var (
	AccessSettings_IdentitySource_name = map[int32]string{
		0: "IDENTITY_SOURCE_UNSPECIFIED",
		3: "WORKFORCE_IDENTITY_FEDERATION",
	}
	AccessSettings_IdentitySource_value = map[string]int32{
		"IDENTITY_SOURCE_UNSPECIFIED":   0,
		"WORKFORCE_IDENTITY_FEDERATION": 3,
	}
)

var (
	ReauthSettings_Method_name = map[int32]string{
		0: "METHOD_UNSPECIFIED",
		1: "LOGIN",
		2: "PASSWORD",
		3: "SECURE_KEY",
		4: "ENROLLED_SECOND_FACTORS",
	}
	ReauthSettings_Method_value = map[string]int32{
		"METHOD_UNSPECIFIED":      0,
		"LOGIN":                   1,
		"PASSWORD":                2,
		"SECURE_KEY":              3,
		"ENROLLED_SECOND_FACTORS": 4,
	}
)

var (
	ReauthSettings_PolicyType_name = map[int32]string{
		0: "POLICY_TYPE_UNSPECIFIED",
		1: "MINIMUM",
		2: "DEFAULT",
	}
	ReauthSettings_PolicyType_value = map[string]int32{
		"POLICY_TYPE_UNSPECIFIED": 0,
		"MINIMUM":                 1,
		"DEFAULT":                 2,
	}
)

var (
	AttributePropagationSettings_OutputCredentials_name = map[int32]string{
		0: "OUTPUT_CREDENTIALS_UNSPECIFIED",
		1: "HEADER",
		2: "JWT",
		3: "RCTOKEN",
	}
	AttributePropagationSettings_OutputCredentials_value = map[string]int32{
		"OUTPUT_CREDENTIALS_UNSPECIFIED": 0,
		"HEADER":                         1,
		"JWT":                            2,
		"RCTOKEN":                        3,
	}
)

var File_google_cloud_iap_v1_service_proto protoreflect.FileDescriptor

type AccessDeniedPageSettings struct {

	// The URI to be redirected to when access is denied.
	AccessDeniedPageUri *wrapperspb.StringValue `protobuf:"bytes,1,opt,name=access_denied_page_uri,json=accessDeniedPageUri,proto3" json:"access_denied_page_uri,omitempty"`
	// Whether to generate a troubleshooting URL on access denied events to this
	// application.
	GenerateTroubleshootingUri *wrapperspb.BoolValue `protobuf:"bytes,2,opt,name=generate_troubleshooting_uri,json=generateTroubleshootingUri,proto3" json:"generate_troubleshooting_uri,omitempty"`
	// Whether to generate remediation token on access denied events to this
	// application.
	RemediationTokenGenerationEnabled *wrapperspb.BoolValue `protobuf:"bytes,3,opt,name=remediation_token_generation_enabled,json=remediationTokenGenerationEnabled,proto3,oneof" json:"remediation_token_generation_enabled,omitempty"`
	// contains filtered or unexported fields
}

type AccessSettings struct {

	// Optional. GCIP claims and endpoint configurations for 3p identity
	// providers.
	GcipSettings *GcipSettings `protobuf:"bytes,1,opt,name=gcip_settings,json=gcipSettings,proto3" json:"gcip_settings,omitempty"`
	// Optional. Configuration to allow cross-origin requests via IAP.
	CorsSettings *CorsSettings `protobuf:"bytes,2,opt,name=cors_settings,json=corsSettings,proto3" json:"cors_settings,omitempty"`
	// Optional. Settings to configure IAP's OAuth behavior.
	OauthSettings *OAuthSettings `protobuf:"bytes,3,opt,name=oauth_settings,json=oauthSettings,proto3" json:"oauth_settings,omitempty"`
	// Optional. Settings to configure reauthentication policies in IAP.
	ReauthSettings *ReauthSettings `protobuf:"bytes,6,opt,name=reauth_settings,json=reauthSettings,proto3" json:"reauth_settings,omitempty"`
	// Optional. Settings to configure and enable allowed domains.
	AllowedDomainsSettings *AllowedDomainsSettings `protobuf:"bytes,7,opt,name=allowed_domains_settings,json=allowedDomainsSettings,proto3" json:"allowed_domains_settings,omitempty"`
	// Optional. Settings to configure the workforce identity federation,
	// including workforce pools and OAuth 2.0 settings.
	WorkforceIdentitySettings *WorkforceIdentitySettings `protobuf:"bytes,9,opt,name=workforce_identity_settings,json=workforceIdentitySettings,proto3" json:"workforce_identity_settings,omitempty"`
	// Optional. Identity sources that IAP can use to authenticate the end user.
	// Only one identity source can be configured.
	IdentitySources []AccessSettings_IdentitySource `protobuf:"varint,10,rep,packed,name=identity_sources,json=identitySources,proto3,enum=google.cloud.iap.v1.AccessSettings_IdentitySource" json:"identity_sources,omitempty"`
	// contains filtered or unexported fields
}

