Conditions on the token’s claims; at least one. Every one must match. A pattern on
/sub must name the subject before any *.String!
required
The HTTPS URL of the OpenID Connect issuer whose tokens the policy trusts.
String!
required
A label that helps recognize the policy.