Audiens, sebagaimana diidentifikasi oleh IdP. Harus diperiksa berdasarkan konfigurasi lokal.
email
string (UTF-8)
Alamat email pengguna.
exp
string
Waktu habis masa berlaku.
iat
string
Waktu penerbitan.
iss
string
Penerbit token. Harus divalidasi terhadap kumpulan penerbit autentikasi tepercaya.
google_email
string
Klaim opsional, yang akan digunakan jika klaim email di JWT ini berbeda dengan ID email Google Workspace pengguna. Klaim ini
membawa identitas email Google Workspace pengguna.
...
Layanan Daftar Kontrol Akses Kunci (KACLS) Anda bebas menggunakan klaim lain (lokasi, klaim kustom, dll.) untuk mengevaluasi perimeter.
Token autentikasi KACLS untuk delegate
Token autentikasi berisi Token Web JSON (JWT) (JWT: RFC 7516)
yang merupakan token autentikasi pemilik.
Terkadang, pengguna tidak dapat melakukan autentikasi langsung di klien.
Dalam kasus ini, pengguna dapat mendelegasikan akses mereka ke resource tertentu untuk klien tersebut. Hal ini dicapai dengan menerbitkan token autentikasi yang didelegasikan baru yang membatasi cakupan token autentikasi asli.
Token autentikasi yang didelegasikan mirip dengan token autentikasi biasa dengan satu klaim tambahan:
klaim
delegated_to
string
ID untuk entitas yang akan didelegasikan autentikasinya.
Klaim resource_name dalam token autentikasi, dalam konteks
delegasi, digunakan untuk mengidentifikasi objek yang dienkripsi oleh
Kunci Enkripsi Data (DEK) yang valid untuk delegasi.
Token dikeluarkan oleh Layanan Daftar Kontrol Akses Kunci (KACLS)
menggunakan panggilan Delegate. JWT yang ditandatangani sendiri yang dapat divalidasi oleh KACLS, atau KACLS dapat menggunakan IdP lain untuk melakukannya, melalui panggilan tepercaya.
Agar token autentikasi yang didelegasikan dianggap valid, token otorisasi yang didelegasikan harus diberikan untuk operasi yang sama. Token otorisasi yang didelegasikan serupa dengan token otorisasi biasa, tetapi berisi klaim tambahan delegated_to. Nilai klaim
delegated_to dan resource_name harus cocok dengan nilai dalam
token autentikasi yang didelegasikan.
Sebaiknya tetapkan nilai masa aktif 15 menit untuk token autentikasi yang didelegasikan guna menghindari potensi penggunaan ulang jika terjadi kebocoran.
Penerbit token harus divalidasi terhadap kumpulan penerbit autentikasi tepercaya.
aud
string
Audiens, sebagaimana diidentifikasi oleh IdP. Harus diperiksa berdasarkan konfigurasi lokal.
exp
string
Waktu habis masa berlaku harus diperiksa.
iat
string
Waktu penerbitan, harus diperiksa.
delegated_to
string
ID untuk entitas yang akan didelegasikan autentikasinya.
resource_name
string
ID untuk objek yang dienkripsi oleh DEK, yang delegasinya valid.
...
KACLS bebas menggunakan klaim lain (lokasi, klaim kustom, dll.) untuk mengevaluasi perimeter.
Token autentikasi KACLS untuk PrivilegedUnwrap
Token pemilik (JWT: RFC 7516)
yang dikeluarkan oleh partner identitas (IdP) untuk membuktikan identitas pengguna.
Opsi ini hanya digunakan di PrivilegedUnwrap. Selama PrivilegedUnwrap, jika JWT KACLS digunakan sebagai pengganti token autentikasi IDP, KACLS penerima harus mengambil JWKS penerbit terlebih dahulu, lalu memverifikasi tanda tangan token, sebelum memeriksa klaim.