type AccessSettings_IdentitySource int32

const (
	// IdentitySource Unspecified.
	// When selected, IAP relies on which identity settings are fully configured
	// to redirect the traffic to. The precedence order is
	// WorkforceIdentitySettings > GcipSettings. If none is set, default to use
	// Google identity.
	AccessSettings_IDENTITY_SOURCE_UNSPECIFIED AccessSettings_IdentitySource = 0
	// Use external identities set up on Google Cloud Workforce Identity
	// Federation.
	AccessSettings_WORKFORCE_IDENTITY_FEDERATION AccessSettings_IdentitySource = 3
)

type AllowedDomainsSettings struct {

	// Optional. Configuration for customers to opt in for the feature.
	Enable *bool `protobuf:"varint,1,opt,name=enable,proto3,oneof" json:"enable,omitempty"`
	// Optional. List of trusted domains.
	Domains []string `protobuf:"bytes,2,rep,name=domains,proto3" json:"domains,omitempty"`
	// contains filtered or unexported fields
}

type ApplicationSettings struct {

	// Optional. Settings to configure IAP's behavior for a service mesh.
	CsmSettings *CsmSettings `protobuf:"bytes,1,opt,name=csm_settings,json=csmSettings,proto3" json:"csm_settings,omitempty"`
	// Optional. Customization for Access Denied page.
	AccessDeniedPageSettings *AccessDeniedPageSettings `protobuf:"bytes,2,opt,name=access_denied_page_settings,json=accessDeniedPageSettings,proto3" json:"access_denied_page_settings,omitempty"`
	// The Domain value to set for cookies generated by IAP. This value is not
	// validated by the API, but will be ignored at runtime if invalid.
	CookieDomain *wrapperspb.StringValue `protobuf:"bytes,3,opt,name=cookie_domain,json=cookieDomain,proto3" json:"cookie_domain,omitempty"`
	// Optional. Settings to configure attribute propagation.
	AttributePropagationSettings *AttributePropagationSettings `protobuf:"bytes,4,opt,name=attribute_propagation_settings,json=attributePropagationSettings,proto3" json:"attribute_propagation_settings,omitempty"`
	// contains filtered or unexported fields
}

type AttributePropagationSettings struct {

	// Optional. Raw string CEL expression. Must return a list of attributes. A
	// maximum of 45 attributes can be selected. Expressions can select different
	// attribute types from `attributes`: `attributes.saml_attributes`,
	// `attributes.iap_attributes`. The following functions are supported:
	//
	//   - filter `<list>.filter(<iter_var>, <predicate>)`: Returns a subset of
	//     `<list>` where `<predicate>` is true for every item.
	//
	//   - in `<var> in <list>`: Returns true if `<list>` contains `<var>`.
	//
	//   - selectByName `<list>.selectByName(<string>)`: Returns the attribute
	//     in
	//     `<list>` with the given `<string>` name, otherwise returns empty.
	//
	//   - emitAs `<attribute>.emitAs(<string>)`: Sets the `<attribute>` name
	//     field to the given `<string>` for propagation in selected output
	//     credentials.
	//
	//   - strict `<attribute>.strict()`: Ignores the `x-goog-iap-attr-` prefix
	//     for the provided `<attribute>` when propagating with the `HEADER` output
	//     credential, such as request headers.
	//
	//   - append `<target_list>.append(<attribute>)` OR
	//     `<target_list>.append(<list>)`: Appends the provided `<attribute>` or
	//     `<list>` to the end of `<target_list>`.
	//
	// Example expression: `attributes.saml_attributes.filter(x, x.name in
	// ['test']).append(attributes.iap_attributes.selectByName('exact').emitAs('custom').strict())`
	Expression *string `protobuf:"bytes,1,opt,name=expression,proto3,oneof" json:"expression,omitempty"`
	// Optional. Which output credentials attributes selected by the CEL
	// expression should be propagated in. All attributes will be fully duplicated
	// in each selected output credential.
	OutputCredentials []AttributePropagationSettings_OutputCredentials `protobuf:"varint,2,rep,packed,name=output_credentials,json=outputCredentials,proto3,enum=google.cloud.iap.v1.AttributePropagationSettings_OutputCredentials" json:"output_credentials,omitempty"`
	// Optional. Whether the provided attribute propagation settings should be
	// evaluated on user requests. If set to true, attributes returned from the
	// expression will be propagated in the set output credentials.
	Enable *bool `protobuf:"varint,3,opt,name=enable,proto3,oneof" json:"enable,omitempty"`
	// contains filtered or unexported fields
}

