zuplo 6.72.3 → 6.72.8

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (96) hide show
  1. package/docs/analytics/access-and-entitlements.md +27 -34
  2. package/docs/analytics/overview.md +7 -6
  3. package/docs/analytics/reference/url-parameters.md +2 -10
  4. package/docs/analytics/shared-controls.md +3 -10
  5. package/docs/analytics/tabs/agents.md +3 -3
  6. package/docs/analytics/tabs/requests.md +2 -4
  7. package/docs/articles/connect-to-aws-alb-with-mtls.mdx +89 -13
  8. package/docs/articles/ddos-protection.mdx +2 -2
  9. package/docs/articles/graphql-security.mdx +2 -1
  10. package/docs/articles/graphql.mdx +8 -0
  11. package/docs/articles/limits.mdx +12 -0
  12. package/docs/articles/local-development-troubleshooting.mdx +12 -3
  13. package/docs/articles/opentelemetry.mdx +7 -5
  14. package/docs/articles/securing-backend-mtls.mdx +92 -3
  15. package/docs/articles/troubleshooting-slow-responses.mdx +4 -3
  16. package/docs/articles/troubleshooting.md +3 -1
  17. package/docs/articles/waf-ddos.mdx +1 -24
  18. package/docs/policies/_index.md +2 -0
  19. package/docs/policies/akamai-ai-firewall/schema.json +1 -0
  20. package/docs/policies/akamai-firewall-for-ai-inbound/schema.json +2 -0
  21. package/docs/policies/akamai-firewall-for-ai-outbound/schema.json +2 -0
  22. package/docs/policies/amberflo-metering-inbound/schema.json +5 -2
  23. package/docs/policies/api-key-inbound/schema.json +11 -5
  24. package/docs/policies/audit-log-inbound/schema.json +2 -0
  25. package/docs/policies/auth0-jwt-auth-inbound/schema.json +7 -5
  26. package/docs/policies/authzen-inbound/schema.json +7 -5
  27. package/docs/policies/axiomatics-authz-inbound/schema.json +14 -6
  28. package/docs/policies/basic-auth-inbound/schema.json +2 -1
  29. package/docs/policies/caching-inbound/schema.json +20 -16
  30. package/docs/policies/clerk-jwt-auth-inbound/schema.json +8 -6
  31. package/docs/policies/cognito-jwt-auth-inbound/schema.json +7 -5
  32. package/docs/policies/comet-opik-tracing-inbound/schema.json +1 -0
  33. package/docs/policies/complex-rate-limit-inbound/schema.json +4 -0
  34. package/docs/policies/curity-phantom-token-inbound/schema.json +1 -0
  35. package/docs/policies/data-loss-prevention-inbound/schema.json +15 -12
  36. package/docs/policies/data-loss-prevention-outbound/schema.json +15 -12
  37. package/docs/policies/firebase-jwt-inbound/schema.json +7 -5
  38. package/docs/policies/formdata-to-json-inbound/schema.json +1 -0
  39. package/docs/policies/galileo-tracing-inbound/schema.json +1 -0
  40. package/docs/policies/geo-filter-inbound/schema.json +1 -0
  41. package/docs/policies/graphql-analytics-outbound/schema.json +1 -0
  42. package/docs/policies/mcp-auth0-oauth-inbound/schema.json +11 -5
  43. package/docs/policies/mcp-clerk-oauth-inbound/schema.json +81 -0
  44. package/docs/policies/mcp-cognito-oauth-inbound/schema.json +81 -0
  45. package/docs/policies/mcp-entra-oauth-inbound/schema.json +81 -0
  46. package/docs/policies/mcp-google-oauth-inbound/schema.json +81 -0
  47. package/docs/policies/mcp-keycloak-oauth-inbound/schema.json +81 -0
  48. package/docs/policies/mcp-logto-oauth-inbound/schema.json +81 -0
  49. package/docs/policies/mcp-oauth-inbound/schema.json +10 -5
  50. package/docs/policies/mcp-okta-oauth-inbound/schema.json +81 -0
  51. package/docs/policies/mcp-onelogin-oauth-inbound/schema.json +81 -0
  52. package/docs/policies/mcp-ping-oauth-inbound/schema.json +81 -0
  53. package/docs/policies/mcp-token-exchange-inbound/doc.md +72 -4
