User Story
As a API provider,
I want to allow access requests only from users of specific IDPs,
so that I am not reviewing requests from identity providers we will not approve.
Background
Product owners currently receive access requests from any developer IDP (IDIR, Business BCeID, GitHub, BC Services Card). There is no per-environment control to limit that.
Prompted by a pending request from a user the owners could not place (see DATABC-6985), and no policy yet for outside requests.
Acceptance Criteria
- Product owners can set an IDP allowlist on a product environment.
- Unset/empty = current behaviour (any developer IDP may request).
- Users whose IDP is not allowed cannot create a request (API + Directory UI).
- Existing pending requests are unchanged; the control applies to new requests only.
Out of Scope
- Auto-rejecting existing requests
- Showing richer requestor identity on the pending-request UI
- Directory/OAS contact fields
User Story
As a API provider,
I want to allow access requests only from users of specific IDPs,
so that I am not reviewing requests from identity providers we will not approve.
Background
Product owners currently receive access requests from any developer IDP (IDIR, Business BCeID, GitHub, BC Services Card). There is no per-environment control to limit that.
Prompted by a pending request from a user the owners could not place (see DATABC-6985), and no policy yet for outside requests.
Acceptance Criteria
Out of Scope