type AttributePropagationSettings_OutputCredentials int32

const (
	// An output credential is required.
	AttributePropagationSettings_OUTPUT_CREDENTIALS_UNSPECIFIED AttributePropagationSettings_OutputCredentials = 0
	// Propagate attributes in the headers with "x-goog-iap-attr-" prefix.
	AttributePropagationSettings_HEADER AttributePropagationSettings_OutputCredentials = 1
	// Propagate attributes in the JWT of the form: `"additional_claims": {
	// "my_attribute": ["value1", "value2"] }`
	AttributePropagationSettings_JWT AttributePropagationSettings_OutputCredentials = 2
	// Propagate attributes in the RCToken of the form: `"additional_claims": {
	// "my_attribute": ["value1", "value2"] }`
	AttributePropagationSettings_RCTOKEN AttributePropagationSettings_OutputCredentials = 3
)

type Brand struct {

	// Output only. Identifier of the brand.
	// NOTE: GCP project number achieves the same brand identification purpose as
	// only one brand per project can be created.
	Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
	// Support email displayed on the OAuth consent screen.
	SupportEmail string `protobuf:"bytes,2,opt,name=support_email,json=supportEmail,proto3" json:"support_email,omitempty"`
	// Application name displayed on OAuth consent screen.
	ApplicationTitle string `protobuf:"bytes,3,opt,name=application_title,json=applicationTitle,proto3" json:"application_title,omitempty"`
	// Output only. Whether the brand is only intended for usage inside the
	// G Suite organization only.
	OrgInternalOnly bool `protobuf:"varint,4,opt,name=org_internal_only,json=orgInternalOnly,proto3" json:"org_internal_only,omitempty"`
	// contains filtered or unexported fields
}

type CorsSettings struct {

	// Configuration to allow HTTP `OPTIONS` calls to skip
	// authentication and authorization. If undefined, IAP will not apply any
	// special logic to `OPTIONS` requests.
	AllowHttpOptions *wrapperspb.BoolValue `protobuf:"bytes,1,opt,name=allow_http_options,json=allowHttpOptions,proto3" json:"allow_http_options,omitempty"`
	// contains filtered or unexported fields
}

type CreateBrandRequest struct {

	// Required. GCP Project number/id under which the brand is to be created.
	// In the following format: projects/{project_number/id}.
	Parent string `protobuf:"bytes,1,opt,name=parent,proto3" json:"parent,omitempty"`
	// Required. The brand to be created.
	Brand *Brand `protobuf:"bytes,2,opt,name=brand,proto3" json:"brand,omitempty"`
	// contains filtered or unexported fields
}

type CreateIdentityAwareProxyClientRequest struct {

	// Required. Path to create the client in.
	// In the following format:
	// projects/{project_number/id}/brands/{brand}.
	// The project must belong to a G Suite account.
	Parent string `protobuf:"bytes,1,opt,name=parent,proto3" json:"parent,omitempty"`
	// Required. Identity Aware Proxy Client to be created.
	IdentityAwareProxyClient *IdentityAwareProxyClient `protobuf:"bytes,2,opt,name=identity_aware_proxy_client,json=identityAwareProxyClient,proto3" json:"identity_aware_proxy_client,omitempty"`
	// contains filtered or unexported fields
}

type CreateTunnelDestGroupRequest struct {

	// Required. Google Cloud Project ID and location.
	// In the following format:
	// `projects/{project_number/id}/iap_tunnel/locations/{location}`.
	Parent string `protobuf:"bytes,1,opt,name=parent,proto3" json:"parent,omitempty"`
	// Required. The TunnelDestGroup to create.
	TunnelDestGroup *TunnelDestGroup `protobuf:"bytes,2,opt,name=tunnel_dest_group,json=tunnelDestGroup,proto3" json:"tunnel_dest_group,omitempty"`
	// Required. The ID to use for the TunnelDestGroup, which becomes the final
	// component of the resource name.
	//
	// This value must be 4-63 characters, and valid characters
	// are `[a-z]-`.
	TunnelDestGroupId string `protobuf:"bytes,3,opt,name=tunnel_dest_group_id,json=tunnelDestGroupId,proto3" json:"tunnel_dest_group_id,omitempty"`
	// contains filtered or unexported fields
}

type CsmSettings struct {

	// Audience claim set in the generated RCToken. This value is not validated by
	// IAP.
	RctokenAud *wrapperspb.StringValue `protobuf:"bytes,1,opt,name=rctoken_aud,json=rctokenAud,proto3" json:"rctoken_aud,omitempty"`
	// contains filtered or unexported fields
}

type DeleteIdentityAwareProxyClientRequest struct {

	// Required. Name of the Identity Aware Proxy client to be deleted.
	// In the following format:
	// projects/{project_number/id}/brands/{brand}/identityAwareProxyClients/{client_id}.
	Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
	// contains filtered or unexported fields
}

type DeleteTunnelDestGroupRequest struct {

	// Required. Name of the TunnelDestGroup to delete.
	// In the following format:
	// `projects/{project_number/id}/iap_tunnel/locations/{location}/destGroups/{dest_group}`.
	Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
	// contains filtered or unexported fields
}

