Authorizers

The authorizers block registers a webhook that you run, such as your own policy engine, that makes decisions for the OAuth server. Registering a webhook doesn't send any requests to it. The token policy decides which requests go to it.

For the request the webhook receives and the response it returns, see External authorizer webhook.

Example

authorizers:
  - name: corp-pdp
    webhook:
      url: https://pdp.example.com/authorize
      auth:
        method: bearer
      caBundle: |
        -----BEGIN CERTIFICATE-----
        ...
        -----END CERTIFICATE-----
      timeout: 2s

Fields

The block can have one entry.

Field	Required	Description	Example
name	Yes	A name for the entry. externalAuthorize rules in the token policy refer to the authorizer by this name. A DNS label, unique across all named entries in the section.	corp-pdp
webhook.url	Yes	The webhook's full URL. Nothing is appended to it. An absolute https URL, with no query, fragment, or user information. http is accepted only for localhost, 127.0.0.1, and [::1].	https://pdp.example.com/authorize
webhook.auth.method	Yes	How the Trust Domain Servers authenticate to the webhook: bearer or none. See Authentication.	bearer
webhook.caBundle	No	PEM certificates that the webhook's TLS certificate must chain to. Without it, the Trust Domain Servers use their system's trusted roots.
webhook.timeout	No. Default 5s.	How long the OAuth server waits for a decision, including a retry, from 100 milliseconds to 30 seconds.	2s

Authentication

With auth.method: bearer, each Trust Domain Server sends a bearer token in the Authorization header of every request to the webhook. Set the token in the Helm value trustDomainDeployment.deployment.oauthExternalAuthorizer.token when you install or upgrade your Trust Domain Servers. Every authorizer that uses bearer sends this token. A changed token takes effect within a minute, without a restart.

With auth.method: none, requests carry no credentials.