0
# Google Cloud Identity-Aware Proxy (IAP)
1
2
A comprehensive Python library for managing Google Cloud Identity-Aware Proxy (IAP), which enables developers to protect access to Google Cloud hosted resources and applications. The library provides programmatic access to IAP policies, OAuth brand/client management, tunnel destination groups, and authentication flows through Google's zero-trust security model.
3
4
## Package Information
5
6
- **Package Name**: google-cloud-iap
7
- **Package Type**: pypi
8
- **Language**: Python
9
- **Installation**: `pip install google-cloud-iap`
10
- **Python Support**: Python >= 3.7
11
12
## Core Imports
13
14
```python
15
from google.cloud.iap import IdentityAwareProxyAdminServiceClient
16
from google.cloud.iap import IdentityAwareProxyOAuthServiceClient
17
```
18
19
For async clients:
20
21
```python
22
from google.cloud.iap import IdentityAwareProxyAdminServiceAsyncClient
23
from google.cloud.iap import IdentityAwareProxyOAuthServiceAsyncClient
24
```
25
26
Import data types:
27
28
```python
29
from google.cloud.iap import (
30
IapSettings,
31
AccessSettings,
32
Brand,
33
IdentityAwareProxyClient,
34
TunnelDestGroup
35
)
36
```
37
38
Import retry constants:
39
40
```python
41
from google.api_core.retry import Retry
42
from google.api_core import gapic_v1
43
44
DEFAULT = gapic_v1.method.DEFAULT # Default retry and timeout behavior
45
```
46
47
## Basic Usage
48
49
```python
50
from google.cloud.iap import IdentityAwareProxyAdminServiceClient
51
from google.cloud.iap import GetIapSettingsRequest
52
53
# Initialize the Admin client
54
client = IdentityAwareProxyAdminServiceClient()
55
56
# Get IAP settings for a resource
57
resource_name = "projects/my-project/iap_web/compute/services/my-service"
58
request = GetIapSettingsRequest(name=resource_name)
59
settings = client.get_iap_settings(request=request)
60
61
print(f"IAP settings for {resource_name}:")
62
print(f"Access settings: {settings.access_settings}")
63
print(f"Application settings: {settings.application_settings}")
64
```
65
66
```python
67
from google.cloud.iap import IdentityAwareProxyOAuthServiceClient
68
from google.cloud.iap import ListBrandsRequest
69
70
# Initialize the OAuth client
71
oauth_client = IdentityAwareProxyOAuthServiceClient()
72
73
# List OAuth brands for a project
74
project_path = "projects/my-project"
75
request = ListBrandsRequest(parent=project_path)
76
response = oauth_client.list_brands(request=request)
77
78
for brand in response.brands:
79
print(f"Brand: {brand.name}")
80
print(f"Application title: {brand.application_title}")
81
print(f"Support email: {brand.support_email}")
82
```
83
84
### Async Client Usage
85
86
```python
87
import asyncio
88
from google.cloud.iap import IdentityAwareProxyOAuthServiceAsyncClient
89
from google.cloud.iap import ListBrandsRequest
90
91
async def list_brands_async():
92
# Initialize async OAuth client
93
async_client = IdentityAwareProxyOAuthServiceAsyncClient()
94
95
# List OAuth brands asynchronously
96
project_path = "projects/my-project"
97
request = ListBrandsRequest(parent=project_path)
98
response = await async_client.list_brands(request=request)
99
100
for brand in response.brands:
101
print(f"Brand: {brand.name}")
102
print(f"Support email: {brand.support_email}")
103
104
# Run async function
105
asyncio.run(list_brands_async())
106
```
107
108
## Architecture
109
110
The google-cloud-iap library provides two main service clients that correspond to different aspects of IAP management:
111
112
- **Admin Service**: Manages IAP settings, access policies, tunnel destination groups, and IAM permissions
113
- **OAuth Service**: Manages OAuth brands and OAuth clients for IAP authentication flows
114
115
Both services support synchronous and asynchronous operation modes, with automatic retry handling, credential management, and built-in logging capabilities for production environments.
116
117
The library follows Google Cloud client library patterns with:
118
- **Transport abstraction**: Supports gRPC and REST transports
119
- **Automatic retry**: Built-in retry logic for transient failures
120
- **Authentication**: Automatic credential discovery and management
121
- **Pagination**: Helper classes for paginated API responses
122
- **Path helpers**: Utility methods for constructing resource names
123
124
## Capabilities
125
126
### IAP Administration
127
128
Comprehensive IAP settings management including access controls, application settings, tunnel destination groups, and IAM policy operations. This includes configuring authentication methods, access restrictions, CORS settings, and custom access denied pages.
129
130
```python { .api }
131
class IdentityAwareProxyAdminServiceClient:
132
def get_iap_settings(self, request, *, retry=DEFAULT, timeout=DEFAULT, metadata=()) -> IapSettings: ...
133
def update_iap_settings(self, request, *, retry=DEFAULT, timeout=DEFAULT, metadata=()) -> IapSettings: ...
134
def validate_iap_attribute_expression(self, request, *, retry=DEFAULT, timeout=DEFAULT, metadata=()) -> ValidateIapAttributeExpressionResponse: ...
