Public client policy

Bounds what a dynamically-registered or CIMD client may ask for at REGISTRATION: which grant types, scopes, resource indicators and client authentication methods are permitted, and whether open registration is allowed at all. It does not decide what an already-registered client is entitled to — that is client_entitlements, scoped by a binding.

• Control id: public_client_policy
• Shape: deny. Segment bindings do not reach this control, because its Rego does not read settings through pbac.segments.settings.
• Entry points: token, register

Policy data

pbac.operator.controls.public_client_policy

• Role: operator
• Written by: operator
• Schema: src/main/resources/schemas/operator-public-client-policy.v1.json

Setting	Type	Default
enabled	boolean	none in the schema
cimd.allowed_grant_types	array of string	none in the schema
cimd.allowed_scopes	array of string	none in the schema
cimd.allowed_resource_indicators	array of string	none in the schema
cimd.allowed_auth_methods	array of one of none, client_secret_post, client_secret_basic, private_key_jwt	none in the schema
dcr.allowed_grant_types	array of string	none in the schema
dcr.allowed_scopes	array of string	none in the schema
dcr.allowed_resource_indicators	array of string	none in the schema
dcr.allowed_auth_methods	array of one of none, client_secret_post, client_secret_basic, private_key_jwt	none in the schema

Reads

• context.client.client_type
• request.cimd_client_id_url
• request.grant_types
• request.token_endpoint_auth_method

Emits

• deny
• reason
• deny_reasons

Reason codes

Code	Category	Entry point	Setting
no_overlapping_grant_types	control	register	pbac.operator.controls.public_client_policy#dcr.allowed_grant_types
auth_method_not_allowed	control	register	pbac.operator.controls.public_client_policy#dcr.allowed_auth_methods
public_client_credentials	control	token	pbac.operator.controls.public_client_policy#enabled

Implementation

Kind	Reference	Files	Role
rego_inline	oauth.register	opa/policies/oauth/register.rego	decides
rego_inline	oauth.token	opa/policies/oauth/token.rego	decides
rego_reader	pbac.operator.controls.public_client_policy	opa/policies/oauth/public_client.rego	reads