Skip to main content

scim_tenants

Creates, updates, deletes, gets or lists a scim_tenants resource.

Overview​

Namescim_tenants
TypeResource
Idgoogle.iam.scim_tenants

Fields​

The following fields are returned by SELECT queries:

NameDatatypeDescription
namestringIdentifier. Gemini Enterprise only. The resource name of the SCIM Tenant. Format: locations/{location}/workforcePools/{workforce_pool}/providers/ {workforce_pool_provider}/scimTenants/{scim_tenant}
baseUristringOutput only. Gemini Enterprise only. Represents the base URI as defined in RFC 7644, Section 1.3. Clients must use this as the root address for managing resources under the tenant. Format: https://iamscim.googleapis.com/{version}/{tenant_id}/
claimMappingobjectRequired. Immutable. Gemini Enterprise only. Maps SCIM attributes to Google attributes. This mapping is used to associate the attributes synced via SCIM with the Google Cloud attributes used in IAM policies for Workforce Identity Federation. SCIM-managed user and group attributes are mapped to google.subject and google.group respectively. Each key must be a string specifying the Google Cloud IAM attribute to map to. The supported keys are as follows: * google.subject: The principal IAM is authenticating. You can reference this value in IAM bindings. This is also the subject that appears in Cloud Logging logs. This is a required field and the mapped subject cannot exceed 127 bytes. * google.group: Group the authenticating user belongs to. You can grant group access to resources using an IAM principalSet binding; access applies to all members of the group. Each value must be a [Common Expression Language] (https://opensource.google/projects/cel) expression that maps SCIM user or group attribute to the normalized attribute specified by the corresponding map key. Example: To map the SCIM user's externalId to google.subject and the SCIM group's externalId to google.group: { "google.subject": "user.externalId", "google.group": "group.externalId" }
descriptionstringOptional. Gemini Enterprise only. The description of the SCIM tenant. Cannot exceed 256 characters.
displayNamestringOptional. Gemini Enterprise only. The display name of the SCIM tenant. Cannot exceed 32 characters.
purgeTimestring (google-datetime)Output only. Gemini Enterprise only. The timestamp that represents the time when the SCIM tenant is purged.
serviceAgentstringOutput only. Service Agent created by SCIM Tenant API. SCIM tokens created under this tenant will be attached to this service agent.
statestringOutput only. Gemini Enterprise only. The state of the tenant. (STATE_UNSPECIFIED, ACTIVE, DELETED)

Methods​

The following methods are available for this resource:

NameAccessible byRequired ParamsOptional ParamsDescription
getselectlocationsId, workforcePoolsId, providersId, scimTenantsIdGemini Enterprise only. Gets an individual WorkforcePoolProviderScimTenant.
listselectlocationsId, workforcePoolsId, providersIdshowDeleted, pageSize, pageTokenGemini Enterprise only. Lists all non-deleted WorkforcePoolProviderScimTenants in a WorkforcePoolProvider. If show_deleted is set to true, then deleted SCIM tenants are also listed.
createinsertlocationsId, workforcePoolsId, providersIdworkforcePoolProviderScimTenantIdGemini Enterprise only. Creates a new WorkforcePoolProviderScimTenant in a WorkforcePoolProvider. You cannot reuse the name of a deleted SCIM tenant until 30 days after deletion.
patchupdatelocationsId, workforcePoolsId, providersId, scimTenantsIdupdateMaskGemini Enterprise only. Updates an existing WorkforcePoolProviderScimTenant.
deletedeletelocationsId, workforcePoolsId, providersId, scimTenantsIdhardDeleteGemini Enterprise only. Deletes a WorkforcePoolProviderScimTenant. You can undelete a SCIM tenant for 30 days. After 30 days, deletion is permanent. You cannot update deleted SCIM tenants. However, you can view and list them.
undeleteexeclocationsId, workforcePoolsId, providersId, scimTenantsIdGemini Enterprise only. Undeletes a WorkforcePoolProviderScimTenant, that was deleted fewer than 30 days ago.

Parameters​

Parameters can be passed in the WHERE clause of a query. Check the Methods section to see which parameters are required or optional for each operation.

NameDatatypeDescription
locationsIdstring
providersIdstring
scimTenantsIdstring
workforcePoolsIdstring
hardDeleteboolean
pageSizeinteger (int32)
pageTokenstring
showDeletedboolean
updateMaskstring (google-fieldmask)
workforcePoolProviderScimTenantIdstring

SELECT examples​

Gemini Enterprise only. Gets an individual WorkforcePoolProviderScimTenant.

SELECT
name,
baseUri,
claimMapping,
description,
displayName,
purgeTime,
serviceAgent,
state
FROM google.iam.scim_tenants
WHERE locationsId = '{{ locationsId }}' -- required
AND workforcePoolsId = '{{ workforcePoolsId }}' -- required
AND providersId = '{{ providersId }}' -- required
AND scimTenantsId = '{{ scimTenantsId }}' -- required
;

INSERT examples​

Gemini Enterprise only. Creates a new WorkforcePoolProviderScimTenant in a WorkforcePoolProvider. You cannot reuse the name of a deleted SCIM tenant until 30 days after deletion.

INSERT INTO google.iam.scim_tenants (
data__name,
data__displayName,
data__description,
data__claimMapping,
locationsId,
workforcePoolsId,
providersId,
workforcePoolProviderScimTenantId
)
SELECT 
'{{ name }}',
'{{ displayName }}',
'{{ description }}',
'{{ claimMapping }}',
'{{ locationsId }}',
'{{ workforcePoolsId }}',
'{{ providersId }}',
'{{ workforcePoolProviderScimTenantId }}'
RETURNING
name,
baseUri,
claimMapping,
description,
displayName,
purgeTime,
serviceAgent,
state
;

UPDATE examples​

Gemini Enterprise only. Updates an existing WorkforcePoolProviderScimTenant.

UPDATE google.iam.scim_tenants
SET 
data__name = '{{ name }}',
data__displayName = '{{ displayName }}',
data__description = '{{ description }}',
data__claimMapping = '{{ claimMapping }}'
WHERE 
locationsId = '{{ locationsId }}' --required
AND workforcePoolsId = '{{ workforcePoolsId }}' --required
AND providersId = '{{ providersId }}' --required
AND scimTenantsId = '{{ scimTenantsId }}' --required
AND updateMask = '{{ updateMask}}'
RETURNING
name,
baseUri,
claimMapping,
description,
displayName,
purgeTime,
serviceAgent,
state;

DELETE examples​

Gemini Enterprise only. Deletes a WorkforcePoolProviderScimTenant. You can undelete a SCIM tenant for 30 days. After 30 days, deletion is permanent. You cannot update deleted SCIM tenants. However, you can view and list them.

DELETE FROM google.iam.scim_tenants
WHERE locationsId = '{{ locationsId }}' --required
AND workforcePoolsId = '{{ workforcePoolsId }}' --required
AND providersId = '{{ providersId }}' --required
AND scimTenantsId = '{{ scimTenantsId }}' --required
AND hardDelete = '{{ hardDelete }}'
;

Lifecycle Methods​

Gemini Enterprise only. Undeletes a WorkforcePoolProviderScimTenant, that was deleted fewer than 30 days ago.

EXEC google.iam.scim_tenants.undelete 
@locationsId='{{ locationsId }}' --required, 
@workforcePoolsId='{{ workforcePoolsId }}' --required, 
@providersId='{{ providersId }}' --required, 
@scimTenantsId='{{ scimTenantsId }}' --required
;