type GcipSettings struct {

	// Optional. GCIP tenant IDs that are linked to the IAP resource. `tenant_ids`
	// could be a string beginning with a number character to indicate
	// authenticating with GCIP tenant flow, or in the format of
	// `_<ProjectNumber>` to indicate authenticating with GCIP agent flow. If
	// agent flow is used, `tenant_ids` should only contain one single element,
	// while for tenant flow, `tenant_ids` can contain multiple elements.
	TenantIds []string `protobuf:"bytes,1,rep,name=tenant_ids,json=tenantIds,proto3" json:"tenant_ids,omitempty"`
	// Login page URI associated with the GCIP tenants.
	// Typically, all resources within the same project share the same login page,
	// though it could be overridden at the sub resource level.
	LoginPageUri *wrapperspb.StringValue `protobuf:"bytes,2,opt,name=login_page_uri,json=loginPageUri,proto3" json:"login_page_uri,omitempty"`
	// contains filtered or unexported fields
}

type GetBrandRequest struct {

	// Required. Name of the brand to be fetched.
	// In the following format: projects/{project_number/id}/brands/{brand}.
	Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
	// contains filtered or unexported fields
}

type GetIapSettingsRequest struct {

	// Required. The resource name for which to retrieve the settings.
	// Authorization: Requires the `getSettings` permission for the associated
	// resource.
	Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
	// contains filtered or unexported fields
}

type GetIdentityAwareProxyClientRequest struct {

	// Required. Name of the Identity Aware Proxy client to be fetched.
	// In the following format:
	// projects/{project_number/id}/brands/{brand}/identityAwareProxyClients/{client_id}.
	Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
	// contains filtered or unexported fields
}

type GetTunnelDestGroupRequest struct {

	// Required. Name of the TunnelDestGroup to be fetched.
	// In the following format:
	// `projects/{project_number/id}/iap_tunnel/locations/{location}/destGroups/{dest_group}`.
	Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
	// contains filtered or unexported fields
}

type IapSettings struct {

	// Required. The resource name of the IAP protected resource.
	Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
	// Optional. Top level wrapper for all access related setting in IAP
	AccessSettings *AccessSettings `protobuf:"bytes,5,opt,name=access_settings,json=accessSettings,proto3" json:"access_settings,omitempty"`
	// Optional. Top level wrapper for all application related settings in IAP
	ApplicationSettings *ApplicationSettings `protobuf:"bytes,6,opt,name=application_settings,json=applicationSettings,proto3" json:"application_settings,omitempty"`
	// contains filtered or unexported fields
}

type IdentityAwareProxyAdminServiceClient interface {
	// Sets the access control policy for an Identity-Aware Proxy protected
	// resource. Replaces any existing policy.
	// More information about managing access via IAP can be found at:
	// https://cloud.google.com/iap/docs/managing-access#managing_access_via_the_api
	SetIamPolicy(ctx context.Context, in *iampb.SetIamPolicyRequest, opts ...grpc.CallOption) (*iampb.Policy, error)
	// Gets the access control policy for an Identity-Aware Proxy protected
	// resource.
	// More information about managing access via IAP can be found at:
	// https://cloud.google.com/iap/docs/managing-access#managing_access_via_the_api
	GetIamPolicy(ctx context.Context, in *iampb.GetIamPolicyRequest, opts ...grpc.CallOption) (*iampb.Policy, error)
	// Returns permissions that a caller has on the Identity-Aware Proxy protected
	// resource.
	// More information about managing access via IAP can be found at:
	// https://cloud.google.com/iap/docs/managing-access#managing_access_via_the_api
	TestIamPermissions(ctx context.Context, in *iampb.TestIamPermissionsRequest, opts ...grpc.CallOption) (*iampb.TestIamPermissionsResponse, error)
	// Gets the IAP settings on a particular IAP protected resource.
	GetIapSettings(ctx context.Context, in *GetIapSettingsRequest, opts ...grpc.CallOption) (*IapSettings, error)
	// Updates the IAP settings on a particular IAP protected resource. It
	// replaces all fields unless the `update_mask` is set.
	UpdateIapSettings(ctx context.Context, in *UpdateIapSettingsRequest, opts ...grpc.CallOption) (*IapSettings, error)
	// Validates that a given CEL expression conforms to IAP restrictions.
	ValidateIapAttributeExpression(ctx context.Context, in *ValidateIapAttributeExpressionRequest, opts ...grpc.CallOption) (*ValidateIapAttributeExpressionResponse, error)
	// Lists the existing TunnelDestGroups. To group across all locations, use a
	// `-` as the location ID. For example:
	// `/v1/projects/123/iap_tunnel/locations/-/destGroups`
	ListTunnelDestGroups(ctx context.Context, in *ListTunnelDestGroupsRequest, opts ...grpc.CallOption) (*ListTunnelDestGroupsResponse, error)
	// Creates a new TunnelDestGroup.
	CreateTunnelDestGroup(ctx context.Context, in *CreateTunnelDestGroupRequest, opts ...grpc.CallOption) (*TunnelDestGroup, error)
	// Retrieves an existing TunnelDestGroup.
	GetTunnelDestGroup(ctx context.Context, in *GetTunnelDestGroupRequest, opts ...grpc.CallOption) (*TunnelDestGroup, error)
	// Deletes a TunnelDestGroup.
	DeleteTunnelDestGroup(ctx context.Context, in *DeleteTunnelDestGroupRequest, opts ...grpc.CallOption) (*emptypb.Empty, error)
	// Updates a TunnelDestGroup.
	UpdateTunnelDestGroup(ctx context.Context, in *UpdateTunnelDestGroupRequest, opts ...grpc.CallOption) (*TunnelDestGroup, error)
}

