- release_tracks: [GA, BETA, ALPHA]

  help_text:
    brief: Update the LDAPS settings for a domain.
    description: |
      Update a Managed Microsoft AD domain's Lightweight Directory Access Protocol over TLS/SSL (LDAPS) settings.
      You must be safelisted for the Managed AD LDAPS Alpha in order to use this feature.
      Consult the API documentation for a list of certificate requirements.

      This command can fail for the following reasons:
        * The certificate is invalid.
        * The domain specified does not exist.
        * The active account does not have permission to view LDAPS settings for the domain.
    examples: |
      To enable LDAPS for the first time or update the certificates being used:

        $ {command} my-domain.com --certificate-pfx-file=certificate-chain-with-private-key.pfx --certificate-password="password"

      To disable LDAPS:

        $ {command} my-domain.com --clear-certificates

  request:
    collection: managedidentities.projects.locations.global.domains
    ALPHA:
      api_version: v1alpha1
    BETA:
      api_version: v1beta1
    GA:
      api_version: v1
    method: updateLdapssettings
    modify_request_hooks:
    - googlecloudsdk.command_lib.active_directory.domains_update_util:ProcessPfxFile
    - googlecloudsdk.command_lib.active_directory.domains_update_util:ReadPfxPasswordIfNeeded
    - googlecloudsdk.command_lib.active_directory.domains_update_util:ClearCertificates

  arguments:
    resource:
      help_text: |
        Name of the managed Managed Microsoft AD domain you want to update.
      spec: !REF googlecloudsdk.command_lib.active_directory.resources:domain

    params:
    - group:
        mutex: true
        required: true
        params:
        - group:
            params:
            - arg_name: certificate-pfx-file
              type: googlecloudsdk.calliope.arg_parsers:FileContents:binary=True
              help_text: |-
                PKCS#12-formatted pfx file that specifies the certificate chain used to configure LDAPS.
                If certificate-password is not specified, command will prompt user for secret.
              required: true
            - arg_name: certificate-password
              help_text: |
                Password used to encrypt the PKCS#12 certificate. If not specified, command will prompt user for secret.
        - arg_name: clear-certificates
          type: bool
          help_text: |
            Disable LDAPS by deleting all existing certificates. Certificates will need to be re-uploaded if LDAPS is to be re-enabled.
  async:
    collection: managedidentities.projects.locations.global.operations