  54. package/docs/policies/mcp-token-exchange-inbound/intro.md +5 -4
  55. package/docs/policies/mcp-token-exchange-inbound/schema.json +287 -7
  56. package/docs/policies/mcp-workos-oauth-inbound/schema.json +81 -0
  57. package/docs/policies/monetization-inbound/schema.json +25 -23
  58. package/docs/policies/mtls-auth-inbound/schema.json +6 -5
  59. package/docs/policies/okta-fga-authz-inbound/schema.json +7 -6
  60. package/docs/policies/okta-jwt-auth-inbound/schema.json +7 -5
  61. package/docs/policies/open-id-jwt-auth-inbound/schema.json +14 -9
  62. package/docs/policies/openfga-authz-inbound/schema.json +7 -6
  63. package/docs/policies/openmeter-inbound/schema.json +23 -19
  64. package/docs/policies/prompt-injection-outbound/schema.json +6 -5
  65. package/docs/policies/propel-auth-jwt-inbound/schema.json +10 -8
  66. package/docs/policies/query-param-to-header-inbound/schema.json +1 -0
  67. package/docs/policies/quota-inbound/schema.json +9 -6
  68. package/docs/policies/rate-limit-inbound/schema.json +4 -0
  69. package/docs/policies/readme-metrics-inbound/schema.json +9 -5
  70. package/docs/policies/request-size-limit-inbound/schema.json +1 -0
  71. package/docs/policies/request-validation-inbound/schema.json +8 -6
  72. package/docs/policies/require-origin-inbound/schema.json +1 -0
  73. package/docs/policies/semantic-cache-inbound/schema.json +9 -5
  74. package/docs/policies/set-status-outbound/schema.json +1 -0
  75. package/docs/policies/set-upstream-api-key-inbound/schema.json +7 -5
  76. package/docs/policies/stripe-webhook-verification-inbound/schema.json +2 -1
  77. package/docs/policies/supabase-jwt-auth-inbound/schema.json +7 -5
  78. package/docs/policies/traffic-splitting-inbound/schema.json +1 -0
  79. package/docs/policies/upstream-aws-federated-auth-inbound/doc.md +78 -0
  80. package/docs/policies/upstream-aws-federated-auth-inbound/intro.md +20 -0
  81. package/docs/policies/upstream-aws-federated-auth-inbound/schema.json +104 -0
  82. package/docs/policies/upstream-aws-service-auth-inbound/doc.md +89 -0
  83. package/docs/policies/upstream-aws-service-auth-inbound/intro.md +19 -0
  84. package/docs/policies/upstream-aws-service-auth-inbound/schema.json +121 -0
  85. package/docs/policies/upstream-azure-ad-service-auth-inbound/schema.json +7 -5
  86. package/docs/policies/upstream-firebase-admin-auth-inbound/schema.json +2 -0
  87. package/docs/policies/upstream-firebase-user-auth-inbound/schema.json +8 -5
  88. package/docs/policies/upstream-gcp-federated-auth-inbound/doc.md +2 -2
  89. package/docs/policies/upstream-gcp-federated-auth-inbound/schema.json +8 -4
  90. package/docs/policies/upstream-gcp-service-auth-inbound/doc.md +3 -3
  91. package/docs/policies/upstream-gcp-service-auth-inbound/schema.json +8 -3
  92. package/docs/policies/upstream-zuplo-jwt-auth-inbound/schema.json +39 -15
  93. package/docs/policies/web-bot-auth-inbound/schema.json +2 -0
  94. package/docs/policies/xml-to-json-outbound/schema.json +9 -5
  95. package/package.json +4 -4
  96. package/docs/articles/zuplo-waf.mdx +0 -156
package/docs/policies/firebase-jwt-inbound/schema.json CHANGED
@@ -35,19 +35,21 @@
35
35
  "additionalProperties": false,
36
36
  "required": ["projectId"],
37
37
  "properties": {
38
- "allowUnauthenticatedRequests": {
39
- "type": "boolean",
40
- "default": false,
41
- "description": "Allow unauthenticated requests to proceed. This is use useful if you want to use multiple authentication policies or if you want to allow both authenticated and non-authenticated traffic."