type IdentityAwareProxyAdminServiceServer interface {
	// Sets the access control policy for an Identity-Aware Proxy protected
	// resource. Replaces any existing policy.
	// More information about managing access via IAP can be found at:
	// https://cloud.google.com/iap/docs/managing-access#managing_access_via_the_api
	SetIamPolicy(context.Context, *iampb.SetIamPolicyRequest) (*iampb.Policy, error)
	// Gets the access control policy for an Identity-Aware Proxy protected
	// resource.
	// More information about managing access via IAP can be found at:
	// https://cloud.google.com/iap/docs/managing-access#managing_access_via_the_api
	GetIamPolicy(context.Context, *iampb.GetIamPolicyRequest) (*iampb.Policy, error)
	// Returns permissions that a caller has on the Identity-Aware Proxy protected
	// resource.
	// More information about managing access via IAP can be found at:
	// https://cloud.google.com/iap/docs/managing-access#managing_access_via_the_api
	TestIamPermissions(context.Context, *iampb.TestIamPermissionsRequest) (*iampb.TestIamPermissionsResponse, error)
	// Gets the IAP settings on a particular IAP protected resource.
	GetIapSettings(context.Context, *GetIapSettingsRequest) (*IapSettings, error)
	// Updates the IAP settings on a particular IAP protected resource. It
	// replaces all fields unless the `update_mask` is set.
	UpdateIapSettings(context.Context, *UpdateIapSettingsRequest) (*IapSettings, error)
	// Validates that a given CEL expression conforms to IAP restrictions.
	ValidateIapAttributeExpression(context.Context, *ValidateIapAttributeExpressionRequest) (*ValidateIapAttributeExpressionResponse, error)
	// Lists the existing TunnelDestGroups. To group across all locations, use a
	// `-` as the location ID. For example:
	// `/v1/projects/123/iap_tunnel/locations/-/destGroups`
	ListTunnelDestGroups(context.Context, *ListTunnelDestGroupsRequest) (*ListTunnelDestGroupsResponse, error)
	// Creates a new TunnelDestGroup.
	CreateTunnelDestGroup(context.Context, *CreateTunnelDestGroupRequest) (*TunnelDestGroup, error)
	// Retrieves an existing TunnelDestGroup.
	GetTunnelDestGroup(context.Context, *GetTunnelDestGroupRequest) (*TunnelDestGroup, error)
	// Deletes a TunnelDestGroup.
	DeleteTunnelDestGroup(context.Context, *DeleteTunnelDestGroupRequest) (*emptypb.Empty, error)
	// Updates a TunnelDestGroup.
	UpdateTunnelDestGroup(context.Context, *UpdateTunnelDestGroupRequest) (*TunnelDestGroup, error)
}

type IdentityAwareProxyClient struct {

	// Output only. Unique identifier of the OAuth client.
	Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
	// Output only. Client secret of the OAuth client.
	Secret string `protobuf:"bytes,2,opt,name=secret,proto3" json:"secret,omitempty"`
	// Human-friendly name given to the OAuth client.
	DisplayName string `protobuf:"bytes,3,opt,name=display_name,json=displayName,proto3" json:"display_name,omitempty"`
	// contains filtered or unexported fields
}

type IdentityAwareProxyOAuthServiceClient interface {
	// Lists the existing brands for the project.
	ListBrands(ctx context.Context, in *ListBrandsRequest, opts ...grpc.CallOption) (*ListBrandsResponse, error)
	// Constructs a new OAuth brand for the project if one does not exist.
	// The created brand is "internal only", meaning that OAuth clients created
	// under it only accept requests from users who belong to the same Google
	// Workspace organization as the project. The brand is created in an
	// un-reviewed status. NOTE: The "internal only" status can be manually
	// changed in the Google Cloud Console. Requires that a brand does not already
	// exist for the project, and that the specified support email is owned by the
	// caller.
	CreateBrand(ctx context.Context, in *CreateBrandRequest, opts ...grpc.CallOption) (*Brand, error)
	// Retrieves the OAuth brand of the project.
	GetBrand(ctx context.Context, in *GetBrandRequest, opts ...grpc.CallOption) (*Brand, error)
	// Creates an Identity Aware Proxy (IAP) OAuth client. The client is owned
	// by IAP. Requires that the brand for the project exists and that it is
	// set for internal-only use.
	CreateIdentityAwareProxyClient(ctx context.Context, in *CreateIdentityAwareProxyClientRequest, opts ...grpc.CallOption) (*IdentityAwareProxyClient, error)
	// Lists the existing clients for the brand.
	ListIdentityAwareProxyClients(ctx context.Context, in *ListIdentityAwareProxyClientsRequest, opts ...grpc.CallOption) (*ListIdentityAwareProxyClientsResponse, error)
	// Retrieves an Identity Aware Proxy (IAP) OAuth client.
	// Requires that the client is owned by IAP.
	GetIdentityAwareProxyClient(ctx context.Context, in *GetIdentityAwareProxyClientRequest, opts ...grpc.CallOption) (*IdentityAwareProxyClient, error)
	// Resets an Identity Aware Proxy (IAP) OAuth client secret. Useful if the
	// secret was compromised. Requires that the client is owned by IAP.
	ResetIdentityAwareProxyClientSecret(ctx context.Context, in *ResetIdentityAwareProxyClientSecretRequest, opts ...grpc.CallOption) (*IdentityAwareProxyClient, error)
	// Deletes an Identity Aware Proxy (IAP) OAuth client. Useful for removing
	// obsolete clients, managing the number of clients in a given project, and
	// cleaning up after tests. Requires that the client is owned by IAP.
	DeleteIdentityAwareProxyClient(ctx context.Context, in *DeleteIdentityAwareProxyClientRequest, opts ...grpc.CallOption) (*emptypb.Empty, error)
}

