Identity Provider
IdentityProvider
Defines the high-level intent for a customer-facing identity provider.
Translates into identity platform configurations, supporting social sign-in (Google, GitHub, etc.), email/password, and other standard identity protocols, driving authentication flows and branding for end-user applications.
| Property | Type | Description |
|---|---|---|
| apiVersion | string | API schema version. Pins the manifest to a specific schema contract for backward-compatibility. Must be the constant lowops.manifests.v1. |
| kind | string | Resource kind discriminator. Identifies this document as an IdentityProvider so the engine routes it to the correct defaulter, validator, computer, and executor. Must be the constant IdentityProvider. |
| metadata | map | Classification labels and graph linkage. Free-form key/value pairs used to classify the manifest. Reserved keys such as name, project, environment, organizational-unit, and organization are read by the engine to resolve this manifest's identity and to locate its parent PublicIngress and the target GCP Project in the dependency graph. |
| spec | Spec | Desired identity provider configuration. The authoritative, user-authored specification for this identity provider. See Spec. |
Spec
User-authored customer identity provider configuration.
Defines the supported login methods, signup/email-domain permissions, password and SMS policies, TOS and operational-status controls, custom claims, and the visual branding shown on the hosted sign-in page for this tenant.
| Property | Type | Description |
|---|---|---|
| description | string | Human-readable description of this identity provider. Optional free text describing the role of this provider. Used as context by AI assistants when reasoning about the manifest; not propagated onto the provisioned GCIP tenant. |
| disabled | bool | Disable this identity provider. When true, the provisioned GCIP tenant is created with authentication disabled (DisableAuth), blocking all sign-in while preserving the tenant configuration. |
| permissions | Permissions | Signup and email-domain permissions. See Permissions. Configures the blocking-function rules that gate end-user registration for this tenant. |
| displayName | string | Display name shown on the login page. Human-readable tenant name rendered to end-users in the hosted sign-in UI. Required. |
| mode | string | Social sign-in flow mode. Controls how federated sign-in is performed in the login UI: POPUP opens a provider popup window, REDIRECT navigates to the provider. Drives the tenant UI config sign-in flow, defaulting to redirect when unset. |
| providers | Providers | Enabled sign-in methods. See Providers. Selects which first-party and federated identity providers are enabled for this tenant and surfaced on the login page. |
| termsOfService | string | Terms of Service URL. Link to the application's terms of service, rendered on the sign-in page and referenced for TOS acceptance tracking. If absolute it must use the https scheme; if relative it is resolved against the login domain. Required when the project has GDPR compliance enabled. |
| privacyPolicy | string | Privacy Policy URL. Link to the application's privacy policy, rendered on the sign-in page. If absolute it must use the https scheme; if relative it is resolved against the login domain. Required when the project has GDPR compliance enabled. |
| logoUrl | string | Logo image URL. URL of the logo displayed on the hosted sign-in page. Relative paths are resolved against the login domain. Required. |
| iconUrl | string | Icon image URL. URL of the icon displayed on the hosted sign-in page. Relative paths are resolved against the login domain. Required. |
| buttonColor | string | Sign-in button color. Hex color code (#RRGGBB) applied to this provider's button on the sign-in page; validated as a hex color and defaulted to #007bff in the computed UI config when unset. |
| styleUrl | string | Custom CSS stylesheet URL. URL of a per-tenant CSS stylesheet that overrides the ingress-level style. Must be a valid URI (https when absolute); relative paths are resolved against the login domain. |
| heroImageUrl | string | Hero panel background image URL. URL of the hero/background image displayed in the login page's hero panel. Must be a valid URI; relative paths are resolved against the login domain. |
| heroBackground | string | Hero panel CSS background. CSS background value for the hero panel (e.g. "linear-gradient(135deg, #667eea, #764ba2)"). Rendered into the login UI and rejected by validation if it contains script-injection patterns. |
| immediateFederatedRedirect | bool | Skip the sign-in UI for a single provider. When true and exactly one federated provider is configured, the login page redirects immediately to that provider instead of showing the provider picker. |
| redirectOnLogin | string | Post-login redirect URL. URL the user is sent to after a successful sign-in, overriding the ingress-level default. |
| redirectOnLogout | string | Post-logout redirect URL. URL the user is sent to after signing out, overriding the ingress-level default. |
| passwordPolicy | PasswordPolicy | Password policy for this tenant. See PasswordPolicy. Applied at the GCIP tenant level in multi-tenant setups. |
| smsRegionPolicy | SmsRegionPolicy | SMS region policy for phone auth. See SmsRegionPolicy. Required when phone sign-in is enabled (validation fails otherwise) to prevent SMS toll fraud. |
| testPhoneNumbers | list of TestPhoneNumbersEntry | Test phone numbers for this tenant. Maps a phone number in E.164 format to a fixed verification code, letting those numbers bypass real SMS delivery during testing. Applied to the provisioned GCIP tenant; limited to 10 entries. |
| termsOfServiceVersion | string | Current Terms of Service version. Version identifier for the active TOS document (e.g. "v2026-05"). When set, the blocking function tracks per-user acceptance via a custom claim, blocks sign-in with TOS_ACCEPTANCE_REQUIRED until the current version is accepted, and injects the version as a claim on first signup. |
| status | OperationalStatus | Operational status of this tenant. See OperationalStatus. Controls the maintenance and suspension states enforced on every sign-in. |
| customClaims | CustomClaims | Custom claims for this tenant. See CustomClaims. Injects custom claims into user tokens during authentication events. |
CustomClaims
Custom claims injected during authentication.
