Interface OidcFederationPolicy

The allowed token audiences, as specified in the 'aud' claim of federated tokens. The audience identifier is intended to represent the recipient of the token. Can be any non-empty string value. As long as the audience in the token matches at least one audience in the policy,

The required token issuer, as specified in the 'iss' claim of federated tokens.

The required token subject, as specified in the subject claim of federated tokens. The subject claim identifies the identity of the user or machine accessing the resource. Examples for Entra ID (AAD):

• U2M flow (group access): If the subject claim is groups, this must be the Object ID of the group in Entra ID.
• U2M flow (user access): If the subject claim is oid, this must be the Object ID of the user in Entra ID.
• M2M flow (OAuth App access): If the subject claim is azp, this must be the client ID of the OAuth app registered in Entra ID.

The claim that contains the subject of the token. Depending on the identity provider and the use case (U2M or M2M), this can vary:

• For Entra ID (AAD):

• U2M flow (group access): Use groups.
• U2M flow (user access): Use oid.
• M2M flow (OAuth App access): Use azp.

• For other IdPs, refer to the specific IdP documentation.

Supported subject_claim values are:

• oid: Object ID of the user.
• azp: Client ID of the OAuth app.
• groups: Object ID of the group.
• sub: Subject identifier for other use cases.