type IdentityAwareProxyOAuthServiceServer interface {
	// Lists the existing brands for the project.
	ListBrands(context.Context, *ListBrandsRequest) (*ListBrandsResponse, error)
	// Constructs a new OAuth brand for the project if one does not exist.
	// The created brand is "internal only", meaning that OAuth clients created
	// under it only accept requests from users who belong to the same Google
	// Workspace organization as the project. The brand is created in an
	// un-reviewed status. NOTE: The "internal only" status can be manually
	// changed in the Google Cloud Console. Requires that a brand does not already
	// exist for the project, and that the specified support email is owned by the
	// caller.
	CreateBrand(context.Context, *CreateBrandRequest) (*Brand, error)
	// Retrieves the OAuth brand of the project.
	GetBrand(context.Context, *GetBrandRequest) (*Brand, error)
	// Creates an Identity Aware Proxy (IAP) OAuth client. The client is owned
	// by IAP. Requires that the brand for the project exists and that it is
	// set for internal-only use.
	CreateIdentityAwareProxyClient(context.Context, *CreateIdentityAwareProxyClientRequest) (*IdentityAwareProxyClient, error)
	// Lists the existing clients for the brand.
	ListIdentityAwareProxyClients(context.Context, *ListIdentityAwareProxyClientsRequest) (*ListIdentityAwareProxyClientsResponse, error)
	// Retrieves an Identity Aware Proxy (IAP) OAuth client.
	// Requires that the client is owned by IAP.
	GetIdentityAwareProxyClient(context.Context, *GetIdentityAwareProxyClientRequest) (*IdentityAwareProxyClient, error)
	// Resets an Identity Aware Proxy (IAP) OAuth client secret. Useful if the
	// secret was compromised. Requires that the client is owned by IAP.
	ResetIdentityAwareProxyClientSecret(context.Context, *ResetIdentityAwareProxyClientSecretRequest) (*IdentityAwareProxyClient, error)
	// Deletes an Identity Aware Proxy (IAP) OAuth client. Useful for removing
	// obsolete clients, managing the number of clients in a given project, and
	// cleaning up after tests. Requires that the client is owned by IAP.
	DeleteIdentityAwareProxyClient(context.Context, *DeleteIdentityAwareProxyClientRequest) (*emptypb.Empty, error)
}

type ListBrandsRequest struct {

	// Required. GCP Project number/id.
	// In the following format: projects/{project_number/id}.
	Parent string `protobuf:"bytes,1,opt,name=parent,proto3" json:"parent,omitempty"`
	// contains filtered or unexported fields
}

type ListBrandsResponse struct {

	// Brands existing in the project.
	Brands []*Brand `protobuf:"bytes,1,rep,name=brands,proto3" json:"brands,omitempty"`
	// contains filtered or unexported fields
}

type ListIdentityAwareProxyClientsRequest struct {

	// Required. Full brand path.
	// In the following format: projects/{project_number/id}/brands/{brand}.
	Parent string `protobuf:"bytes,1,opt,name=parent,proto3" json:"parent,omitempty"`
	// The maximum number of clients to return. The service may return fewer than
	// this value.
	// If unspecified, at most 100 clients will be returned.
	// The maximum value is 1000; values above 1000 will be coerced to 1000.
	PageSize int32 `protobuf:"varint,2,opt,name=page_size,json=pageSize,proto3" json:"page_size,omitempty"`
	// A page token, received from a previous `ListIdentityAwareProxyClients`
	// call. Provide this to retrieve the subsequent page.
	//
	// When paginating, all other parameters provided to
	// `ListIdentityAwareProxyClients` must match the call that provided the page
	// token.
	PageToken string `protobuf:"bytes,3,opt,name=page_token,json=pageToken,proto3" json:"page_token,omitempty"`
	// contains filtered or unexported fields
}