Key/value claims applied by the blocking function and embedded in the user's Firebase Auth ID token (JWT).
| Property | Type | Description |
|---|---|---|
| onCreate | list of OnCreateEntry | Claims set on account creation. Claims injected once when a new account is created, via the beforeCreate trigger (e.g. {"role": "user", "tier": "free"}). |
| onSignIn | list of OnSignInEntry | Claims refreshed on every sign-in. Claims re-applied on each sign-in via the beforeSignIn trigger (e.g. {"lastLoginTenant": "infrastream-cloud"}). Runs on every login attempt, so use sparingly. |
OnCreateEntry
| Property | Type | Description |
|---|---|---|
| key | string | |
| value | string |
OnSignInEntry
| Property | Type | Description |
|---|---|---|
| key | string | |
| value | string |
OperationalStatus
Tenant operational-status controls.
Maintenance and suspension switches evaluated by the blocking function's beforeSignIn trigger; unlike signup rules these affect every login attempt, not just new registrations.
| Property | Type | Description |
|---|---|---|
| maintenance | Maintenance | Maintenance mode. See Maintenance. |
| suspension | Suspension | Tenant suspension. See Suspension. |
Maintenance
Maintenance-mode configuration.
When enabled, all sign-in attempts for this tenant are blocked with an informational message (severity=info).
| Property | Type | Description |
|---|---|---|
| enabled | bool | Whether maintenance mode is active. When true, the blocking function blocks all sign-ins for this tenant with a maintenance notice. |
| message | string | Maintenance message shown to users. Operator-provided text (not translated — dynamic content) passed through the MAINTENANCE code so the login app can display it verbatim. |
Suspension
Tenant-suspension configuration.
When enabled, all sign-in attempts for this tenant are blocked with an error message (severity=error). Unlike spec.disabled (which uses GCIP DisableAuth), this blocks access at the application level while preserving the tenant's GCIP configuration and allowing a custom message.
| Property | Type | Description |
|---|---|---|
| enabled | bool | Whether the tenant is suspended. When true, the blocking function blocks all sign-ins for this tenant with a suspension error. |
| message | string | Suspension reason shown to users. Operator-provided reason for the suspension (not translated — dynamic content); displayed to users on blocked sign-in. |
PasswordPolicy
Tenant password policy.
Length and character-class requirements enforced at the GCIP tenant level and applied by the executor to the provisioned tenant. Only effective in multi-tenant mode.
| Property | Type | Description |
|---|---|---|
| minLength | int32 | Minimum password length. Fewest characters a password may contain, between 6 and 30 (default 6). Applied to the provisioned GCIP tenant. |
| maxLength | int32 | Maximum password length. Most characters a password may contain, between 6 and 4096 (default 4096). Applied to the provisioned GCIP tenant. |
| requireUppercase | bool | Require an uppercase letter. When true, passwords must contain at least one uppercase letter. Applied to the provisioned GCIP tenant. |
| requireLowercase | bool | Require a lowercase letter. When true, passwords must contain at least one lowercase letter. Applied to the provisioned GCIP tenant. |
| requireNumeric | bool | Require a numeric character. When true, passwords must contain at least one digit. Applied to the provisioned GCIP tenant. |
| requireNonAlphanumeric | bool | Require a non-alphanumeric character. When true, passwords must contain at least one symbol. Applied to the provisioned GCIP tenant. |
Permissions
End-user signup and email-domain controls.
