iappb

type AccessDeniedPageSettings struct {

	// The URI to be redirected to when access is denied.
	AccessDeniedPageUri *wrapperspb.StringValue `protobuf:"bytes,1,opt,name=access_denied_page_uri,json=accessDeniedPageUri,proto3" json:"access_denied_page_uri,omitempty"`
	// Whether to generate a troubleshooting URL on access denied events to this
	// application.
	GenerateTroubleshootingUri *wrapperspb.BoolValue `` /* 141-byte string literal not displayed */
	// Whether to generate remediation token on access denied events to this
	// application.
	RemediationTokenGenerationEnabled *wrapperspb.BoolValue `` /* 170-byte string literal not displayed */
	// contains filtered or unexported fields
}

type AccessSettings struct {

	// GCIP claims and endpoint configurations for 3p identity providers.
	GcipSettings *GcipSettings `protobuf:"bytes,1,opt,name=gcip_settings,json=gcipSettings,proto3" json:"gcip_settings,omitempty"`
	// Configuration to allow cross-origin requests via IAP.
	CorsSettings *CorsSettings `protobuf:"bytes,2,opt,name=cors_settings,json=corsSettings,proto3" json:"cors_settings,omitempty"`
	// Settings to configure IAP's OAuth behavior.
	OauthSettings *OAuthSettings `protobuf:"bytes,3,opt,name=oauth_settings,json=oauthSettings,proto3" json:"oauth_settings,omitempty"`
	// Settings to configure reauthentication policies in IAP.
	ReauthSettings *ReauthSettings `protobuf:"bytes,6,opt,name=reauth_settings,json=reauthSettings,proto3" json:"reauth_settings,omitempty"`
	// Settings to configure and enable allowed domains.
	AllowedDomainsSettings *AllowedDomainsSettings `` /* 129-byte string literal not displayed */
	// contains filtered or unexported fields
}

type AllowedDomainsSettings struct {

	// Configuration for customers to opt in for the feature.
	Enable *bool `protobuf:"varint,1,opt,name=enable,proto3,oneof" json:"enable,omitempty"`
	// List of trusted domains.
	Domains []string `protobuf:"bytes,2,rep,name=domains,proto3" json:"domains,omitempty"`
	// contains filtered or unexported fields
}

type ApplicationSettings struct {

	// Settings to configure IAP's behavior for a service mesh.
	CsmSettings *CsmSettings `protobuf:"bytes,1,opt,name=csm_settings,json=csmSettings,proto3" json:"csm_settings,omitempty"`
	// Customization for Access Denied page.
	AccessDeniedPageSettings *AccessDeniedPageSettings `` /* 137-byte string literal not displayed */
	// The Domain value to set for cookies generated by IAP. This value is not
	// validated by the API, but will be ignored at runtime if invalid.
	CookieDomain *wrapperspb.StringValue `protobuf:"bytes,3,opt,name=cookie_domain,json=cookieDomain,proto3" json:"cookie_domain,omitempty"`
	// Settings to configure attribute propagation.
	AttributePropagationSettings *AttributePropagationSettings `` /* 147-byte string literal not displayed */
	// contains filtered or unexported fields
}