type ListIdentityAwareProxyClientsResponse struct {

	// Clients existing in the brand.
	IdentityAwareProxyClients []*IdentityAwareProxyClient `protobuf:"bytes,1,rep,name=identity_aware_proxy_clients,json=identityAwareProxyClients,proto3" json:"identity_aware_proxy_clients,omitempty"`
	// A token, which can be send as `page_token` to retrieve the next page.
	// If this field is omitted, there are no subsequent pages.
	NextPageToken string `protobuf:"bytes,2,opt,name=next_page_token,json=nextPageToken,proto3" json:"next_page_token,omitempty"`
	// contains filtered or unexported fields
}

type ListTunnelDestGroupsRequest struct {

	// Required. Google Cloud Project ID and location.
	// In the following format:
	// `projects/{project_number/id}/iap_tunnel/locations/{location}`.
	// A `-` can be used for the location to group across all locations.
	Parent string `protobuf:"bytes,1,opt,name=parent,proto3" json:"parent,omitempty"`
	// The maximum number of groups to return. The service might return fewer than
	// this value.
	// If unspecified, at most 100 groups are returned.
	// The maximum value is 1000; values above 1000 are coerced to 1000.
	PageSize int32 `protobuf:"varint,2,opt,name=page_size,json=pageSize,proto3" json:"page_size,omitempty"`
	// A page token, received from a previous `ListTunnelDestGroups`
	// call. Provide this to retrieve the subsequent page.
	//
	// When paginating, all other parameters provided to
	// `ListTunnelDestGroups` must match the call that provided the page
	// token.
	PageToken string `protobuf:"bytes,3,opt,name=page_token,json=pageToken,proto3" json:"page_token,omitempty"`
	// contains filtered or unexported fields
}

type ListTunnelDestGroupsResponse struct {

	// TunnelDestGroup existing in the project.
	TunnelDestGroups []*TunnelDestGroup `protobuf:"bytes,1,rep,name=tunnel_dest_groups,json=tunnelDestGroups,proto3" json:"tunnel_dest_groups,omitempty"`
	// A token that you can send as `page_token` to retrieve the next page.
	// If this field is omitted, there are no subsequent pages.
	NextPageToken string `protobuf:"bytes,2,opt,name=next_page_token,json=nextPageToken,proto3" json:"next_page_token,omitempty"`
	// contains filtered or unexported fields
}

type OAuth2 struct {

	// The OAuth 2.0 client ID registered in the workforce identity federation
	// OAuth 2.0 Server.
	ClientId string `protobuf:"bytes,1,opt,name=client_id,json=clientId,proto3" json:"client_id,omitempty"`
	// Input only. The OAuth 2.0 client secret created while registering the
	// client ID.
	ClientSecret string `protobuf:"bytes,2,opt,name=client_secret,json=clientSecret,proto3" json:"client_secret,omitempty"`
	// Output only. SHA256 hash value for the client secret. This field is
	// returned by IAP when the settings are retrieved.
	ClientSecretSha256 string `protobuf:"bytes,3,opt,name=client_secret_sha256,json=clientSecretSha256,proto3" json:"client_secret_sha256,omitempty"`
	// contains filtered or unexported fields
}

type OAuthSettings struct {

	// Domain hint to send as hd=? parameter in OAuth request flow. Enables
	// redirect to primary IDP by skipping Google's login screen.
	// https://developers.google.com/identity/protocols/OpenIDConnect#hd-param
	// Note: IAP does not verify that the id token's hd claim matches this value
	// since access behavior is managed by IAM policies.
	LoginHint *wrapperspb.StringValue `protobuf:"bytes,2,opt,name=login_hint,json=loginHint,proto3" json:"login_hint,omitempty"`
	// Optional. List of client ids allowed to use IAP programmatically.
	ProgrammaticClients []string `protobuf:"bytes,5,rep,name=programmatic_clients,json=programmaticClients,proto3" json:"programmatic_clients,omitempty"`
	// contains filtered or unexported fields
}

type ReauthSettings struct {

	// Optional. Reauth method requested.
	Method ReauthSettings_Method `protobuf:"varint,1,opt,name=method,proto3,enum=google.cloud.iap.v1.ReauthSettings_Method" json:"method,omitempty"`
	// Optional. Reauth session lifetime, how long before a user has to
	// reauthenticate again.
	MaxAge *durationpb.Duration `protobuf:"bytes,2,opt,name=max_age,json=maxAge,proto3" json:"max_age,omitempty"`
	// Optional. How IAP determines the effective policy in cases of hierarchical
	// policies. Policies are merged from higher in the hierarchy to lower in the
	// hierarchy.
	PolicyType ReauthSettings_PolicyType `protobuf:"varint,3,opt,name=policy_type,json=policyType,proto3,enum=google.cloud.iap.v1.ReauthSettings_PolicyType" json:"policy_type,omitempty"`
	// contains filtered or unexported fields
}