Rules enforced by the tenant's blocking function beforeCreate trigger that gate whether, and with which email domains, end-users may register a new account with this provider.
| Property | Type | Description |
|---|---|---|
| disableUserSignup | bool | Disable new end-user signups. When true, end-users cannot register a new account with this provider; enforced by the blocking function's beforeCreate trigger on a per-tenant basis. |
| allowedEmailDomains | list of string | Email-domain allowlist for registration. Only emails whose domain appears in this list may register a new account (e.g. ["company.com", "partner.org"]). Enforced by the blocking function's beforeCreate trigger; when empty, no allowlist is applied. |
| blockedEmailDomains | list of string | Email-domain blocklist for registration. Emails whose domain appears in this list are blocked from registering (e.g. ["gmail.com", "yahoo.com"]). Enforced by the blocking function's beforeCreate trigger and evaluated after allowed_email_domains, so both may be set together. |
Providers
Enabled sign-in methods.
Toggles for the built-in first-party and federated identity providers offered on the sign-in page. Each enabled federated provider causes the executor to provision a GCIP tenant provider and expects its client ID and secret to be present in the centralized secret manager.
| Property | Type | Description |
|---|---|---|
| anonymous | bool | Enable anonymous sign-in. When true, adds an anonymous (guest) sign-in option to the hosted login UI. A first-party GCIP method; no external provider or client secret is provisioned. |
| password | bool | Enable email/password sign-in. When true, allows email/password (and email-link) sign-up and sign-in on this tenant and surfaces the option on the login UI. Enables AllowPasswordSignup on the provisioned GCIP tenant. |
| phone | bool | Enable phone-number (SMS) sign-in. When true, adds SMS/phone sign-in to the login UI. A first-party GCIP method; when enabled, sms_region_policy is required (validation fails otherwise) to guard against toll fraud. |
| bool | Enable Google federated sign-in. When true, provisions a google.com GCIP tenant provider and surfaces the Google option on the login UI. Expects the Google client ID and secret in the centralized secret manager. | |
| apple | bool | Enable Apple federated sign-in. When true, provisions an apple.com GCIP tenant provider and surfaces the Apple option on the login UI. Expects the Apple client ID and secret in the centralized secret manager. |
| bool | Enable Facebook federated sign-in. When true, provisions a facebook.com GCIP tenant provider and surfaces the Facebook option on the login UI. Expects the Facebook client ID and secret in the centralized secret manager. | |
| github | bool | Enable GitHub federated sign-in. When true, provisions a github.com GCIP tenant provider, expecting its client ID and secret in the centralized secret manager. Not yet surfaced among the engine-generated login UI sign-in options. |
| bool | Enable LinkedIn federated sign-in. When true, provisions a linkedin.com GCIP tenant provider and surfaces the LinkedIn option on the login UI. Expects the LinkedIn client ID and secret in the centralized secret manager. | |
| microsoft | bool | Enable Microsoft federated sign-in. When true, provisions a microsoft.com GCIP tenant provider and surfaces the Microsoft option on the login UI. Expects the Microsoft client ID and secret in the centralized secret manager. |
| googlePlay | bool | Enable Google Play Games federated sign-in. When true, provisions a playgames.google.com GCIP tenant provider, expecting its client ID and secret in the centralized secret manager. Not yet surfaced among the engine-generated login UI sign-in options. |
| bool | Enable Twitter/X federated sign-in. When true, provisions a twitter.com GCIP tenant provider, expecting its client ID and secret in the centralized secret manager. Not yet surfaced among the engine-generated login UI sign-in options. | |
| yahoo | bool | Enable Yahoo federated sign-in. When true, provisions a yahoo.com GCIP tenant provider, expecting its client ID and secret in the centralized secret manager. Not yet surfaced among the engine-generated login UI sign-in options. |
| oauth2 | list of string | Generic OAuth 2.0 provider IDs. NOT YET IMPLEMENTED. Declared in the schema but currently ignored by the engine (no consumer reads it). Intended future behavior: register each listed provider ID as a generic OAuth 2.0 identity provider on the tenant. |
SmsRegionPolicy
SMS region restriction policy.
Restricts which geographic regions may receive SMS verification codes, guarding against toll fraud. Applied to the provisioned GCIP tenant.
| Property | Type | Description |
|---|---|---|
| allowedRegions | list of string | Allowed SMS region codes. Allowlist of ISO 3166-1 alpha-2 region codes permitted to receive SMS; only these regions can receive verification codes. |
TestPhoneNumbersEntry
| Property | Type | Description |
|---|---|---|
| key | string | |
| value | string |