type AttributePropagationSettings struct {

	// Raw string CEL expression. Must return a list of attributes. A maximum of
	// 45 attributes can be selected. Expressions can select different attribute
	// types from `attributes`: `attributes.saml_attributes`,
	// `attributes.iap_attributes`. The following functions are supported:
	//
	//   - filter `<list>.filter(<iter_var>, <predicate>)`: Returns a subset of
	//     `<list>` where `<predicate>` is true for every item.
	//
	//   - in `<var> in <list>`: Returns true if `<list>` contains `<var>`.
	//
	//   - selectByName `<list>.selectByName(<string>)`: Returns the attribute
	//     in
	//     `<list>` with the given `<string>` name, otherwise returns empty.
	//
	//   - emitAs `<attribute>.emitAs(<string>)`: Sets the `<attribute>` name
	//     field to the given `<string>` for propagation in selected output
	//     credentials.
	//
	//   - strict `<attribute>.strict()`: Ignores the `x-goog-iap-attr-` prefix
	//     for the provided `<attribute>` when propagating with the `HEADER` output
	//     credential, such as request headers.
	//
	//   - append `<target_list>.append(<attribute>)` OR
	//     `<target_list>.append(<list>)`: Appends the provided `<attribute>` or
	//     `<list>` to the end of `<target_list>`.
	//
	// Example expression: `attributes.saml_attributes.filter(x, x.name in
	// ['test']).append(attributes.iap_attributes.selectByName('exact').emitAs('custom').strict())`
	Expression *string `protobuf:"bytes,1,opt,name=expression,proto3,oneof" json:"expression,omitempty"`
	// Which output credentials attributes selected by the CEL expression should
	// be propagated in. All attributes will be fully duplicated in each selected
	// output credential.
	OutputCredentials []AttributePropagationSettings_OutputCredentials `` /* 192-byte string literal not displayed */
	// Whether the provided attribute propagation settings should be evaluated on
	// user requests. If set to true, attributes returned from the expression will
	// be propagated in the set output credentials.
	Enable *bool `protobuf:"varint,3,opt,name=enable,proto3,oneof" json:"enable,omitempty"`
	// contains filtered or unexported fields
}

type AttributePropagationSettings_OutputCredentials int32

type Brand struct {

	// Output only. Identifier of the brand.
	// NOTE: GCP project number achieves the same brand identification purpose as
	// only one brand per project can be created.
	Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
	// Support email displayed on the OAuth consent screen.
	SupportEmail string `protobuf:"bytes,2,opt,name=support_email,json=supportEmail,proto3" json:"support_email,omitempty"`
	// Application name displayed on OAuth consent screen.
	ApplicationTitle string `protobuf:"bytes,3,opt,name=application_title,json=applicationTitle,proto3" json:"application_title,omitempty"`
	// Output only. Whether the brand is only intended for usage inside the
	// G Suite organization only.
	OrgInternalOnly bool `protobuf:"varint,4,opt,name=org_internal_only,json=orgInternalOnly,proto3" json:"org_internal_only,omitempty"`
	// contains filtered or unexported fields
}

type CorsSettings struct {

	// Configuration to allow HTTP OPTIONS calls to skip authorization. If
	// undefined, IAP will not apply any special logic to OPTIONS requests.
	AllowHttpOptions *wrapperspb.BoolValue `protobuf:"bytes,1,opt,name=allow_http_options,json=allowHttpOptions,proto3" json:"allow_http_options,omitempty"`
	// contains filtered or unexported fields
}

type CreateBrandRequest struct {

	// Required. GCP Project number/id under which the brand is to be created.
	// In the following format: projects/{project_number/id}.
	Parent string `protobuf:"bytes,1,opt,name=parent,proto3" json:"parent,omitempty"`
	// Required. The brand to be created.
	Brand *Brand `protobuf:"bytes,2,opt,name=brand,proto3" json:"brand,omitempty"`
	// contains filtered or unexported fields
}

type CreateIdentityAwareProxyClientRequest struct {

	// Required. Path to create the client in.
	// In the following format:
	// projects/{project_number/id}/brands/{brand}.
	// The project must belong to a G Suite account.
	Parent string `protobuf:"bytes,1,opt,name=parent,proto3" json:"parent,omitempty"`
	// Required. Identity Aware Proxy Client to be created.
	IdentityAwareProxyClient *IdentityAwareProxyClient `` /* 137-byte string literal not displayed */
	// contains filtered or unexported fields
}

