imjasonh/gcloud-help
1
0
Fork 0
mirror of https://github.com/imjasonh/gcloud-help synced 2026-07-18 14:56:05 +00:00
Code Activity

gcloud: Wed Feb 8 10:13:59 UTC 2023

Browse source
This commit is contained in:
Automated 2023-02-08 10:13:59 +00:00
parent fc11b54760
commit 11068cb123
240 changed files with 8982 additions and 619 deletions
Download patch file Download diff file Expand all files Collapse all files

202
gcloud/iam/workforce-pools/providers/update-oidc Normal file
View file

@ -0,0 +1,202 @@
NAME
gcloud iam workforce-pools providers update-oidc - update an OIDC workforce
pool provider
SYNOPSIS
gcloud iam workforce-pools providers update-oidc
(PROVIDER : --location=LOCATION --workforce-pool=WORKFORCE_POOL)
[--async] [--attribute-condition=ATTRIBUTE_CONDITION]
[--attribute-mapping=[ATTRIBUTE_MAPPING,...]] [--client-id=CLIENT_ID]
[--description=DESCRIPTION] [--disabled] [--display-name=DISPLAY_NAME]
[--issuer-uri=ISSUER_URI] [GCLOUD_WIDE_FLAG ...]
DESCRIPTION
Update an OIDC workforce pool provider.
EXAMPLES
The following command updates the OIDC workforce pool provider with the ID
my-workforce-pool-provider in the workforce pool my-workforce-pool.
Explicit values for all required and optional parameters are provided:
$ gcloud iam workforce-pools providers update-oidc \
my-workforce-pool-provider \
--workforce-pool="my-workforce-pool" --location="global" \
--display-name="My Workforce Pool Provider" \
--description="My workforce pool provider description." \
--disabled --attribute-mapping="google.subject=assertion.sub" \
--attribute-condition="true" --client-id="client-id" \
--issuer-uri="https://test-idp.com"
POSITIONAL ARGUMENTS
Workforce pool provider resource - The workforce pool provider to update.
The arguments in this group can be used to specify the attributes of this
resource.
This must be specified.
PROVIDER
ID of the workforce pool provider or fully qualified identifier for
the workforce pool provider. To set the provider attribute:
▸ provide the argument provider on the command line.
This positional argument must be specified if any of the other
arguments in this group are specified.
--location=LOCATION
The location for the workforce pool. To set the location attribute:
▸ provide the argument provider on the command line with a fully
specified name;
▸ provide the argument --location on the command line.
--workforce-pool=WORKFORCE_POOL
The ID to use for the workforce pool, which becomes the final
component of the resource name. This value must be a globally unique
string of 6 to 63 lowercase letters, digits, or hyphens. It must
start with a letter, and cannot have a trailing hyphen. The prefix
gcp- is reserved for use by Google, and may not be specified.
To set the workforce-pool attribute:
▸ provide the argument provider on the command line with a fully
specified name;
▸ provide the argument --workforce-pool on the command line.
FLAGS
--async
Return immediately, without waiting for the operation in progress to
complete.
--attribute-condition=ATTRIBUTE_CONDITION
A Common Expression Language (https://opensource.google/projects/cel)
expression, in plain text, to restrict which otherwise valid
authentication credentials issued by the provider should be accepted.
The expression must output a boolean representing whether to allow the
federation.
The following keywords may be referenced in the expressions:
◆ assertion: JSON representing the authentication credential issued
by the Provider.
◆ google: The Google attributes mapped from the assertion in the
attribute_mappings. google.profile_photo and google.display_name are
not supported.
◆ attribute: The custom attributes mapped from the assertion in the
attribute_mappings.
The maximum length of the attribute condition expression is 4096
characters. If unspecified, all valid authentication credential will be
accepted.
Example: Only allow credentials with a mapped google.groups value of
admins.
"'admins' in google.groups"
--attribute-mapping=[ATTRIBUTE_MAPPING,...]
Maps claims from the authentication credentials issued by the Identity
Provider into Google Cloud IAM attributes, e.g. subject, segment.
Each key must be a string specifying the Google Cloud IAM attribute to
be produced.
The following predefined keys are currently supported:
◆ google.subject: required field that indicates the principal that is
being authenticated to IAM, and will be logged in all API accesses
for which Cloud Audit Logging is configured.
◆ google.groups: optional field that indicates asserted groups that
the user should be considered to belong to. You can create IAM
bindings using the groups attribute and access to a resource will be
granted if any of the groups asserted here match a group in the
respective binding.
◆ google.display_name: optional field that overrides the name of the
user. If not set, google.subject will be displayed instead. This
attribute cannot be used in IAM policies. The maximum length of this
field is 100 characters.
◆ google.profile_photo: optional fields that may be set to a valid
URL specifying the user's thumbnail photo. When set, the image will
be visible as the user's profile picture. If not set, a generic user
icon will be displayed instead. This attribute cannot be used in IAM
policies.
Custom attributes can also be mapped by specifying
attribute.{custom_attribute}, replacing {custom_attribute} with the
name of the custom attribute to be mapped. A maximum of 50 custom
attribute mappings can be defined. The maximum length of a mapped
attribute key is 2048 characters and may only contain the characters
[a-z0-9].
These attributes can then be referenced in IAM policies to define
fine-grained access for the workforce pool to Google Cloud resources by
specifying:
◆ google.subject:
principal://iam.googleapis.com/locations/global/workforcePools/{pool}/subject/{value}
◆ google.groups:
principalSet://iam.googleapis.com/locations/global/workforcePools/{pool}/group/{value}
◆ attribute.{custom_attribute}:
principalSet://iam.googleapis.com/locations/global/workforcePools/{pool}/attribute.{custom_attribute}/{value}
Each value must be a Common Expression Language
(https://opensource.google/projects/cel) function that maps an Identity
Provider credential to the normalized attribute specified by the
corresponding map key.
The following keywords may be referenced in the expressions:
◆ assertion: JSON representing the authentication credential issued
by the Identity Provider.
The maximum length of an attribute mapping expression is 2048
characters. When evaluated, the total size of all mapped attributes
must not exceed 8KB.
Example: Map the sub claim of the incoming credential to the subject
Google Cloud IAM attribute.
{"google.subject": "assertion.sub"}
--client-id=CLIENT_ID
The OIDC client ID. This must match the audience claim of the JWT
issued by the identity provider.
--description=DESCRIPTION
A description for the workforce pool provider. Cannot exceed 256
characters in length.
--disabled
Whether the workforce pool provider is disabled. You cannot use a
disabled provider to perform new token exchanges or sign-ins. However,
existing tokens still grant access.
--display-name=DISPLAY_NAME
A display name for the workforce pool provider. Cannot exceed 32
characters in length.
--issuer-uri=ISSUER_URI
The OIDC issuer URI. Must be a valid URI using the 'https' scheme.
GCLOUD WIDE FLAGS
These flags are available to all commands: --access-token-file, --account,
--billing-project, --configuration, --flags-file, --flatten, --format,
--help, --impersonate-service-account, --log-http, --project, --quiet,
--trace-token, --user-output-enabled, --verbosity.
Run $ gcloud help for details.
API REFERENCE
This command uses the iam/v1 API. The full documentation for this API can
be found at: https://cloud.google.com/iam/
NOTES
These variants are also available:
$ gcloud alpha iam workforce-pools providers update-oidc
$ gcloud beta iam workforce-pools providers update-oidc