or run

npx @tessl/cli init
Log in

Version

Tile

Overview

Evals

Files

docs

iam-policies.mdiap-admin.mdindex.mdoauth-management.md
tile.json

tessl/pypi-google-cloud-iap

Google Cloud Identity-Aware Proxy API client library for Python

Workspace
tessl
Visibility
Public
Created
Last updated
Describes
pypipkg:pypi/google-cloud-iap@1.17.x

To install, run

npx @tessl/cli install tessl/pypi-google-cloud-iap@1.17.0

index.mddocs/

Google Cloud Identity-Aware Proxy (IAP)

A comprehensive Python library for managing Google Cloud Identity-Aware Proxy (IAP), which enables developers to protect access to Google Cloud hosted resources and applications. The library provides programmatic access to IAP policies, OAuth brand/client management, tunnel destination groups, and authentication flows through Google's zero-trust security model.

Package Information

  • Package Name: google-cloud-iap
  • Package Type: pypi
  • Language: Python
  • Installation: pip install google-cloud-iap
  • Python Support: Python >= 3.7

Core Imports

from google.cloud.iap import IdentityAwareProxyAdminServiceClient
from google.cloud.iap import IdentityAwareProxyOAuthServiceClient

For async clients:

from google.cloud.iap import IdentityAwareProxyAdminServiceAsyncClient
from google.cloud.iap import IdentityAwareProxyOAuthServiceAsyncClient

Import data types:

from google.cloud.iap import (
    IapSettings,
    AccessSettings,
    Brand,
    IdentityAwareProxyClient,
    TunnelDestGroup
)

Import retry constants:

from google.api_core.retry import Retry
from google.api_core import gapic_v1

DEFAULT = gapic_v1.method.DEFAULT  # Default retry and timeout behavior

Basic Usage

from google.cloud.iap import IdentityAwareProxyAdminServiceClient
from google.cloud.iap import GetIapSettingsRequest

# Initialize the Admin client
client = IdentityAwareProxyAdminServiceClient()

# Get IAP settings for a resource
resource_name = "projects/my-project/iap_web/compute/services/my-service"
request = GetIapSettingsRequest(name=resource_name)
settings = client.get_iap_settings(request=request)

print(f"IAP settings for {resource_name}:")
print(f"Access settings: {settings.access_settings}")
print(f"Application settings: {settings.application_settings}")
from google.cloud.iap import IdentityAwareProxyOAuthServiceClient
from google.cloud.iap import ListBrandsRequest

# Initialize the OAuth client
oauth_client = IdentityAwareProxyOAuthServiceClient()

# List OAuth brands for a project
project_path = "projects/my-project"
request = ListBrandsRequest(parent=project_path)
response = oauth_client.list_brands(request=request)

for brand in response.brands:
    print(f"Brand: {brand.name}")
    print(f"Application title: {brand.application_title}")
    print(f"Support email: {brand.support_email}")

Async Client Usage

import asyncio
from google.cloud.iap import IdentityAwareProxyOAuthServiceAsyncClient
from google.cloud.iap import ListBrandsRequest

async def list_brands_async():
    # Initialize async OAuth client
    async_client = IdentityAwareProxyOAuthServiceAsyncClient()
    
    # List OAuth brands asynchronously
    project_path = "projects/my-project"
    request = ListBrandsRequest(parent=project_path)
    response = await async_client.list_brands(request=request)
    
    for brand in response.brands:
        print(f"Brand: {brand.name}")
        print(f"Support email: {brand.support_email}")

# Run async function
asyncio.run(list_brands_async())

Architecture

The google-cloud-iap library provides two main service clients that correspond to different aspects of IAP management:

  • Admin Service: Manages IAP settings, access policies, tunnel destination groups, and IAM permissions
  • OAuth Service: Manages OAuth brands and OAuth clients for IAP authentication flows

Both services support synchronous and asynchronous operation modes, with automatic retry handling, credential management, and built-in logging capabilities for production environments.

The library follows Google Cloud client library patterns with:

  • Transport abstraction: Supports gRPC and REST transports
  • Automatic retry: Built-in retry logic for transient failures
  • Authentication: Automatic credential discovery and management
  • Pagination: Helper classes for paginated API responses
  • Path helpers: Utility methods for constructing resource names

Capabilities

IAP Administration

Comprehensive IAP settings management including access controls, application settings, tunnel destination groups, and IAM policy operations. This includes configuring authentication methods, access restrictions, CORS settings, and custom access denied pages.

