IdP routing

Chooses which identity provider an authorization request is sent to.

• Control id: idp_selection
• Shape: selection. The most specific matching binding wins, and a tie gives an empty result.
• Entry points: authorize

Policy data

pbac.operator.controls.idp_selection

• Role: operator
• Written by: operator
• Schema: src/main/resources/schemas/operator-idp-selection.v1.json

Setting	Type	Default
default_idp	string	none in the schema
resource_to_idp	object	none in the schema
resource_type_to_idp	object	none in the schema
acr_to_idp	object	none in the schema

Reads

• context.authorize.acr_values

Emits

• subject_obligations

Reason codes

This control emits no reason code.

Implementation

Kind	Reference	Files	Role
rego_fragment	oauth.authorize	opa/policies/oauth/authorize.rego	decides