Script TIA Plugin

The Script TIA runs a JavaScript procedure at token issuance time to produce per-scope decisions. This enables custom business rules, attribute-driven logic, and integration patterns that the other TIA plugins cannot express.

Use Cases#

The Script TIA enables custom token-issuance-authorization logic. Common use cases include:

• Custom Business Rules — implement organization-specific logic for scope issuance that requires custom algorithms or decision trees, such as scope denial based on combinations of subject attributes, time of day, and grant type.
• Attribute-Driven Decisions — authorize the issuance of scopes against attributes that are not part of the standard TIA context, for example custom claims resolved upstream or values read from a configured data source.
• External Authorization Delegation — delegate the decision to an external HTTP service whose contract does not match the AuthZen protocol expected by the AuthZen TIA.
• Conditional Consent and Time-to-Live — require user consent or cap a scope’s lifetime only under specific conditions (for example a stricter TTL for high-risk clients).

Getting Started#

To create a Script TIA, sign in to the Admin UI and navigate to Profiles → Token Service → Scopes → Token Authorization. Select + New Token Issuance Authorizer, give the TIA a unique identifier, and choose the Script type.

Configure the following settings:

1. Script — the JavaScript procedure that returns per-scope decisions. The script is validated at configuration-commit time, so a syntactically invalid script is rejected before it can affect token issuance.
2. HTTP Client — optional. Select an HTTP client facility if the script needs to call an external service to inform its decision.

Once the TIA is configured, assign it to one or more scopes in the Scopes section of the Token Profile.

Script Requirements#

The Script TIA requires a JavaScript procedure that:

• exports a top-level function named result that receives the procedure context as its single argument;
• returns either a result built with context.newResultBuilder() or a plain JavaScript object mapping scope names to decisions (or arrays of decisions).

A scope can carry more than one decision at once, for example, the procedure below requires user consent for the transfer_money scope and caps its lifetime at 5 minutes:

function result(context) {
    return context.newResultBuilder()
        .requireUserConsent("transfer_money")
        .setTimeToLive("transfer_money", 300)
        .build();
}

Multiple decisions per scope are resolved by the framework - Deny wins over any other decision, the smallest SetScopeTimeToLive duration wins, and RequireUserConsent is applied if present at least once.

Script Context#

The context argument passed to the result function exposes the full token-issuance request context.

Request Data#

Deciding on Resolved Claim Values#

When the Script TIA is designated as the profile’s post-claims-resolution authorizer , it is invoked after claim values have been resolved and can base its decisions on them. The following procedure denies the admin scope unless the resolved department claim is IT:

function result(context) {
    var builder = context.newResultBuilder();
    var iter = context.getScopeNames().iterator();
    while (iter.hasNext()) {
        var scope = iter.next();
        if (context.getPhase() === 'POST_CLAIMS_RESOLUTION'
                && scope === 'admin'
                && String(context.getResolvedClaims().get('department')) !== 'IT') {
            builder.deny(scope);
        } else {
            builder.allow(scope);
        }
    }
    return builder.build();
}

The same script instance may also be used as a scope-bound or Global authorizer; checking context.getPhase() keeps the resolved-value logic confined to the post-claims-resolution pass, where the values are available.

Data Sources and Services#

Result Builder#

context.newResultBuilder() returns a fluent builder for assembling the result:

Multiple decisions can be added for the same scope, the framework applies deny-wins, minimum-TTL, and consent semantics when resolving them.

function result(context) {
    var builder = context.newResultBuilder();
    var iterator = context.getScopeNames().iterator();
    while (iterator.hasNext()) {
        var scope = iterator.next();
        if (scope === "account") {
            builder.deny(scope);
        } else {
            builder.allow(scope);
        }
    }
    return builder.build();
}