Audiens, sebagaimana diidentifikasi oleh IdP. Untuk operasi enkripsi sisi klien (CSE) PrivilegedUnwrap Drive,
nilai ini harus kacls-migration.
exp
string
Waktu habis masa berlaku.
iat
string
Waktu penerbitan.
iss
string
Penerbit token. Harus divalidasi terhadap kumpulan penerbit autentikasi tepercaya. Harus cocok dengan KACLS_URL dari KACLS yang meminta. Kumpulan kunci publik penerbit dapat ditemukan di /certs.
kacls_url
string
URL KACLS saat ini, tempat data didekripsi.
resource_name
string
ID untuk objek yang dienkripsi oleh DEK. Ukuran maksimum: 128 byte.
...
Layanan Daftar Kontrol Akses Kunci (KACLS) Anda bebas menggunakan klaim lain (lokasi, klaim kustom, dll.) untuk mengevaluasi perimeter.
[[["Mudah dipahami","easyToUnderstand","thumb-up"],["Memecahkan masalah saya","solvedMyProblem","thumb-up"],["Lainnya","otherUp","thumb-up"]],[["Informasi yang saya butuhkan tidak ada","missingTheInformationINeed","thumb-down"],["Terlalu rumit/langkahnya terlalu banyak","tooComplicatedTooManySteps","thumb-down"],["Sudah usang","outOfDate","thumb-down"],["Masalah terjemahan","translationIssue","thumb-down"],["Masalah kode / contoh","samplesCodeIssue","thumb-down"],["Lainnya","otherDown","thumb-down"]],["Terakhir diperbarui pada 2025-08-04 UTC."],[[["\u003cp\u003eKACLS uses bearer tokens (JWTs) issued by an identity provider (IdP) to verify user identity and authorize access.\u003c/p\u003e\n"],["\u003cp\u003eJWTs contain essential claims like audience, email, expiration, issuance, issuer, and potentially a Google Workspace email for specific scenarios.\u003c/p\u003e\n"],["\u003cp\u003eFor \u003ccode\u003ePrivilegedUnwrap\u003c/code\u003e operations, a KACLS JWT is used, requiring the recipient KACLS to verify the token signature and claims after fetching the issuer's JWKS.\u003c/p\u003e\n"],["\u003cp\u003eKACLS JWTs include specific claims like \u003ccode\u003ekacls_url\u003c/code\u003e and \u003ccode\u003eresource_name\u003c/code\u003e relevant to the decryption process.\u003c/p\u003e\n"],["\u003cp\u003eKACLS offers flexibility by allowing the use of additional claims for perimeter evaluation and custom authorization logic.\u003c/p\u003e\n"]]],["The document outlines two types of Bearer tokens (JWTs) used for user identity and KACLS authentication. User identity tokens, issued by the IdP, include fields like `aud`, `email`, `exp`, `iat`, `iss`, and `google_email` for email verification. KACLS authentication tokens, used during `PrivilegedUnwrap`, contain `aud` (specifically `kacls-migration`), `exp`, `iat`, `iss`, `kacls_url`, and `resource_name`. KACLS must verify the KACLS JWT's signature and claims after fetching the issuer's JWKS. Both types allow for custom claims.\n"],null,["# Authentication tokens\n\nBearer token ([JWT: RFC 7516](https://tools.ietf.org/html/rfc7516))\nissued by the identity partner (IdP) to attest a user's identity.\n\n| JSON representation ||\n|----------------------------------------------------------------------------------------------------------------------|---|\n| ``` { \"aud\": string, \"email\": string, \"exp\": string, \"iat\": string, \"iss\": string, \"google_email\": string, ... } ``` |\n\n| Fields ||\n|----------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|\n| `aud` | `string` The audience, as identified by the IdP. Should be checked against the local configuration. |\n| `email` | `string (UTF-8)` The user's email address. |\n| `exp` | `string` Expiration time. |\n| `iat` | `string` Issuance time. |\n| `iss` | `string` The token issuer. Should be validated against the trusted set of authentication issuers. |\n| `google_email` | `string` An optional claim, to be used when the email claim in this JWT is different from the user's Google Workspace email ID. This claim carries the user's Google Workspace email identity. |\n| `...` | Your Key Access Control List Service (KACLS) is free to use any other claims (location, custom claim, etc) to evaluate the perimeter. |\n\nKACLS authentication token for `delegate`\n-----------------------------------------\n\nThe authentication token contains a JSON Web Token (JWT) ([JWT: RFC 7516](https://tools.ietf.org/html/rfc7516))\nthat is a bearer authentication token.\n\nSometimes a user is not able to authenticate on a client directly.