42
- },
43
38
  "projectId": {
44
39
  "type": "string",
45
40
  "examples": ["my-project-id"],
46
41
  "description": "Your Firebase Project ID."
47
42
  },
43
+ "allowUnauthenticatedRequests": {
44
+ "type": "boolean",
45
+ "default": false,
46
+ "x-advanced": true,
47
+ "description": "Allow unauthenticated requests to proceed. This is use useful if you want to use multiple authentication policies or if you want to allow both authenticated and non-authenticated traffic."
48
+ },
48
49
  "oAuthResourceMetadataEnabled": {
49
50
  "type": "boolean",
50
51
  "default": false,
52
+ "x-advanced": true,
51
53
  "description": "Flag that determines whether OAuth protected resource metadata is enabled."
52
54
  }
53
55
  }
package/docs/policies/formdata-to-json-inbound/schema.json CHANGED
@@ -42,6 +42,7 @@
42
42
  },
43
43
  "optionalHoneypotName": {
44
44
  "type": "string",
45
+ "x-advanced": true,
45
46
  "description": "The name of the honeypot field. Used to provide basic spam filtering."
46
47
  }
47
48
  }
package/docs/policies/galileo-tracing-inbound/schema.json CHANGED
@@ -46,6 +46,7 @@
46
46
  "type": "string"
47
47
  },
48
48
  "baseUrl": {
49
+ "x-advanced": true,
49
50
  "description": "The base URL for the Galileo API (optional, defaults to https://api.galileo.ai).",
50
51
  "type": "string"
51
52
  }
package/docs/policies/geo-filter-inbound/schema.json CHANGED
@@ -80,6 +80,7 @@
80
80
  "ignoreUnknown": {
81
81
  "type": "boolean",
82
82
  "default": true,
83
+ "x-advanced": true,
83
84
  "description": "Specifies whether unknown geo-location parameters should be ignored (allowed through)."
84
85
  }
85
86
  }
package/docs/policies/graphql-analytics-outbound/schema.json CHANGED
@@ -70,6 +70,7 @@
70
70
  "maximum": 5242880,
71
71
  "default": 131072,
72
72
  "x-show-example": false,
73
+ "x-advanced": true,
73
74
  "description": "How many bytes of the response body the policy reads to look for GraphQL errors. The body is read and scanned for the `errors` token up to this limit; a body larger than the limit — by `Content-Length`, or measured while reading when the header is absent — is treated as error-free, so any errors it carries go unreported. The default of 128 KiB suits the common case, where servers emit `errors` near the front of the body. Raise it (up to the 5 MiB maximum) to detect errors in larger responses, at the cost of reading more of every response. When the token is found and the body fits within the limit, the body is parsed and its errors are reported."