type CreateTunnelDestGroupRequest struct {

	// Required. Google Cloud Project ID and location.
	// In the following format:
	// `projects/{project_number/id}/iap_tunnel/locations/{location}`.
	Parent string `protobuf:"bytes,1,opt,name=parent,proto3" json:"parent,omitempty"`
	// Required. The TunnelDestGroup to create.
	TunnelDestGroup *TunnelDestGroup `protobuf:"bytes,2,opt,name=tunnel_dest_group,json=tunnelDestGroup,proto3" json:"tunnel_dest_group,omitempty"`
	// Required. The ID to use for the TunnelDestGroup, which becomes the final
	// component of the resource name.
	//
	// This value must be 4-63 characters, and valid characters
	// are `[a-z]-`.
	TunnelDestGroupId string `protobuf:"bytes,3,opt,name=tunnel_dest_group_id,json=tunnelDestGroupId,proto3" json:"tunnel_dest_group_id,omitempty"`
	// contains filtered or unexported fields
}

type CsmSettings struct {

	// Audience claim set in the generated RCToken. This value is not validated by
	// IAP.
	RctokenAud *wrapperspb.StringValue `protobuf:"bytes,1,opt,name=rctoken_aud,json=rctokenAud,proto3" json:"rctoken_aud,omitempty"`
	// contains filtered or unexported fields
}

type DeleteIdentityAwareProxyClientRequest struct {

	// Required. Name of the Identity Aware Proxy client to be deleted.
	// In the following format:
	// projects/{project_number/id}/brands/{brand}/identityAwareProxyClients/{client_id}.
	Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
	// contains filtered or unexported fields
}

type DeleteTunnelDestGroupRequest struct {

	// Required. Name of the TunnelDestGroup to delete.
	// In the following format:
	// `projects/{project_number/id}/iap_tunnel/locations/{location}/destGroups/{dest_group}`.
	Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
	// contains filtered or unexported fields
}

type GcipSettings struct {

	// GCIP tenant ids that are linked to the IAP resource.
	// tenant_ids could be a string beginning with a number character to indicate
	// authenticating with GCIP tenant flow, or in the format of _<ProjectNumber>
	// to indicate authenticating with GCIP agent flow.
	// If agent flow is used, tenant_ids should only contain one single element,
	// while for tenant flow, tenant_ids can contain multiple elements.
	TenantIds []string `protobuf:"bytes,1,rep,name=tenant_ids,json=tenantIds,proto3" json:"tenant_ids,omitempty"`
	// Login page URI associated with the GCIP tenants.
	// Typically, all resources within the same project share the same login page,
	// though it could be overridden at the sub resource level.
	LoginPageUri *wrapperspb.StringValue `protobuf:"bytes,2,opt,name=login_page_uri,json=loginPageUri,proto3" json:"login_page_uri,omitempty"`
	// contains filtered or unexported fields
}

type GetBrandRequest struct {

	// Required. Name of the brand to be fetched.
	// In the following format: projects/{project_number/id}/brands/{brand}.
	Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
	// contains filtered or unexported fields
}

type GetIapSettingsRequest struct {

	// Required. The resource name for which to retrieve the settings.
	// Authorization: Requires the `getSettings` permission for the associated
	// resource.
	Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
	// contains filtered or unexported fields
}

type GetIdentityAwareProxyClientRequest struct {

	// Required. Name of the Identity Aware Proxy client to be fetched.
	// In the following format:
	// projects/{project_number/id}/brands/{brand}/identityAwareProxyClients/{client_id}.
	Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
	// contains filtered or unexported fields
}

type GetTunnelDestGroupRequest struct {

	// Required. Name of the TunnelDestGroup to be fetched.
	// In the following format:
	// `projects/{project_number/id}/iap_tunnel/locations/{location}/destGroups/{dest_group}`.
	Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
	// contains filtered or unexported fields
}