\nIn these cases the user can delegate their access to a specific\nresource to that client. This is achieved through issuing a new\ndelegated authentication token that limits the scope of the original\nauthentication token.\n\nThe delegated authentication token is similar to the ordinary\nauthentication token with one additional claim:\n\n| claim ||\n|----------------|----------------------------------------------------------------------|\n| `delegated_to` | `string` An identifier for the entity to delegate authentication to. |\n\nThe `resource_name` claim in the authentication token is, in a\ndelegation context, used for identifying the object encrypted by the\nData Encryption Key (DEK) for which the delegation is valid.\n\nThe token is issued by the Key Access Control List Service (KACLS)\nusing the `Delegate` call. It may be either self-signed JWTs\nthat KACLS is able to validate, or KACLS may use any other IdP to do\nthat, through a trusted call.\n\nIn order for the delegated authentication token to be considered valid, a\ndelegated authorization token must be provided for the same operation. The\ndelegated authorization token is similar to the ordinary authorization token,\nbut contains the additional claim `delegated_to`. The values of the\n`delegated_to` and `resource_name` claims must match the values in the\ndelegated authentication token.\n\nWe recommend that you set a lifetime value of 15 minutes for the delegated\nauthentication tokens to avoid potential reuse in case of leakage.\n\n| JSON representation ||\n|----------------------------------------------------------------------------------------------------------------------------------------------------------------------|---|\n| ``` { \"email\": string, \"iss\": string, \"aud\": string, \"exp\": string, \"iat\": string, \"google_email\": string, \"delegated_to\": string, \"resource_name\": string ... } ``` |\n\n| Fields ||\n|-----------------|-------------------------------------------------------------------------------------------------------|\n| `email` | `string (UTF-8)` The user's UTF-8 formatted email address. |\n| `iss` | `string` The token issuer, should be validated against the trusted set of authentication issuers. |\n| `aud` | `string` The audience, as identified by the IdP. Should be checked against the local configuration. |\n| `exp` | `string` Expiration time, should be checked. |\n| `iat` | `string` Issuance time, should be checked. |\n| `delegated_to` | `string` An identifier for the entity to delegate authentication to. |\n| `resource_name` | `string` An identifier for the object encrypted by the DEK, for which the delegation is valid. |\n| `...` | The KACLS is free to use any other claims (location, custom claim, etc...) to evaluate the perimeter. |\n\nKACLS authentication token for `PrivilegedUnwrap`\n-------------------------------------------------\n\nBearer token ([JWT: RFC 7516](https://tools.ietf.org/html/rfc7516))\nissued by the identity partner (IdP) to attest a user's identity.\n\nThis is only used on `PrivilegedUnwrap`. During `PrivilegedUnwrap`, if a KACLS\nJWT is used in place of an IDP authentication token, the recipient KACLS must\nfirst fetch the JWKS of the issuer, then verify the token signature, before\nchecking the claims.\n\n| JSON representation ||\n|--------------------------------------------------------------------------------------------------------------------------|---|\n| ``` { \"aud\": string, \"exp\": string, \"iat\": string, \"iss\": string, \"kacls_url\": string, \"resource_name\": string ... } ``` |\n\n| Fields ||\n|-----------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|\n| `aud` | `string` The audience, as identified by the IdP. For Drive client-side encryption (CSE) `PrivilegedUnwrap` operations, this should be `kacls-migration`. |\n| `exp` | `string` Expiration time. |\n| `iat` | `string` Issuance time. |\n| `iss` | `string` The token issuer. Should be validated against the trusted set of authentication issuers. Must match the `KACLS_URL` of the requesting KACLS. The public key set of the issuer can be found at /certs. |\n| `kacls_url` | `string` URL of current KACLS, that the data is being decrypted on. |\n| `resource_name` | `string` An identifier for the object encrypted by the DEK. Maximum size: 128 bytes. |\n| `...` | Your Key Access Control List Service (KACLS) is free to use any other claims (location, custom claim, etc) to evaluate the perimeter. |"]]
