ // {
+ // "iss": "https://accounts.google.com",
+ // "iat": 1517963104,
+ // "exp": 1517966704,
+ // "aud": "https://iamcredentials.googleapis.com/",
+ // "sub": "113475438248934895348",
+ // "my_claims": {
+ // "additional_claim": "value"
+ // }
+ // }
+ string jwt = 3;
+}
+
+message GenerateIdentityBindingAccessTokenResponse {
+ // The OAuth 2.0 access token.
+ string access_token = 1;
+
+ // Token expiration time.
+ // The expiration time is always set.
+ google.protobuf.Timestamp expire_time = 2;
+}
git://repos.xcallymotion.com / motion2.git / blobdiff