type IapSettings struct {

	// Required. The resource name of the IAP protected resource.
	Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
	// Top level wrapper for all access related setting in IAP
	AccessSettings *AccessSettings `protobuf:"bytes,5,opt,name=access_settings,json=accessSettings,proto3" json:"access_settings,omitempty"`
	// Top level wrapper for all application related settings in IAP
	ApplicationSettings *ApplicationSettings `protobuf:"bytes,6,opt,name=application_settings,json=applicationSettings,proto3" json:"application_settings,omitempty"`
	// contains filtered or unexported fields
}

type IdentityAwareProxyAdminServiceClient interface {
	// Sets the access control policy for an Identity-Aware Proxy protected
	// resource. Replaces any existing policy.
	// More information about managing access via IAP can be found at:
	// https://cloud.google.com/iap/docs/managing-access#managing_access_via_the_api
	SetIamPolicy(ctx context.Context, in *iampb.SetIamPolicyRequest, opts ...grpc.CallOption) (*iampb.Policy, error)
	// Gets the access control policy for an Identity-Aware Proxy protected
	// resource.
	// More information about managing access via IAP can be found at:
	// https://cloud.google.com/iap/docs/managing-access#managing_access_via_the_api
	GetIamPolicy(ctx context.Context, in *iampb.GetIamPolicyRequest, opts ...grpc.CallOption) (*iampb.Policy, error)
	// Returns permissions that a caller has on the Identity-Aware Proxy protected
	// resource.
	// More information about managing access via IAP can be found at:
	// https://cloud.google.com/iap/docs/managing-access#managing_access_via_the_api
	TestIamPermissions(ctx context.Context, in *iampb.TestIamPermissionsRequest, opts ...grpc.CallOption) (*iampb.TestIamPermissionsResponse, error)
	// Gets the IAP settings on a particular IAP protected resource.
	GetIapSettings(ctx context.Context, in *GetIapSettingsRequest, opts ...grpc.CallOption) (*IapSettings, error)
	// Updates the IAP settings on a particular IAP protected resource. It
	// replaces all fields unless the `update_mask` is set.
	UpdateIapSettings(ctx context.Context, in *UpdateIapSettingsRequest, opts ...grpc.CallOption) (*IapSettings, error)
	// Lists the existing TunnelDestGroups. To group across all locations, use a
	// `-` as the location ID. For example:
	// `/v1/projects/123/iap_tunnel/locations/-/destGroups`
	ListTunnelDestGroups(ctx context.Context, in *ListTunnelDestGroupsRequest, opts ...grpc.CallOption) (*ListTunnelDestGroupsResponse, error)
	// Creates a new TunnelDestGroup.
	CreateTunnelDestGroup(ctx context.Context, in *CreateTunnelDestGroupRequest, opts ...grpc.CallOption) (*TunnelDestGroup, error)
	// Retrieves an existing TunnelDestGroup.
	GetTunnelDestGroup(ctx context.Context, in *GetTunnelDestGroupRequest, opts ...grpc.CallOption) (*TunnelDestGroup, error)
	// Deletes a TunnelDestGroup.
	DeleteTunnelDestGroup(ctx context.Context, in *DeleteTunnelDestGroupRequest, opts ...grpc.CallOption) (*emptypb.Empty, error)
	// Updates a TunnelDestGroup.
	UpdateTunnelDestGroup(ctx context.Context, in *UpdateTunnelDestGroupRequest, opts ...grpc.CallOption) (*TunnelDestGroup, error)
}

