ReadonlynameA short name for the source, used in log records. Never a secret.
Answers the grants a principal holds.
The signed-in principal's id and, when present, its
iss claim — nothing else
The scopes asked about, or every scope
Aborted when the evaluator's deadline expires
The grants
A source of scoped role grants — a repository, a directory, an identity provider. Several sources are UNIONED; a source that rejects, throws or exceeds its deadline makes the whole check deny.
Every returned value is validated and copied by the evaluator; an invalid grant is dropped, never coerced.
The answer is SHARED between every credential of one principal: AuthPlugin memoises, coalesces and caches it by the principal's id and
issclaim. So the principal a source receives carries only those two fields — no other claims, roles or permissions, which come from the credential and can differ between two tokens for the same user. Grants derived from the credential belong in AuthPlugin'sclaimssource, which is mapped per credential.Since
0.9.0