{
  "$schema": "http://json-schema.org/draft-07/schema#",
  "type": "object",
  "properties": {
    "auth": {
      "type": "object",
      "properties": {
        "providers": {
          "type": "object",
          "properties": {
            "gcpIap": {
              "type": "object",
              "properties": {
                "audience": {
                  "type": "string",
                  "description": "The audience to use when validating incoming JWT tokens. See https://backstage.io/docs/auth/google/gcp-iap-auth"
                },
                "jwtHeader": {
                  "type": "string",
                  "description": "The name of the header to read the JWT token from, defaults to `'x-goog-iap-jwt-assertion'`."
                },
                "signIn": {
                  "type": "object",
                  "properties": {
                    "resolvers": {
                      "type": "array",
                      "items": {
                        "anyOf": [
                          {
                            "type": "object",
                            "properties": {
                              "resolver": {
                                "type": "string",
                                "const": "emailMatchingUserEntityAnnotation"
                              },
                              "dangerouslyAllowSignInWithoutUserInCatalog": {
                                "type": "boolean"
                              }
                            },
                            "required": [
                              "resolver"
                            ]
                          },
                          {
                            "type": "object",
                            "properties": {
                              "resolver": {
                                "type": "string",
                                "const": "idMatchingUserEntityAnnotation"
                              },
                              "dangerouslyAllowSignInWithoutUserInCatalog": {
                                "type": "boolean"
                              }
                            },
                            "required": [
                              "resolver"
                            ]
                          },
                          {
                            "type": "object",
                            "properties": {
                              "resolver": {
                                "type": "string",
                                "const": "emailLocalPartMatchingUserEntityName"
                              },
                              "allowedDomains": {
                                "type": "array",
                                "items": {
                                  "type": "string"
                                }
                              },
                              "dangerouslyAllowSignInWithoutUserInCatalog": {
                                "type": "boolean"
                              }
                            },
                            "required": [
                              "resolver"
                            ]
                          },
                          {
                            "type": "object",
                            "properties": {
                              "resolver": {
                                "type": "string",
                                "const": "emailMatchingUserEntityProfileEmail"
                              },
                              "dangerouslyAllowSignInWithoutUserInCatalog": {
                                "type": "boolean"
                              }
                            },
                            "required": [
                              "resolver"
                            ]
                          }
                        ]
                      }
                    }
                  },
                  "required": [
                    "resolvers"
                  ]
                },
                "sessionDuration": {
                  "anyOf": [
                    {
                      "type": "object",
                      "properties": {
                        "years": {
                          "type": "number"
                        },
                        "months": {
                          "type": "number"
                        },
                        "weeks": {
                          "type": "number"
                        },
                        "days": {
                          "type": "number"
                        },
                        "hours": {
                          "type": "number"
                        },
                        "minutes": {
                          "type": "number"
                        },
                        "seconds": {
                          "type": "number"
                        },
                        "milliseconds": {
                          "type": "number"
                        }
                      },
                      "description": "Human friendly durations object."
                    },
                    {
                      "type": "string"
                    }
                  ]
                }
              },
              "required": [
                "audience"
              ],
              "description": "Configuration for the Google Cloud Platform Identity-Aware Proxy (IAP) auth provider."
            }
          }
        }
      }
    }
  }
}