class IdentityAwareProxyAdminServiceClient:
    def get_iap_settings(self, request, *, retry=DEFAULT, timeout=DEFAULT, metadata=()) -> IapSettings: ...
    def update_iap_settings(self, request, *, retry=DEFAULT, timeout=DEFAULT, metadata=()) -> IapSettings: ...
    def validate_iap_attribute_expression(self, request, *, retry=DEFAULT, timeout=DEFAULT, metadata=()) -> ValidateIapAttributeExpressionResponse: ...
    def list_tunnel_dest_groups(self, request, *, parent=None, retry=DEFAULT, timeout=DEFAULT, metadata=()) -> ListTunnelDestGroupsPager: ...
    def create_tunnel_dest_group(self, request, *, parent=None, tunnel_dest_group=None, tunnel_dest_group_id=None, retry=DEFAULT, timeout=DEFAULT, metadata=()) -> TunnelDestGroup: ...
    def get_tunnel_dest_group(self, request, *, name=None, retry=DEFAULT, timeout=DEFAULT, metadata=()) -> TunnelDestGroup: ...
    def update_tunnel_dest_group(self, request, *, tunnel_dest_group=None, update_mask=None, retry=DEFAULT, timeout=DEFAULT, metadata=()) -> TunnelDestGroup: ...
    def delete_tunnel_dest_group(self, request, *, name=None, retry=DEFAULT, timeout=DEFAULT, metadata=()) -> None: ...

IAP Administration

OAuth Brand and Client Management

Programmatic creation, management, and configuration of IAP OAuth brands and OAuth clients. This includes creating OAuth applications, managing client secrets, and configuring OAuth flows for IAP authentication.

class IdentityAwareProxyOAuthServiceClient:
    def list_brands(self, request, *, retry=DEFAULT, timeout=DEFAULT, metadata=()) -> ListBrandsResponse: ...
    def create_brand(self, request, *, retry=DEFAULT, timeout=DEFAULT, metadata=()) -> Brand: ...
    def get_brand(self, request, *, name=None, retry=DEFAULT, timeout=DEFAULT, metadata=()) -> Brand: ...
    def create_identity_aware_proxy_client(self, request, *, retry=DEFAULT, timeout=DEFAULT, metadata=()) -> IdentityAwareProxyClient: ...
    def list_identity_aware_proxy_clients(self, request, *, retry=DEFAULT, timeout=DEFAULT, metadata=()) -> ListIdentityAwareProxyClientsPager: ...
    def get_identity_aware_proxy_client(self, request, *, name=None, retry=DEFAULT, timeout=DEFAULT, metadata=()) -> IdentityAwareProxyClient: ...
    def reset_identity_aware_proxy_client_secret(self, request, *, retry=DEFAULT, timeout=DEFAULT, metadata=()) -> IdentityAwareProxyClient: ...
    def delete_identity_aware_proxy_client(self, request, *, name=None, retry=DEFAULT, timeout=DEFAULT, metadata=()) -> None: ...

OAuth Management

IAM Policy Management

Standard Google Cloud IAM operations for IAP resources, including setting policies, getting policies, and testing permissions on IAP-protected resources.

class IdentityAwareProxyAdminServiceClient:
    def set_iam_policy(self, request, *, retry=DEFAULT, timeout=DEFAULT, metadata=()) -> policy_pb2.Policy: ...
    def get_iam_policy(self, request, *, retry=DEFAULT, timeout=DEFAULT, metadata=()) -> policy_pb2.Policy: ...
    def test_iam_permissions(self, request, *, retry=DEFAULT, timeout=DEFAULT, metadata=()) -> iam_policy_pb2.TestIamPermissionsResponse: ...

IAM Policy Management

Types

Core Configuration Types

class IapSettings:
    """The IAP configurable settings."""
    name: str
    access_settings: AccessSettings
    application_settings: ApplicationSettings

class AccessSettings:
    """Access related settings for IAP protected apps."""
    gcip_settings: GcipSettings
    cors_settings: CorsSettings
    oauth_settings: OAuthSettings
    reauth_settings: ReauthSettings
    allowed_domains_settings: AllowedDomainsSettings
    workforce_identity_settings: WorkforceIdentitySettings
    identity_sources: List[IdentitySource]
    
    class IdentitySource(Enum):
        IDENTITY_SOURCE_UNSPECIFIED = 0
        WORKFORCE_IDENTITY_FEDERATION = 3

class ApplicationSettings:
    """Wrapper over application specific settings for IAP."""
    csm_settings: CsmSettings
    access_denied_page_settings: AccessDeniedPageSettings
    cookie_domain: wrappers_pb2.StringValue
    attribute_propagation_settings: AttributePropagationSettings

Resource Types

class Brand:
    """OAuth brand data."""
    name: str  # Output only
    support_email: str
    application_title: str
    org_internal_only: bool  # Output only

class IdentityAwareProxyClient:
    """IAP OAuth client data."""
    name: str  # Output only
    secret: str  # Output only
    display_name: str

class TunnelDestGroup:
    """A tunnel destination group."""
    name: str
    cidrs: List[str]  # Optional
    fqdns: List[str]  # Optional