You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Mappings map an identity token's claim values to a specific role within Central.
121
121
@@ -126,33 +126,33 @@ Mappings map an identity token's claim values to a specific role within Central.
126
126
| Field Name| Required| Nullable | Type| Description | Format
127
127
128
128
| key
129
-
|
130
-
|
131
-
| String
129
+
|
130
+
|
131
+
| String
132
132
| A key within the identity token's claim value to use.
133
-
|
133
+
|
134
134
135
135
| valueExpression
136
-
|
137
-
|
138
-
| String
136
+
|
137
+
|
138
+
| String
139
139
| A regular expression that will be evaluated against values of the identity token claim identified by the specified key. This regular expressions is in RE2 format, see more here: https://github.com/google/re2/wiki/Syntax.
140
-
|
140
+
|
141
141
142
142
| role
143
-
|
144
-
|
145
-
| String
143
+
|
144
+
|
145
+
| String
146
146
| The role which should be issued when the key and value match for a particular identity token.
| Sets the expiration of the token returned from the ExchangeAuthMachineToMachineToken API call. Possible valid time units are: s, m, h. The maximum allowed expiration duration is 24h. As an example: 2h45m. For additional information on the validation of the duration, see: https://pkg.go.dev/time#ParseDuration.
202
-
|
202
+
|
203
203
204
204
| mappings
205
-
|
206
-
|
205
+
|
206
+
|
207
207
| List of <<AuthMachineToMachineConfigMapping_{context}, AuthMachineToMachineConfigMapping>>
208
208
| At least one mapping is required to resolve to a valid role for the access token to be successfully generated.
209
-
|
209
+
|
210
210
211
211
| issuer
212
-
|
213
-
|
214
-
| String
212
+
|
213
+
|
214
+
| String
215
215
| The issuer of the related OIDC provider issuing the ID tokens to exchange. Must be non-empty string containing URL when type is GENERIC. In case of GitHub actions, this must be empty or set to https://token.actions.githubusercontent.com. Issuer is a unique key, therefore there may be at most one GITHUB_ACTIONS config, and each GENERIC config must have a distinct issuer.
216
-
|
216
+
|
217
217
218
218
|===
219
219
220
220
221
221
222
222
[id="GooglerpcStatus_{context}"]
223
223
=== _GooglerpcStatus_
224
-
224
+
225
225
226
226
227
227
@@ -232,33 +232,33 @@ for the config.
232
232
| Field Name| Required| Nullable | Type| Description | Format
233
233
234
234
| code
235
-
|
236
-
|
237
-
| Integer
238
-
|
239
-
| int32
235
+
|
236
+
|
237
+
| Integer
238
+
|
239
+
| int32
240
240
241
241
| message
242
-
|
243
-
|
244
-
| String
245
-
|
246
-
|
242
+
|
243
+
|
244
+
| String
245
+
|
246
+
|
247
247
248
248
| details
249
-
|
250
-
|
249
+
|
250
+
|
251
251
| List of <<ProtobufAny_{context}, ProtobufAny>>
252
-
|
253
-
|
252
+
|
253
+
|
254
254
255
255
|===
256
256
257
257
258
258
259
259
[id="ProtobufAny_{context}"]
260
260
=== _ProtobufAny_
261
-
261
+
262
262
263
263
`Any` contains an arbitrary serialized protocol buffer message along with a
264
264
URL that describes the type of the serialized message.
@@ -352,19 +352,19 @@ field. Example (for message [google.protobuf.Duration][]):
352
352
| Field Name| Required| Nullable | Type| Description | Format
353
353
354
354
| @type
355
-
|
356
-
|
357
-
| String
355
+
|
356
+
|
357
+
| String
358
358
| A URL/resource name that uniquely identifies the type of the serialized protocol buffer message. This string must contain at least one \"/\" character. The last segment of the URL's path must represent the fully qualified name of the type (as in `path/google.protobuf.Duration`). The name should be in a canonical form (e.g., leading \".\" is not accepted). In practice, teams usually precompile into the binary all types that they expect it to use in the context of Any. However, for URLs which use the scheme `http`, `https`, or no scheme, one can optionally set up a type server that maps type URLs to message definitions as follows: * If no scheme is provided, `https` is assumed. * An HTTP GET on the URL must yield a [google.protobuf.Type][] value in binary format, or produce an error. * Applications are allowed to cache lookup results based on the URL, or have them precompiled into a binary to avoid any lookup. Therefore, binary compatibility needs to be preserved on changes to types. (Use versioned type names to manage breaking changes.) Note: this functionality is not currently available in the official protobuf release, and it is not used for type URLs beginning with type.googleapis.com. As of May 2023, there are no widely used type server implementations and no plans to implement one. Schemes other than `http`, `https` (or the empty scheme) might be used with implementation specific semantics.
359
-
|
359
+
|
360
360
361
361
|===
362
362
363
363
364
364
365
365
[id="V1AuthMachineToMachineConfigType_{context}"]
366
366
=== _V1AuthMachineToMachineConfigType_
367
-
367
+
368
368
369
369
The type of the auth machine to machine config.
370
370
Currently supports GitHub actions or any other generic OIDC provider to use for verifying and
0 commit comments