74
75
  }
75
76
  }
package/docs/policies/mcp-auth0-oauth-inbound/schema.json CHANGED
@@ -61,6 +61,7 @@
61
61
  },
62
62
  "gateway": {
63
63
  "type": "object",
64
+ "x-advanced": true,
64
65
  "description": "Gateway-side OAuth token settings. The gateway issuer and advertised URLs are derived from the incoming request origin.",
65
66
  "additionalProperties": false,
66
67
  "properties": {
@@ -84,6 +85,7 @@
84
85
  }
85
86
  },
86
87
  "idJag": {
88
+ "x-advanced": true,
87
89
  "description": "Optional Identity Assertion JWT Authorization Grant (ID-JAG / XAA) support for the gateway token endpoint.",
88
90
  "oneOf": [
89
91
  {
@@ -100,7 +102,7 @@
100
102
  {
101
103
  "type": "object",
102
104
  "additionalProperties": false,
103
- "required": ["enabled", "trustedIssuers"],
105
+ "required": ["enabled"],
104
106
  "properties": {
105
107
  "enabled": {
106
108
  "const": true,
@@ -109,21 +111,24 @@
109
111
  "trustedIssuers": {
110
112
  "type": "array",
111
113
  "minItems": 1,
112
- "description": "Trusted ID-JAG issuers. These values are never published in OAuth metadata.",
114
+ "description": "Trusted ID-JAG issuers. These values are never published in OAuth metadata. Omit to trust this policy's browser-login IdP.",
113
115
  "items": {
114
116
  "type": "object",
115
117
  "additionalProperties": false,
116
- "required": ["issuer", "jwksUrl"],
118
+ "dependentRequired": {
119
+ "issuer": ["jwksUrl"],
120
+ "jwksUrl": ["issuer"]
121
+ },
117
122
  "properties": {
118
123
  "issuer": {
119
124
  "type": "string",
120
125
  "format": "uri",
121
- "description": "Exact issuer URL expected in the ID-JAG iss claim."
126
+ "description": "Exact issuer URL expected in the ID-JAG iss claim. Provide together with jwksUrl, or omit both to default to this policy's browser-login IdP."
122
127
  },
123
128
  "jwksUrl": {
124
129
  "type": "string",
125
130
  "format": "uri",
126
- "description": "JWKS URL used to verify ID-JAG signatures from this issuer."
131
+ "description": "JWKS URL used to verify ID-JAG signatures from this issuer. Provide together with issuer, or omit both to default to this policy's browser-login IdP."
127
132
  },
128
133
  "expectedClientIds": {
129
134
  "type": "array",
@@ -160,6 +165,7 @@
160
165
  },
161
166
  "browserLoginOverrides": {
162
167
  "type": "object",
168
+ "x-advanced": true,
163
169
  "description": "Optional overrides for the derived browser-login settings.",
164
170
  "additionalProperties": false,
165
171
  "properties": {
package/docs/policies/mcp-clerk-oauth-inbound/schema.json CHANGED
@@ -60,6 +60,7 @@
60
60
  },
61
61
  "gateway": {
62
62
  "type": "object",
63
+ "x-advanced": true,
63
64
  "description": "Gateway-side OAuth token settings. The gateway issuer and advertised URLs are derived from the incoming request origin.",
64
65
  "additionalProperties": false,
65
66
  "properties": {
@@ -82,8 +83,88 @@
82
83
  }
83
84
  }
84
85
  },
86
+ "idJag": {
87
+ "x-advanced": true,
88
+ "description": "Optional Identity Assertion JWT Authorization Grant (ID-JAG / XAA) support for the gateway token endpoint.",
89
+ "oneOf": [
90
+ {
91
+ "type": "object",
92
+ "additionalProperties": false,
93
+ "required": ["enabled"],
94
+ "properties": {
95
+ "enabled": {
96
+ "const": false,
97
+ "description": "Disable ID-JAG support."
98
+ }
99
+ }
100
+ },
101
+ {
102
+ "type": "object",
103
+ "additionalProperties": false,
104
+ "required": ["enabled"],
105
+ "properties": {
106
+ "enabled": {
107
+ "const": true,
108
+ "description": "Enable ID-JAG support."
109
+ },
110
+ "trustedIssuers": {
111
+ "type": "array",
112
+ "minItems": 1,
113
+ "description": "Trusted ID-JAG issuers. These values are never published in OAuth metadata. Omit to trust this policy's browser-login IdP.",
114
+ "items": {
115
+ "type": "object",
116
+ "additionalProperties": false,
117
+ "dependentRequired": {
118
+ "issuer": ["jwksUrl"],
119
+ "jwksUrl": ["issuer"]
120
+ },
121
+ "properties": {
122
+ "issuer": {
123
+ "type": "string",
124
+ "format": "uri",
125
+ "description": "Exact issuer URL expected in the ID-JAG iss claim. Provide together with jwksUrl, or omit both to default to this policy's browser-login IdP."