type IdentityAwareProxyAdminServiceServer interface {
	// Sets the access control policy for an Identity-Aware Proxy protected
	// resource. Replaces any existing policy.
	// More information about managing access via IAP can be found at:
	// https://cloud.google.com/iap/docs/managing-access#managing_access_via_the_api
	SetIamPolicy(context.Context, *iampb.SetIamPolicyRequest) (*iampb.Policy, error)
	// Gets the access control policy for an Identity-Aware Proxy protected
	// resource.
	// More information about managing access via IAP can be found at:
	// https://cloud.google.com/iap/docs/managing-access#managing_access_via_the_api
	GetIamPolicy(context.Context, *iampb.GetIamPolicyRequest) (*iampb.Policy, error)
	// Returns permissions that a caller has on the Identity-Aware Proxy protected
	// resource.
	// More information about managing access via IAP can be found at:
	// https://cloud.google.com/iap/docs/managing-access#managing_access_via_the_api
	TestIamPermissions(context.Context, *iampb.TestIamPermissionsRequest) (*iampb.TestIamPermissionsResponse, error)
	// Gets the IAP settings on a particular IAP protected resource.
	GetIapSettings(context.Context, *GetIapSettingsRequest) (*IapSettings, error)
	// Updates the IAP settings on a particular IAP protected resource. It
	// replaces all fields unless the `update_mask` is set.
	UpdateIapSettings(context.Context, *UpdateIapSettingsRequest) (*IapSettings, error)
	// Lists the existing TunnelDestGroups. To group across all locations, use a
	// `-` as the location ID. For example:
	// `/v1/projects/123/iap_tunnel/locations/-/destGroups`
	ListTunnelDestGroups(context.Context, *ListTunnelDestGroupsRequest) (*ListTunnelDestGroupsResponse, error)
	// Creates a new TunnelDestGroup.
	CreateTunnelDestGroup(context.Context, *CreateTunnelDestGroupRequest) (*TunnelDestGroup, error)
	// Retrieves an existing TunnelDestGroup.
	GetTunnelDestGroup(context.Context, *GetTunnelDestGroupRequest) (*TunnelDestGroup, error)
	// Deletes a TunnelDestGroup.
	DeleteTunnelDestGroup(context.Context, *DeleteTunnelDestGroupRequest) (*emptypb.Empty, error)
	// Updates a TunnelDestGroup.
	UpdateTunnelDestGroup(context.Context, *UpdateTunnelDestGroupRequest) (*TunnelDestGroup, error)
}

type IdentityAwareProxyClient struct {

	// Output only. Unique identifier of the OAuth client.
	Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
	// Output only. Client secret of the OAuth client.
	Secret string `protobuf:"bytes,2,opt,name=secret,proto3" json:"secret,omitempty"`
	// Human-friendly name given to the OAuth client.
	DisplayName string `protobuf:"bytes,3,opt,name=display_name,json=displayName,proto3" json:"display_name,omitempty"`
	// contains filtered or unexported fields
}

type IdentityAwareProxyOAuthServiceClient interface {
	// Lists the existing brands for the project.
	ListBrands(ctx context.Context, in *ListBrandsRequest, opts ...grpc.CallOption) (*ListBrandsResponse, error)
	// Constructs a new OAuth brand for the project if one does not exist.
	// The created brand is "internal only", meaning that OAuth clients created
	// under it only accept requests from users who belong to the same Google
	// Workspace organization as the project. The brand is created in an
	// un-reviewed status. NOTE: The "internal only" status can be manually
	// changed in the Google Cloud Console. Requires that a brand does not already
	// exist for the project, and that the specified support email is owned by the
	// caller.
	CreateBrand(ctx context.Context, in *CreateBrandRequest, opts ...grpc.CallOption) (*Brand, error)
	// Retrieves the OAuth brand of the project.
	GetBrand(ctx context.Context, in *GetBrandRequest, opts ...grpc.CallOption) (*Brand, error)
	// Creates an Identity Aware Proxy (IAP) OAuth client. The client is owned
	// by IAP. Requires that the brand for the project exists and that it is
	// set for internal-only use.
	CreateIdentityAwareProxyClient(ctx context.Context, in *CreateIdentityAwareProxyClientRequest, opts ...grpc.CallOption) (*IdentityAwareProxyClient, error)
	// Lists the existing clients for the brand.
	ListIdentityAwareProxyClients(ctx context.Context, in *ListIdentityAwareProxyClientsRequest, opts ...grpc.CallOption) (*ListIdentityAwareProxyClientsResponse, error)
	// Retrieves an Identity Aware Proxy (IAP) OAuth client.
	// Requires that the client is owned by IAP.
	GetIdentityAwareProxyClient(ctx context.Context, in *GetIdentityAwareProxyClientRequest, opts ...grpc.CallOption) (*IdentityAwareProxyClient, error)
	// Resets an Identity Aware Proxy (IAP) OAuth client secret. Useful if the
	// secret was compromised. Requires that the client is owned by IAP.
	ResetIdentityAwareProxyClientSecret(ctx context.Context, in *ResetIdentityAwareProxyClientSecretRequest, opts ...grpc.CallOption) (*IdentityAwareProxyClient, error)
	// Deletes an Identity Aware Proxy (IAP) OAuth client. Useful for removing
	// obsolete clients, managing the number of clients in a given project, and
	// cleaning up after tests. Requires that the client is owned by IAP.
	DeleteIdentityAwareProxyClient(ctx context.Context, in *DeleteIdentityAwareProxyClientRequest, opts ...grpc.CallOption) (*emptypb.Empty, error)
}

