|
| 1 | +// Copyright 2017 Google Inc. |
| 2 | +// |
| 3 | +// Licensed under the Apache License, Version 2.0 (the "License"); |
| 4 | +// you may not use this file except in compliance with the License. |
| 5 | +// You may obtain a copy of the License at |
| 6 | +// |
| 7 | +// http://www.apache.org/licenses/LICENSE-2.0 |
| 8 | +// |
| 9 | +// Unless required by applicable law or agreed to in writing, software |
| 10 | +// distributed under the License is distributed on an "AS IS" BASIS, |
| 11 | +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| 12 | +// See the License for the specific language governing permissions and |
| 13 | +// limitations under the License. |
| 14 | + |
| 15 | +syntax = "proto3"; |
| 16 | + |
| 17 | +package google.api; |
| 18 | + |
| 19 | +import "google/api/annotations.proto"; |
| 20 | + |
| 21 | +option go_package = "google.golang.org/genproto/googleapis/api/serviceconfig;serviceconfig"; |
| 22 | +option java_multiple_files = true; |
| 23 | +option java_outer_classname = "AuthProto"; |
| 24 | +option java_package = "com.google.api"; |
| 25 | +option objc_class_prefix = "GAPI"; |
| 26 | + |
| 27 | + |
| 28 | +// `Authentication` defines the authentication configuration for an API. |
| 29 | +// |
| 30 | +// Example for an API targeted for external use: |
| 31 | +// |
| 32 | +// name: calendar.googleapis.com |
| 33 | +// authentication: |
| 34 | +// providers: |
| 35 | +// - id: google_calendar_auth |
| 36 | +// jwks_uri: https://www.googleapis.com/oauth2/v1/certs |
| 37 | +// issuer: https://securetoken.google.com |
| 38 | +// rules: |
| 39 | +// - selector: "*" |
| 40 | +// requirements: |
| 41 | +// provider_id: google_calendar_auth |
| 42 | +message Authentication { |
| 43 | + // A list of authentication rules that apply to individual API methods. |
| 44 | + // |
| 45 | + // **NOTE:** All service configuration rules follow "last one wins" order. |
| 46 | + repeated AuthenticationRule rules = 3; |
| 47 | + |
| 48 | + // Defines a set of authentication providers that a service supports. |
| 49 | + repeated AuthProvider providers = 4; |
| 50 | +} |
| 51 | + |
| 52 | +// Authentication rules for the service. |
| 53 | +// |
| 54 | +// By default, if a method has any authentication requirements, every request |
| 55 | +// must include a valid credential matching one of the requirements. |
| 56 | +// It's an error to include more than one kind of credential in a single |
| 57 | +// request. |
| 58 | +// |
| 59 | +// If a method doesn't have any auth requirements, request credentials will be |
| 60 | +// ignored. |
| 61 | +message AuthenticationRule { |
| 62 | + // Selects the methods to which this rule applies. |
| 63 | + // |
| 64 | + // Refer to [selector][google.api.DocumentationRule.selector] for syntax details. |
| 65 | + string selector = 1; |
| 66 | + |
| 67 | + // The requirements for OAuth credentials. |
| 68 | + OAuthRequirements oauth = 2; |
| 69 | + |
| 70 | + // Whether to allow requests without a credential. The credential can be |
| 71 | + // an OAuth token, Google cookies (first-party auth) or EndUserCreds. |
| 72 | + // |
| 73 | + // For requests without credentials, if the service control environment is |
| 74 | + // specified, each incoming request **must** be associated with a service |
| 75 | + // consumer. This can be done by passing an API key that belongs to a consumer |
| 76 | + // project. |
| 77 | + bool allow_without_credential = 5; |
| 78 | + |
| 79 | + // Requirements for additional authentication providers. |
| 80 | + repeated AuthRequirement requirements = 7; |
| 81 | +} |
| 82 | + |
| 83 | +// Configuration for an anthentication provider, including support for |
| 84 | +// [JSON Web Token (JWT)](https://tools.ietf.org/html/draft-ietf-oauth-json-web-token-32). |
| 85 | +message AuthProvider { |
| 86 | + // The unique identifier of the auth provider. It will be referred to by |
| 87 | + // `AuthRequirement.provider_id`. |
| 88 | + // |
| 89 | + // Example: "bookstore_auth". |
| 90 | + string id = 1; |
| 91 | + |
| 92 | + // Identifies the principal that issued the JWT. See |
| 93 | + // https://tools.ietf.org/html/draft-ietf-oauth-json-web-token-32#section-4.1.1 |
| 94 | + // Usually a URL or an email address. |
| 95 | + // |
| 96 | + // Example: https://securetoken.google.com |
| 97 | + |
| 98 | + string issuer = 2; |
| 99 | + |
| 100 | + // URL of the provider's public key set to validate signature of the JWT. See |
| 101 | + // [OpenID Discovery](https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderMetadata). |