126
+ },
127
+ "jwksUrl": {
128
+ "type": "string",
129
+ "format": "uri",
130
+ "description": "JWKS URL used to verify ID-JAG signatures from this issuer. Provide together with issuer, or omit both to default to this policy's browser-login IdP."
131
+ },
132
+ "expectedClientIds": {
133
+ "type": "array",
134
+ "items": {
135
+ "type": "string",
136
+ "minLength": 1
137
+ },
138
+ "description": "Optional allow-list of client IDs accepted from this issuer. The ID-JAG client_id must still match the authenticated token-endpoint client."
139
+ },
140
+ "subjectMapping": {
141
+ "type": "string",
142
+ "enum": [
143
+ "iss_prefix",
144
+ "iss_tenant_prefix",
145
+ "sub_id_only"
146
+ ],
147
+ "default": "iss_prefix",
148
+ "description": "How the ID-JAG subject is mapped into the gateway subject ID."
149
+ }
150
+ }
151
+ }
152
+ },
153
+ "authorizationDetailsTypesAllowed": {
154
+ "type": "array",
155
+ "items": {
156
+ "type": "string",
157
+ "minLength": 1
158
+ },
159
+ "description": "Optional allow-list of RFC 9396 authorization_details type values accepted from ID-JAGs."
160
+ }
161
+ }
162
+ }
163
+ ]
164
+ },
85
165
  "browserLoginOverrides": {
86
166
  "type": "object",
167
+ "x-advanced": true,
87
168
  "description": "Optional overrides for the derived browser-login settings.",
88
169
  "additionalProperties": false,
89
170
  "properties": {
package/docs/policies/mcp-cognito-oauth-inbound/schema.json CHANGED
@@ -76,6 +76,7 @@
76
76
  },
77
77
  "gateway": {
78
78
  "type": "object",
79
+ "x-advanced": true,
79
80
  "description": "Gateway-side OAuth token settings. The gateway issuer and advertised URLs are derived from the incoming request origin.",
80
81
  "additionalProperties": false,
81
82
  "properties": {
@@ -98,8 +99,88 @@
98
99
  }
99
100
  }
100
101
  },
102
+ "idJag": {
103
+ "x-advanced": true,
104
+ "description": "Optional Identity Assertion JWT Authorization Grant (ID-JAG / XAA) support for the gateway token endpoint.",
105
+ "oneOf": [
106
+ {
107
+ "type": "object",
108
+ "additionalProperties": false,
109
+ "required": ["enabled"],
110
+ "properties": {
111
+ "enabled": {
112
+ "const": false,
113
+ "description": "Disable ID-JAG support."
114
+ }
115
+ }
116
+ },
117
+ {
118
+ "type": "object",
119
+ "additionalProperties": false,
120
+ "required": ["enabled"],
121
+ "properties": {
122
+ "enabled": {
123
+ "const": true,
124
+ "description": "Enable ID-JAG support."
125
+ },
126
+ "trustedIssuers": {
127
+ "type": "array",
128
+ "minItems": 1,
129
+ "description": "Trusted ID-JAG issuers. These values are never published in OAuth metadata. Omit to trust this policy's browser-login IdP.",
130
+ "items": {
131
+ "type": "object",
132
+ "additionalProperties": false,
133
+ "dependentRequired": {
134
+ "issuer": ["jwksUrl"],
135
+ "jwksUrl": ["issuer"]
136
+ },
137
+ "properties": {
138
+ "issuer": {
139
+ "type": "string",
140
+ "format": "uri",
141
+ "description": "Exact issuer URL expected in the ID-JAG iss claim. Provide together with jwksUrl, or omit both to default to this policy's browser-login IdP."
142
+ },
143
+ "jwksUrl": {
144
+ "type": "string",
145
+ "format": "uri",
146
+ "description": "JWKS URL used to verify ID-JAG signatures from this issuer. Provide together with issuer, or omit both to default to this policy's browser-login IdP."
147
+ },
148
+ "expectedClientIds": {
149
+ "type": "array",
150
+ "items": {
151
+ "type": "string",
152
+ "minLength": 1
153
+ },
154
+ "description": "Optional allow-list of client IDs accepted from this issuer. The ID-JAG client_id must still match the authenticated token-endpoint client."