type IdentityAwareProxyOAuthServiceServer interface {
	// Lists the existing brands for the project.
	ListBrands(context.Context, *ListBrandsRequest) (*ListBrandsResponse, error)
	// Constructs a new OAuth brand for the project if one does not exist.
	// The created brand is "internal only", meaning that OAuth clients created
	// under it only accept requests from users who belong to the same Google
	// Workspace organization as the project. The brand is created in an
	// un-reviewed status. NOTE: The "internal only" status can be manually
	// changed in the Google Cloud Console. Requires that a brand does not already
	// exist for the project, and that the specified support email is owned by the
	// caller.
	CreateBrand(context.Context, *CreateBrandRequest) (*Brand, error)
	// Retrieves the OAuth brand of the project.
	GetBrand(context.Context, *GetBrandRequest) (*Brand, error)
	// Creates an Identity Aware Proxy (IAP) OAuth client. The client is owned
	// by IAP. Requires that the brand for the project exists and that it is
	// set for internal-only use.
	CreateIdentityAwareProxyClient(context.Context, *CreateIdentityAwareProxyClientRequest) (*IdentityAwareProxyClient, error)
	// Lists the existing clients for the brand.
	ListIdentityAwareProxyClients(context.Context, *ListIdentityAwareProxyClientsRequest) (*ListIdentityAwareProxyClientsResponse, error)
	// Retrieves an Identity Aware Proxy (IAP) OAuth client.
	// Requires that the client is owned by IAP.
	GetIdentityAwareProxyClient(context.Context, *GetIdentityAwareProxyClientRequest) (*IdentityAwareProxyClient, error)
	// Resets an Identity Aware Proxy (IAP) OAuth client secret. Useful if the
	// secret was compromised. Requires that the client is owned by IAP.
	ResetIdentityAwareProxyClientSecret(context.Context, *ResetIdentityAwareProxyClientSecretRequest) (*IdentityAwareProxyClient, error)
	// Deletes an Identity Aware Proxy (IAP) OAuth client. Useful for removing
	// obsolete clients, managing the number of clients in a given project, and
	// cleaning up after tests. Requires that the client is owned by IAP.
	DeleteIdentityAwareProxyClient(context.Context, *DeleteIdentityAwareProxyClientRequest) (*emptypb.Empty, error)
}

type ListBrandsRequest struct {

	// Required. GCP Project number/id.
	// In the following format: projects/{project_number/id}.
	Parent string `protobuf:"bytes,1,opt,name=parent,proto3" json:"parent,omitempty"`
	// contains filtered or unexported fields
}

