Skip to content

Commit 7414ae7

Browse files
yoshi-code-botyoshi-code-bot
authored
Regenerate sts client (#8331)
Generated in GitHub action: https://togithub.com/googleapis/googleapis/google-api-php-client-services/actions/workflows/codegen.yaml
1 parent 95f1762 commit 7414ae7

1 file changed

Lines changed: 56 additions & 52 deletions

File tree

‎src/CloudSecurityToken/GoogleIdentityStsV1ExchangeTokenRequest.php‎

Lines changed: 56 additions & 52 deletions
Original file line numberDiff line numberDiff line change
@@ -82,32 +82,34 @@ class GoogleIdentityStsV1ExchangeTokenRequest extends \Google\Model
8282
* 4.2 of the [OIDC 1.0 Discovery
8383
* specification](https://openid.net/specs/openid-connect-
8484
* discovery-1_0.html#ProviderConfigurationResponse). - `iat`: The issue time,
85-
* in seconds, since the Unix epoch. Must be in the past. - `exp`: The
86-
* expiration time, in seconds, since the Unix epoch. Must be less than 48
87-
* hours after `iat`. Shorter expiration times are more secure. If possible,
88-
* we recommend setting an expiration time less than 6 hours. - `sub`: The
89-
* identity asserted in the JWT. - `aud`: For workload identity pools, this
90-
* must be a value specified in the allowed audiences for the workload
91-
* identity pool provider, or one of the audiences allowed by default if no
92-
* audiences were specified. See https://cloud.google.com/iam/docs/reference/r
93-
* est/v1/projects.locations.workloadIdentityPools.providers#oidc. For
94-
* workforce pools, this must match the client ID specified in the provider
95-
* configuration. See https://cloud.google.com/iam/docs/reference/rest/v1/loca
96-
* tions.workforcePools.providers#oidc. Example header: ``` { "alg": "RS256",
97-
* "kid": "us-east-11" } ``` Example payload: ``` { "iss":
98-
* "https://accounts.google.com", "iat": 1517963104, "exp": 1517966704, "aud":
99-
* "//iam.googleapis.com/projects/1234567890123/locations/global/workloadIdent
100-
* ityPools/my-pool/providers/my-provider", "sub": "113475438248934895348",
101-
* "my_claims": { "additional_claim": "value" } } ``` If `subject_token` is
102-
* for AWS, it must be a serialized `GetCallerIdentity` token. This token
103-
* contains the same information as a request to the AWS [`GetCallerIdentity()
104-
* `](https://docs.aws.amazon.com/STS/latest/APIReference/API_GetCallerIdentit
105-
* y) method, as well as the AWS [signature](https://docs.aws.amazon.com/gener
106-
* al/latest/gr/signing_aws_api_requests.html) for the request information.
107-
* Use Signature Version 4. Format the request as URL-encoded JSON, and set
108-
* the `subject_token_type` parameter to `urn:ietf:params:aws:token-
109-
* type:aws4_request`. The following parameters are required: - `url`: The URL
110-
* of the AWS STS endpoint for `GetCallerIdentity()`, such as
85+
* in seconds, since the Unix epoch. This timestamp must be in the past and no
86+
* more than 24 hours in the past, or the token will be rejected. Note that
87+
* this implies the token is only acceptable within a time window of at most
88+
* 24 hours. - `exp`: The expiration time, in seconds, since the Unix epoch.
89+
* Shorter expiration times are more secure. If possible, we recommend setting
90+
* an expiration time less than 6 hours. - `sub`: The identity asserted in the
91+
* JWT. - `aud`: For workload identity pools, this must be a value specified
92+
* in the allowed audiences for the workload identity pool provider, or one of
93+
* the audiences allowed by default if no audiences were specified. See https:
94+
* //cloud.google.com/iam/docs/reference/rest/v1/projects.locations.workloadId
95+
* entityPools.providers#oidc. For workforce pools, this must match the client
96+
* ID specified in the provider configuration. See https://cloud.google.com/ia
97+
* m/docs/reference/rest/v1/locations.workforcePools.providers#oidc. Example
98+
* header: ``` { "alg": "RS256", "kid": "us-east-11" } ``` Example payload:
99+
* ``` { "iss": "https://accounts.google.com", "iat": 1517963104, "exp":
100+
* 1517966704, "aud": "//iam.googleapis.com/projects/1234567890123/locations/g
101+
* lobal/workloadIdentityPools/my-pool/providers/my-provider", "sub":
102+
* "113475438248934895348", "my_claims": { "additional_claim": "value" } } ```
103+
* If `subject_token` is for AWS, it must be a serialized `GetCallerIdentity`
104+
* token. This token contains the same information as a request to the AWS [`G
105+
* etCallerIdentity()`](https://docs.aws.amazon.com/STS/latest/APIReference/AP
106+
* I_GetCallerIdentity) method, as well as the AWS [signature](https://docs.aw
107+
* s.amazon.com/general/latest/gr/signing_aws_api_requests.html) for the
108+
* request information. Use Signature Version 4. Format the request as URL-
109+
* encoded JSON, and set the `subject_token_type` parameter to
110+
* `urn:ietf:params:aws:token-type:aws4_request`. The following parameters are
111+
* required: - `url`: The URL of the AWS STS endpoint for
112+
* `GetCallerIdentity()`, such as
