Optional Token Issuance Authorizer (TIA) that is invoked once, before any scope-bound TIAs, with the full set of requested-and-allowed scopes (including the empty default scope). The referenced id must match one of the TIAs defined in the token-issuance-authorizer list below. The ‘openid’ scope is exempt: decisions targeting it are ignored and it is always issued when requested and allowed.
post-claims-resolution-token-issuance-authorizer
leafref → ../token-issuance-authorizer/id
optional
-
Optional Token Issuance Authorizer (TIA) that is invoked once, after claim values have been resolved, with the full set of requested-and-allowed scopes, so it can decide whether a scope or claim is issued based on the resolved claim values. This pass is restrict-only: it can only further deny scopes/claims or shorten a scope’s time-to-live, never re-allow anything an earlier pass denied. Configuring it makes token issuance resolve claim values eagerly. The referenced id must match one of the TIAs defined in the token-issuance-authorizer list below. The ‘openid’ scope is exempt: decisions targeting it are ignored and it is always issued when requested and allowed.