type ListBrandsResponse struct {

	// Brands existing in the project.
	Brands []*Brand `protobuf:"bytes,1,rep,name=brands,proto3" json:"brands,omitempty"`
	// contains filtered or unexported fields
}

type ListIdentityAwareProxyClientsRequest struct {

	// Required. Full brand path.
	// In the following format: projects/{project_number/id}/brands/{brand}.
	Parent string `protobuf:"bytes,1,opt,name=parent,proto3" json:"parent,omitempty"`
	// The maximum number of clients to return. The service may return fewer than
	// this value.
	// If unspecified, at most 100 clients will be returned.
	// The maximum value is 1000; values above 1000 will be coerced to 1000.
	PageSize int32 `protobuf:"varint,2,opt,name=page_size,json=pageSize,proto3" json:"page_size,omitempty"`
	// A page token, received from a previous `ListIdentityAwareProxyClients`
	// call. Provide this to retrieve the subsequent page.
	//
	// When paginating, all other parameters provided to
	// `ListIdentityAwareProxyClients` must match the call that provided the page
	// token.
	PageToken string `protobuf:"bytes,3,opt,name=page_token,json=pageToken,proto3" json:"page_token,omitempty"`
	// contains filtered or unexported fields
}

type ListIdentityAwareProxyClientsResponse struct {

	// Clients existing in the brand.
	IdentityAwareProxyClients []*IdentityAwareProxyClient `` /* 140-byte string literal not displayed */
	// A token, which can be send as `page_token` to retrieve the next page.
	// If this field is omitted, there are no subsequent pages.
	NextPageToken string `protobuf:"bytes,2,opt,name=next_page_token,json=nextPageToken,proto3" json:"next_page_token,omitempty"`
	// contains filtered or unexported fields
}

type ListTunnelDestGroupsRequest struct {

	// Required. Google Cloud Project ID and location.
	// In the following format:
	// `projects/{project_number/id}/iap_tunnel/locations/{location}`.
	// A `-` can be used for the location to group across all locations.
	Parent string `protobuf:"bytes,1,opt,name=parent,proto3" json:"parent,omitempty"`
	// The maximum number of groups to return. The service might return fewer than
	// this value.
	// If unspecified, at most 100 groups are returned.
	// The maximum value is 1000; values above 1000 are coerced to 1000.
	PageSize int32 `protobuf:"varint,2,opt,name=page_size,json=pageSize,proto3" json:"page_size,omitempty"`
	// A page token, received from a previous `ListTunnelDestGroups`
	// call. Provide this to retrieve the subsequent page.
	//
	// When paginating, all other parameters provided to
	// `ListTunnelDestGroups` must match the call that provided the page
	// token.
	PageToken string `protobuf:"bytes,3,opt,name=page_token,json=pageToken,proto3" json:"page_token,omitempty"`
	// contains filtered or unexported fields
}

type ListTunnelDestGroupsResponse struct {

	// TunnelDestGroup existing in the project.
	TunnelDestGroups []*TunnelDestGroup `protobuf:"bytes,1,rep,name=tunnel_dest_groups,json=tunnelDestGroups,proto3" json:"tunnel_dest_groups,omitempty"`
	// A token that you can send as `page_token` to retrieve the next page.
	// If this field is omitted, there are no subsequent pages.
	NextPageToken string `protobuf:"bytes,2,opt,name=next_page_token,json=nextPageToken,proto3" json:"next_page_token,omitempty"`
	// contains filtered or unexported fields
}

type OAuthSettings struct {

	// Domain hint to send as hd=? parameter in OAuth request flow. Enables
	// redirect to primary IDP by skipping Google's login screen.
	// https://developers.google.com/identity/protocols/OpenIDConnect#hd-param
	// Note: IAP does not verify that the id token's hd claim matches this value
	// since access behavior is managed by IAM policies.
	LoginHint *wrapperspb.StringValue `protobuf:"bytes,2,opt,name=login_hint,json=loginHint,proto3" json:"login_hint,omitempty"`
	// List of OAuth client IDs allowed to programmatically authenticate with IAP.
	ProgrammaticClients []string `protobuf:"bytes,5,rep,name=programmatic_clients,json=programmaticClients,proto3" json:"programmatic_clients,omitempty"`
	// contains filtered or unexported fields
}