155
+ },
156
+ "subjectMapping": {
157
+ "type": "string",
158
+ "enum": [
159
+ "iss_prefix",
160
+ "iss_tenant_prefix",
161
+ "sub_id_only"
162
+ ],
163
+ "default": "iss_prefix",
164
+ "description": "How the ID-JAG subject is mapped into the gateway subject ID."
165
+ }
166
+ }
167
+ }
168
+ },
169
+ "authorizationDetailsTypesAllowed": {
170
+ "type": "array",
171
+ "items": {
172
+ "type": "string",
173
+ "minLength": 1
174
+ },
175
+ "description": "Optional allow-list of RFC 9396 authorization_details type values accepted from ID-JAGs."
176
+ }
177
+ }
178
+ }
179
+ ]
180
+ },
101
181
  "browserLoginOverrides": {
102
182
  "type": "object",
183
+ "x-advanced": true,
103
184
  "description": "Optional overrides for the derived browser-login settings.",
104
185
  "additionalProperties": false,
105
186
  "properties": {
package/docs/policies/mcp-entra-oauth-inbound/schema.json CHANGED
@@ -57,6 +57,7 @@
57
57
  },
58
58
  "gateway": {
59
59
  "type": "object",
60
+ "x-advanced": true,
60
61
  "description": "Gateway-side OAuth token settings. The gateway issuer and advertised URLs are derived from the incoming request origin.",
61
62
  "additionalProperties": false,
62
63
  "properties": {
@@ -79,8 +80,88 @@
79
80
  }
80
81
  }
81
82
  },
83
+ "idJag": {
84
+ "x-advanced": true,
85
+ "description": "Optional Identity Assertion JWT Authorization Grant (ID-JAG / XAA) support for the gateway token endpoint.",
86
+ "oneOf": [
87
+ {
88
+ "type": "object",
89
+ "additionalProperties": false,
90
+ "required": ["enabled"],
91
+ "properties": {
92
+ "enabled": {
93
+ "const": false,
94
+ "description": "Disable ID-JAG support."
95
+ }
96
+ }
97
+ },
98
+ {
99
+ "type": "object",
100
+ "additionalProperties": false,
101
+ "required": ["enabled"],
102
+ "properties": {
103
+ "enabled": {
104
+ "const": true,
105
+ "description": "Enable ID-JAG support."
106
+ },
107
+ "trustedIssuers": {
108
+ "type": "array",
109
+ "minItems": 1,
110
+ "description": "Trusted ID-JAG issuers. These values are never published in OAuth metadata. Omit to trust this policy's browser-login IdP.",
111
+ "items": {
112
+ "type": "object",
113
+ "additionalProperties": false,
114
+ "dependentRequired": {
115
+ "issuer": ["jwksUrl"],
116
+ "jwksUrl": ["issuer"]
117
+ },
118
+ "properties": {
119
+ "issuer": {
120
+ "type": "string",
121
+ "format": "uri",
122
+ "description": "Exact issuer URL expected in the ID-JAG iss claim. Provide together with jwksUrl, or omit both to default to this policy's browser-login IdP."
123
+ },
124
+ "jwksUrl": {
125
+ "type": "string",
126
+ "format": "uri",
127
+ "description": "JWKS URL used to verify ID-JAG signatures from this issuer. Provide together with issuer, or omit both to default to this policy's browser-login IdP."
128
+ },
129
+ "expectedClientIds": {
130
+ "type": "array",
131
+ "items": {
132
+ "type": "string",
133
+ "minLength": 1
134
+ },
135
+ "description": "Optional allow-list of client IDs accepted from this issuer. The ID-JAG client_id must still match the authenticated token-endpoint client."
136
+ },
137
+ "subjectMapping": {
138
+ "type": "string",
139
+ "enum": [
140
+ "iss_prefix",
141
+ "iss_tenant_prefix",
142
+ "sub_id_only"
143
+ ],
144
+ "default": "iss_prefix",
145
+ "description": "How the ID-JAG subject is mapped into the gateway subject ID."