135
def list_tunnel_dest_groups(self, request, *, parent=None, retry=DEFAULT, timeout=DEFAULT, metadata=()) -> ListTunnelDestGroupsPager: ...
136
def create_tunnel_dest_group(self, request, *, parent=None, tunnel_dest_group=None, tunnel_dest_group_id=None, retry=DEFAULT, timeout=DEFAULT, metadata=()) -> TunnelDestGroup: ...
137
def get_tunnel_dest_group(self, request, *, name=None, retry=DEFAULT, timeout=DEFAULT, metadata=()) -> TunnelDestGroup: ...
138
def update_tunnel_dest_group(self, request, *, tunnel_dest_group=None, update_mask=None, retry=DEFAULT, timeout=DEFAULT, metadata=()) -> TunnelDestGroup: ...
139
def delete_tunnel_dest_group(self, request, *, name=None, retry=DEFAULT, timeout=DEFAULT, metadata=()) -> None: ...
140
```
141
142
[IAP Administration](./iap-admin.md)
143
144
### OAuth Brand and Client Management
145
146
Programmatic creation, management, and configuration of IAP OAuth brands and OAuth clients. This includes creating OAuth applications, managing client secrets, and configuring OAuth flows for IAP authentication.
147
148
```python { .api }
149
class IdentityAwareProxyOAuthServiceClient:
150
def list_brands(self, request, *, retry=DEFAULT, timeout=DEFAULT, metadata=()) -> ListBrandsResponse: ...
151
def create_brand(self, request, *, retry=DEFAULT, timeout=DEFAULT, metadata=()) -> Brand: ...
152
def get_brand(self, request, *, name=None, retry=DEFAULT, timeout=DEFAULT, metadata=()) -> Brand: ...
153
def create_identity_aware_proxy_client(self, request, *, retry=DEFAULT, timeout=DEFAULT, metadata=()) -> IdentityAwareProxyClient: ...
154
def list_identity_aware_proxy_clients(self, request, *, retry=DEFAULT, timeout=DEFAULT, metadata=()) -> ListIdentityAwareProxyClientsPager: ...
155
def get_identity_aware_proxy_client(self, request, *, name=None, retry=DEFAULT, timeout=DEFAULT, metadata=()) -> IdentityAwareProxyClient: ...
156
def reset_identity_aware_proxy_client_secret(self, request, *, retry=DEFAULT, timeout=DEFAULT, metadata=()) -> IdentityAwareProxyClient: ...
157
def delete_identity_aware_proxy_client(self, request, *, name=None, retry=DEFAULT, timeout=DEFAULT, metadata=()) -> None: ...
158
```
159
160
[OAuth Management](./oauth-management.md)
161
162
### IAM Policy Management
163
164
Standard Google Cloud IAM operations for IAP resources, including setting policies, getting policies, and testing permissions on IAP-protected resources.
165
166
```python { .api }
167
class IdentityAwareProxyAdminServiceClient:
168
def set_iam_policy(self, request, *, retry=DEFAULT, timeout=DEFAULT, metadata=()) -> policy_pb2.Policy: ...
169
def get_iam_policy(self, request, *, retry=DEFAULT, timeout=DEFAULT, metadata=()) -> policy_pb2.Policy: ...
170
def test_iam_permissions(self, request, *, retry=DEFAULT, timeout=DEFAULT, metadata=()) -> iam_policy_pb2.TestIamPermissionsResponse: ...
171
```
172
173
[IAM Policy Management](./iam-policies.md)
174
175
## Types
176
177
### Core Configuration Types
178
179
```python { .api }
180
class IapSettings:
181
"""The IAP configurable settings."""
182
name: str
183
access_settings: AccessSettings
184
application_settings: ApplicationSettings
185
186
class AccessSettings:
187
"""Access related settings for IAP protected apps."""
188
gcip_settings: GcipSettings
189
cors_settings: CorsSettings
190
oauth_settings: OAuthSettings
191
reauth_settings: ReauthSettings
192
allowed_domains_settings: AllowedDomainsSettings
193
workforce_identity_settings: WorkforceIdentitySettings
194
identity_sources: List[IdentitySource]
195
196
class IdentitySource(Enum):
197
IDENTITY_SOURCE_UNSPECIFIED = 0
198
WORKFORCE_IDENTITY_FEDERATION = 3
199
200
class ApplicationSettings:
201
"""Wrapper over application specific settings for IAP."""
202
csm_settings: CsmSettings
203
access_denied_page_settings: AccessDeniedPageSettings
204
cookie_domain: wrappers_pb2.StringValue
205
attribute_propagation_settings: AttributePropagationSettings
206
```
207
208
### Resource Types
209
210
```python { .api }
211
class Brand:
212
"""OAuth brand data."""
213
name: str # Output only
214
support_email: str
215
application_title: str
216
org_internal_only: bool # Output only
217
218
class IdentityAwareProxyClient:
219
"""IAP OAuth client data."""
220
name: str # Output only
221
secret: str # Output only
222
display_name: str
223
224
class TunnelDestGroup:
225
"""A tunnel destination group."""
226
name: str
227
cidrs: List[str] # Optional
228
fqdns: List[str] # Optional
229
```