type ReauthSettings struct {

	// Reauth method requested.
	Method ReauthSettings_Method `protobuf:"varint,1,opt,name=method,proto3,enum=google.cloud.iap.v1.ReauthSettings_Method" json:"method,omitempty"`
	// Reauth session lifetime, how long before a user has to reauthenticate
	// again.
	MaxAge *durationpb.Duration `protobuf:"bytes,2,opt,name=max_age,json=maxAge,proto3" json:"max_age,omitempty"`
	// How IAP determines the effective policy in cases of hierarchial policies.
	// Policies are merged from higher in the hierarchy to lower in the hierarchy.
	PolicyType ReauthSettings_PolicyType `` /* 143-byte string literal not displayed */
	// contains filtered or unexported fields
}

type ReauthSettings_Method int32

type ReauthSettings_PolicyType int32

type ResetIdentityAwareProxyClientSecretRequest struct {

	// Required. Name of the Identity Aware Proxy client to that will have its
	// secret reset. In the following format:
	// projects/{project_number/id}/brands/{brand}/identityAwareProxyClients/{client_id}.
	Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
	// contains filtered or unexported fields
}

type TunnelDestGroup struct {

	// Required. Immutable. Identifier for the TunnelDestGroup. Must be unique
	// within the project and contain only lower case letters (a-z) and dashes
	// (-).
	Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
	// Unordered list. List of CIDRs that this group applies to.
	Cidrs []string `protobuf:"bytes,2,rep,name=cidrs,proto3" json:"cidrs,omitempty"`
	// Unordered list. List of FQDNs that this group applies to.
	Fqdns []string `protobuf:"bytes,3,rep,name=fqdns,proto3" json:"fqdns,omitempty"`
	// contains filtered or unexported fields
}

type UnimplementedIdentityAwareProxyAdminServiceServer struct {
}

type UnimplementedIdentityAwareProxyOAuthServiceServer struct {
}

type UpdateIapSettingsRequest struct {

	// Required. The new values for the IAP settings to be updated.
	// Authorization: Requires the `updateSettings` permission for the associated
	// resource.
	IapSettings *IapSettings `protobuf:"bytes,1,opt,name=iap_settings,json=iapSettings,proto3" json:"iap_settings,omitempty"`
	// The field mask specifying which IAP settings should be updated.
	// If omitted, then all of the settings are updated. See
	// https://developers.google.com/protocol-buffers/docs/reference/google.protobuf#fieldmask.
	//
	// Note: All IAP reauth settings must always be set together, using the
	// field mask: `iapSettings.accessSettings.reauthSettings`.
	UpdateMask *fieldmaskpb.FieldMask `protobuf:"bytes,2,opt,name=update_mask,json=updateMask,proto3" json:"update_mask,omitempty"`
	// contains filtered or unexported fields
}

type UpdateTunnelDestGroupRequest struct {

	// Required. The new values for the TunnelDestGroup.
	TunnelDestGroup *TunnelDestGroup `protobuf:"bytes,1,opt,name=tunnel_dest_group,json=tunnelDestGroup,proto3" json:"tunnel_dest_group,omitempty"`
	// A field mask that specifies which IAP settings to update.
	// If omitted, then all of the settings are updated. See
	// https://developers.google.com/protocol-buffers/docs/reference/google.protobuf#fieldmask
	UpdateMask *fieldmaskpb.FieldMask `protobuf:"bytes,2,opt,name=update_mask,json=updateMask,proto3" json:"update_mask,omitempty"`
	// contains filtered or unexported fields
}