146
+ }
147
+ }
148
+ }
149
+ },
150
+ "authorizationDetailsTypesAllowed": {
151
+ "type": "array",
152
+ "items": {
153
+ "type": "string",
154
+ "minLength": 1
155
+ },
156
+ "description": "Optional allow-list of RFC 9396 authorization_details type values accepted from ID-JAGs."
157
+ }
158
+ }
159
+ }
160
+ ]
161
+ },
82
162
  "browserLoginOverrides": {
83
163
  "type": "object",
164
+ "x-advanced": true,
84
165
  "description": "Optional overrides for the derived browser-login settings.",
85
166
  "additionalProperties": false,
86
167
  "properties": {
package/docs/policies/mcp-google-oauth-inbound/schema.json CHANGED
@@ -52,6 +52,7 @@
52
52
  },
53
53
  "gateway": {
54
54
  "type": "object",
55
+ "x-advanced": true,
55
56
  "description": "Gateway-side OAuth token settings. The gateway issuer and advertised URLs are derived from the incoming request origin.",
56
57
  "additionalProperties": false,
57
58
  "properties": {
@@ -74,8 +75,88 @@
74
75
  }
75
76
  }
76
77
  },
78
+ "idJag": {
79
+ "x-advanced": true,
80
+ "description": "Optional Identity Assertion JWT Authorization Grant (ID-JAG / XAA) support for the gateway token endpoint.",
81
+ "oneOf": [
82
+ {
83
+ "type": "object",
84
+ "additionalProperties": false,
85
+ "required": ["enabled"],
86
+ "properties": {
87
+ "enabled": {
88
+ "const": false,
89
+ "description": "Disable ID-JAG support."
90
+ }
91
+ }
92
+ },
93
+ {
94
+ "type": "object",
95
+ "additionalProperties": false,
96
+ "required": ["enabled"],
97
+ "properties": {
98
+ "enabled": {
99
+ "const": true,
100
+ "description": "Enable ID-JAG support."
101
+ },
102
+ "trustedIssuers": {
103
+ "type": "array",
104
+ "minItems": 1,
105
+ "description": "Trusted ID-JAG issuers. These values are never published in OAuth metadata. Omit to trust this policy's browser-login IdP.",
106
+ "items": {
107
+ "type": "object",
108
+ "additionalProperties": false,
109
+ "dependentRequired": {
110
+ "issuer": ["jwksUrl"],
111
+ "jwksUrl": ["issuer"]
112
+ },
113
+ "properties": {
114
+ "issuer": {
115
+ "type": "string",
116
+ "format": "uri",
117
+ "description": "Exact issuer URL expected in the ID-JAG iss claim. Provide together with jwksUrl, or omit both to default to this policy's browser-login IdP."
118
+ },
119
+ "jwksUrl": {
120
+ "type": "string",
121
+ "format": "uri",
122
+ "description": "JWKS URL used to verify ID-JAG signatures from this issuer. Provide together with issuer, or omit both to default to this policy's browser-login IdP."
123
+ },
124
+ "expectedClientIds": {
125
+ "type": "array",
126
+ "items": {
127
+ "type": "string",
128
+ "minLength": 1
129
+ },
130
+ "description": "Optional allow-list of client IDs accepted from this issuer. The ID-JAG client_id must still match the authenticated token-endpoint client."
131
+ },
132
+ "subjectMapping": {
133
+ "type": "string",
134
+ "enum": [
135
+ "iss_prefix",
136
+ "iss_tenant_prefix",
137
+ "sub_id_only"
138
+ ],
139
+ "default": "iss_prefix",
140
+ "description": "How the ID-JAG subject is mapped into the gateway subject ID."
141
+ }
142
+ }
143
+ }
144
+ },
145
+ "authorizationDetailsTypesAllowed": {
146
+ "type": "array",
147
+ "items": {
148
+ "type": "string",
149
+ "minLength": 1
150
+ },
151
+ "description": "Optional allow-list of RFC 9396 authorization_details type values accepted from ID-JAGs."