| 102 | + // Optional if the key set document: |
| 103 | + // - can be retrieved from |
| 104 | + // [OpenID Discovery](https://openid.net/specs/openid-connect-discovery-1_0.html |
| 105 | + // of the issuer. |
| 106 | + // - can be inferred from the email domain of the issuer (e.g. a Google service account). |
| 107 | + // |
| 108 | + // Example: https://www.googleapis.com/oauth2/v1/certs |
| 109 | + string jwks_uri = 3; |
| 110 | + |
| 111 | + // The list of JWT |
| 112 | + // [audiences](https://tools.ietf.org/html/draft-ietf-oauth-json-web-token-32#section-4.1.3). |
| 113 | + // that are allowed to access. A JWT containing any of these audiences will |
| 114 | + // be accepted. When this setting is absent, only JWTs with audience |
| 115 | + // "https://[Service_name][google.api.Service.name]/[API_name][google.protobuf.Api.name]" |
| 116 | + // will be accepted. For example, if no audiences are in the setting, |
| 117 | + // LibraryService API will only accept JWTs with the following audience |
| 118 | + // "https://library-example.googleapis.com/google.example.library.v1.LibraryService". |
| 119 | + // |
| 120 | + // Example: |
| 121 | + // |
| 122 | + // audiences: bookstore_android.apps.googleusercontent.com, |
| 123 | + // bookstore_web.apps.googleusercontent.com |
| 124 | + string audiences = 4; |
| 125 | +} |
| 126 | + |
| 127 | +// OAuth scopes are a way to define data and permissions on data. For example, |
| 128 | +// there are scopes defined for "Read-only access to Google Calendar" and |
| 129 | +// "Access to Cloud Platform". Users can consent to a scope for an application, |
| 130 | +// giving it permission to access that data on their behalf. |
| 131 | +// |
| 132 | +// OAuth scope specifications should be fairly coarse grained; a user will need |
| 133 | +// to see and understand the text description of what your scope means. |
| 134 | +// |
| 135 | +// In most cases: use one or at most two OAuth scopes for an entire family of |
| 136 | +// products. If your product has multiple APIs, you should probably be sharing |
| 137 | +// the OAuth scope across all of those APIs. |
| 138 | +// |
| 139 | +// When you need finer grained OAuth consent screens: talk with your product |
| 140 | +// management about how developers will use them in practice. |
| 141 | +// |
| 142 | +// Please note that even though each of the canonical scopes is enough for a |
| 143 | +// request to be accepted and passed to the backend, a request can still fail |
| 144 | +// due to the backend requiring additional scopes or permissions. |
| 145 | +message OAuthRequirements { |
| 146 | + // The list of publicly documented OAuth scopes that are allowed access. An |
| 147 | + // OAuth token containing any of these scopes will be accepted. |
| 148 | + // |
| 149 | + // Example: |
| 150 | + // |
| 151 | + // canonical_scopes: https://www.googleapis.com/auth/calendar, |
| 152 | + // https://www.googleapis.com/auth/calendar.read |
| 153 | + string canonical_scopes = 1; |
| 154 | +} |
| 155 | + |
| 156 | +// User-defined authentication requirements, including support for |
| 157 | +// [JSON Web Token (JWT)](https://tools.ietf.org/html/draft-ietf-oauth-json-web-token-32). |
| 158 | +message AuthRequirement { |
| 159 | + // [id][google.api.AuthProvider.id] from authentication provider. |
| 160 | + // |
| 161 | + // Example: |
| 162 | + // |
| 163 | + // provider_id: bookstore_auth |
| 164 | + string provider_id = 1; |
| 165 | + |
| 166 | + // NOTE: This will be deprecated soon, once AuthProvider.audiences is |
| 167 | + // implemented and accepted in all the runtime components. |
| 168 | + // |
| 169 | + // The list of JWT |
| 170 | + // [audiences](https://tools.ietf.org/html/draft-ietf-oauth-json-web-token-32#section-4.1.3). |
| 171 | + // that are allowed to access. A JWT containing any of these audiences will |
| 172 | + // be accepted. When this setting is absent, only JWTs with audience |
| 173 | + // "https://[Service_name][google.api.Service.name]/[API_name][google.protobuf.Api.name]" |
| 174 | + // will be accepted. For example, if no audiences are in the setting, |
| 175 | + // LibraryService API will only accept JWTs with the following audience |
| 176 | + // "https://library-example.googleapis.com/google.example.library.v1.LibraryService". |
| 177 | + // |
| 178 | + // Example: |
| 179 | + // |
| 180 | + // audiences: bookstore_android.apps.googleusercontent.com, |
| 181 | + // bookstore_web.apps.googleusercontent.com |
| 182 | + string audiences = 2; |
| 183 | +} |
0 commit comments