111113
* `https://sts.amazonaws.com?Action=GetCallerIdentity&Version=2011-06-15`.
112114
* Regional endpoints are also supported. - `method`: The HTTP request method:
113115
* `POST`. - `headers`: The HTTP request headers, which must include: -
@@ -282,32 +284,34 @@ public function getScope()
282284
* 4.2 of the [OIDC 1.0 Discovery
283285
* specification](https://openid.net/specs/openid-connect-
284286
* discovery-1_0.html#ProviderConfigurationResponse). - `iat`: The issue time,
285-
* in seconds, since the Unix epoch. Must be in the past. - `exp`: The
286-
* expiration time, in seconds, since the Unix epoch. Must be less than 48
287-
* hours after `iat`. Shorter expiration times are more secure. If possible,
288-
* we recommend setting an expiration time less than 6 hours. - `sub`: The
289-
* identity asserted in the JWT. - `aud`: For workload identity pools, this
290-
* must be a value specified in the allowed audiences for the workload
291-
* identity pool provider, or one of the audiences allowed by default if no
292-
* audiences were specified. See https://cloud.google.com/iam/docs/reference/r
293-
* est/v1/projects.locations.workloadIdentityPools.providers#oidc. For
294-
* workforce pools, this must match the client ID specified in the provider
295-
* configuration. See https://cloud.google.com/iam/docs/reference/rest/v1/loca
296-
* tions.workforcePools.providers#oidc. Example header: ``` { "alg": "RS256",
297-
* "kid": "us-east-11" } ``` Example payload: ``` { "iss":
298-
* "https://accounts.google.com", "iat": 1517963104, "exp": 1517966704, "aud":
299-
* "//iam.googleapis.com/projects/1234567890123/locations/global/workloadIdent
300-
* ityPools/my-pool/providers/my-provider", "sub": "113475438248934895348",
301-
* "my_claims": { "additional_claim": "value" } } ``` If `subject_token` is
302-
* for AWS, it must be a serialized `GetCallerIdentity` token. This token
303-
* contains the same information as a request to the AWS [`GetCallerIdentity()
304-
* `](https://docs.aws.amazon.com/STS/latest/APIReference/API_GetCallerIdentit
305-
* y) method, as well as the AWS [signature](https://docs.aws.amazon.com/gener
306-
* al/latest/gr/signing_aws_api_requests.html) for the request information.
307-
* Use Signature Version 4. Format the request as URL-encoded JSON, and set
308-
* the `subject_token_type` parameter to `urn:ietf:params:aws:token-
309-
* type:aws4_request`. The following parameters are required: - `url`: The URL
310-
* of the AWS STS endpoint for `GetCallerIdentity()`, such as
287+
* in seconds, since the Unix epoch. This timestamp must be in the past and no
288+
* more than 24 hours in the past, or the token will be rejected. Note that
289+
* this implies the token is only acceptable within a time window of at most
290+
* 24 hours. - `exp`: The expiration time, in seconds, since the Unix epoch.
291+
* Shorter expiration times are more secure. If possible, we recommend setting
292+
* an expiration time less than 6 hours. - `sub`: The identity asserted in the
293+
* JWT. - `aud`: For workload identity pools, this must be a value specified
294+
* in the allowed audiences for the workload identity pool provider, or one of
295+
* the audiences allowed by default if no audiences were specified. See https:
296+
* //cloud.google.com/iam/docs/reference/rest/v1/projects.locations.workloadId
297+
* entityPools.providers#oidc. For workforce pools, this must match the client
298+
* ID specified in the provider configuration. See https://cloud.google.com/ia
299+
* m/docs/reference/rest/v1/locations.workforcePools.providers#oidc. Example
300+
* header: ``` { "alg": "RS256", "kid": "us-east-11" } ``` Example payload:
301+
* ``` { "iss": "https://accounts.google.com", "iat": 1517963104, "exp":
302+
* 1517966704, "aud": "//iam.googleapis.com/projects/1234567890123/locations/g
303+
* lobal/workloadIdentityPools/my-pool/providers/my-provider", "sub":
304+
* "113475438248934895348", "my_claims": { "additional_claim": "value" } } ```
305+
* If `subject_token` is for AWS, it must be a serialized `GetCallerIdentity`
306+
* token. This token contains the same information as a request to the AWS [`G
307+
* etCallerIdentity()`](https://docs.aws.amazon.com/STS/latest/APIReference/AP
308+
* I_GetCallerIdentity) method, as well as the AWS [signature](https://docs.aw
309+
* s.amazon.com/general/latest/gr/signing_aws_api_requests.html) for the
310+
* request information. Use Signature Version 4. Format the request as URL-
311+
* encoded JSON, and set the `subject_token_type` parameter to
312+
* `urn:ietf:params:aws:token-type:aws4_request`. The following parameters are
313+
* required: - `url`: The URL of the AWS STS endpoint for
314+
* `GetCallerIdentity()`, such as
311315
* `https://sts.amazonaws.com?Action=GetCallerIdentity&Version=2011-06-15`.
312316
* Regional endpoints are also supported. - `method`: The HTTP request method:
313317
* `POST`. - `headers`: The HTTP request headers, which must include: -

0 commit comments

Comments
 (0)