152
+ }
153
+ }
154
+ }
155
+ ]
156
+ },
77
157
  "browserLoginOverrides": {
78
158
  "type": "object",
159
+ "x-advanced": true,
79
160
  "description": "Optional overrides for the derived browser-login settings.",
80
161
  "additionalProperties": false,
81
162
  "properties": {
package/docs/policies/mcp-keycloak-oauth-inbound/schema.json CHANGED
@@ -65,6 +65,7 @@
65
65
  },
66
66
  "gateway": {
67
67
  "type": "object",
68
+ "x-advanced": true,
68
69
  "description": "Gateway-side OAuth token settings. The gateway issuer and advertised URLs are derived from the incoming request origin.",
69
70
  "additionalProperties": false,
70
71
  "properties": {
@@ -87,8 +88,88 @@
87
88
  }
88
89
  }
89
90
  },
91
+ "idJag": {
92
+ "x-advanced": true,
93
+ "description": "Optional Identity Assertion JWT Authorization Grant (ID-JAG / XAA) support for the gateway token endpoint.",
94
+ "oneOf": [
95
+ {
96
+ "type": "object",
97
+ "additionalProperties": false,
98
+ "required": ["enabled"],
99
+ "properties": {
100
+ "enabled": {
101
+ "const": false,
102
+ "description": "Disable ID-JAG support."
103
+ }
104
+ }
105
+ },
106
+ {
107
+ "type": "object",
108
+ "additionalProperties": false,
109
+ "required": ["enabled"],
110
+ "properties": {
111
+ "enabled": {
112
+ "const": true,
113
+ "description": "Enable ID-JAG support."
114
+ },
115
+ "trustedIssuers": {
116
+ "type": "array",
117
+ "minItems": 1,
118
+ "description": "Trusted ID-JAG issuers. These values are never published in OAuth metadata. Omit to trust this policy's browser-login IdP.",
119
+ "items": {
120
+ "type": "object",
121
+ "additionalProperties": false,
122
+ "dependentRequired": {
123
+ "issuer": ["jwksUrl"],
124
+ "jwksUrl": ["issuer"]
125
+ },
126
+ "properties": {
127
+ "issuer": {
128
+ "type": "string",
129
+ "format": "uri",
130
+ "description": "Exact issuer URL expected in the ID-JAG iss claim. Provide together with jwksUrl, or omit both to default to this policy's browser-login IdP."
131
+ },
132
+ "jwksUrl": {
133
+ "type": "string",
134
+ "format": "uri",
135
+ "description": "JWKS URL used to verify ID-JAG signatures from this issuer. Provide together with issuer, or omit both to default to this policy's browser-login IdP."
136
+ },
137
+ "expectedClientIds": {
138
+ "type": "array",
139
+ "items": {
140
+ "type": "string",
141
+ "minLength": 1
142
+ },
143
+ "description": "Optional allow-list of client IDs accepted from this issuer. The ID-JAG client_id must still match the authenticated token-endpoint client."
144
+ },
145
+ "subjectMapping": {
146
+ "type": "string",
147
+ "enum": [
148
+ "iss_prefix",
149
+ "iss_tenant_prefix",
150
+ "sub_id_only"
151
+ ],
152
+ "default": "iss_prefix",
153
+ "description": "How the ID-JAG subject is mapped into the gateway subject ID."
154
+ }
155
+ }
156
+ }
157
+ },
158
+ "authorizationDetailsTypesAllowed": {
159
+ "type": "array",
160
+ "items": {
161
+ "type": "string",
162
+ "minLength": 1
163
+ },
164
+ "description": "Optional allow-list of RFC 9396 authorization_details type values accepted from ID-JAGs."
165
+ }
166
+ }
167
+ }
168
+ ]
169
+ },
90
170
  "browserLoginOverrides": {
91
171
  "type": "object",
172
+ "x-advanced": true,
92
173
  "description": "Optional overrides for the derived browser-login settings.",
93
174
  "additionalProperties": false,
94
175
  "properties": {