type ReauthSettings_Method int32

const (
	// Reauthentication disabled.
	ReauthSettings_METHOD_UNSPECIFIED ReauthSettings_Method = 0
	// Prompts the user to log in again.
	ReauthSettings_LOGIN ReauthSettings_Method = 1
	// Deprecated: Marked as deprecated in google/cloud/iap/v1/service.proto.
	ReauthSettings_PASSWORD ReauthSettings_Method = 2
	// User must use their secure key 2nd factor device.
	ReauthSettings_SECURE_KEY ReauthSettings_Method = 3
	// User can use any enabled 2nd factor.
	ReauthSettings_ENROLLED_SECOND_FACTORS ReauthSettings_Method = 4
)

type ReauthSettings_PolicyType int32

const (
	// Default value. This value is unused.
	ReauthSettings_POLICY_TYPE_UNSPECIFIED ReauthSettings_PolicyType = 0
	// This policy acts as a minimum to other policies, lower in the hierarchy.
	// Effective policy may only be the same or stricter.
	ReauthSettings_MINIMUM ReauthSettings_PolicyType = 1
	// This policy acts as a default if no other reauth policy is set.
	ReauthSettings_DEFAULT ReauthSettings_PolicyType = 2
)

type ResetIdentityAwareProxyClientSecretRequest struct {

	// Required. Name of the Identity Aware Proxy client to that will have its
	// secret reset. In the following format:
	// projects/{project_number/id}/brands/{brand}/identityAwareProxyClients/{client_id}.
	Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
	// contains filtered or unexported fields
}

type TunnelDestGroup struct {

	// Identifier. Identifier for the TunnelDestGroup. Must be unique within the
	// project and contain only lower case letters (a-z) and dashes (-).
	Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
	// Optional. Unordered list. List of CIDRs that this group applies to.
	Cidrs []string `protobuf:"bytes,2,rep,name=cidrs,proto3" json:"cidrs,omitempty"`
	// Optional. Unordered list. List of FQDNs that this group applies to.
	Fqdns []string `protobuf:"bytes,3,rep,name=fqdns,proto3" json:"fqdns,omitempty"`
	// contains filtered or unexported fields
}

type UnimplementedIdentityAwareProxyAdminServiceServer struct {
}

type UnimplementedIdentityAwareProxyOAuthServiceServer struct {
}

type UpdateIapSettingsRequest struct {

	// Required. The new values for the IAP settings to be updated.
	// Authorization: Requires the `updateSettings` permission for the associated
	// resource.
	IapSettings *IapSettings `protobuf:"bytes,1,opt,name=iap_settings,json=iapSettings,proto3" json:"iap_settings,omitempty"`
	// The field mask specifying which IAP settings should be updated.
	// If omitted, then all of the settings are updated. See
	// https://developers.google.com/protocol-buffers/docs/reference/google.protobuf#fieldmask.
	//
	// Note: All IAP reauth settings must always be set together, using the
	// field mask: `iapSettings.accessSettings.reauthSettings`.
	UpdateMask *fieldmaskpb.FieldMask `protobuf:"bytes,2,opt,name=update_mask,json=updateMask,proto3" json:"update_mask,omitempty"`
	// contains filtered or unexported fields
}

type UpdateTunnelDestGroupRequest struct {

	// Required. The new values for the TunnelDestGroup.
	TunnelDestGroup *TunnelDestGroup `protobuf:"bytes,1,opt,name=tunnel_dest_group,json=tunnelDestGroup,proto3" json:"tunnel_dest_group,omitempty"`
	// A field mask that specifies which IAP settings to update.
	// If omitted, then all of the settings are updated. See
	// https://developers.google.com/protocol-buffers/docs/reference/google.protobuf#fieldmask
	UpdateMask *fieldmaskpb.FieldMask `protobuf:"bytes,2,opt,name=update_mask,json=updateMask,proto3" json:"update_mask,omitempty"`
	// contains filtered or unexported fields
}

type ValidateIapAttributeExpressionRequest struct {

	// Required. The resource name of the IAP protected resource.
	Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
	// Required. User input string expression. Should be of the form
	// `attributes.saml_attributes.filter(attribute, attribute.name in
	// ['{attribute_name}', '{attribute_name}'])`
	Expression string `protobuf:"bytes,2,opt,name=expression,proto3" json:"expression,omitempty"`
	// contains filtered or unexported fields
}

type ValidateIapAttributeExpressionResponse struct {
	// contains filtered or unexported fields
}

type WorkforceIdentitySettings struct {

	// The workforce pool resources. Only one workforce pool is accepted.
	WorkforcePools []string `protobuf:"bytes,1,rep,name=workforce_pools,json=workforcePools,proto3" json:"workforce_pools,omitempty"`
	// OAuth 2.0 settings for IAP to perform OIDC flow with workforce identity
	// federation services.
	Oauth2 *OAuth2 `protobuf:"bytes,2,opt,name=oauth2,proto3" json:"oauth2,omitempty"`
	// contains filtered or unexported fields
}