# The FederationPolicy object

## Attributes

- `name` (string)
  Name of the federation policy. A recipient can have multiple policies with different names.
   The name must contain only lowercase alphanumeric characters, numbers, and hyphens.
  Example: `my-federation-policy1`
- `oidc_policy` (object)
  Specifies the policy to use for validating OIDC claims in the federated tokens.
  - `issuer` (string)
    The required token issuer, as specified in the 'iss' claim of federated tokens.
    Example: `https://myidp.example.com/oidc`
  - `subject_claim` (string)
    The claim that contains the subject of the token.
     Depending on the identity provider and the use case (U2M or M2M), this can vary:
     - For Entra ID (AAD):
       * U2M flow (group access): Use `groups`.
       * U2M flow (user access): Use `oid`.
       * M2M flow (OAuth App access): Use `azp`.
     - For other IdPs, refer to the specific IdP documentation.
    
     Supported `subject_claim` values are:
     - `oid`: Object ID of the user.
     - `azp`: Client ID of the OAuth app.
     - `groups`: Object ID of the group.
     - `sub`: Subject identifier for other use cases.
    Example: `azp`
  - `subject` (string)
    The required token subject, as specified in the subject claim of federated tokens.
     The subject claim identifies the identity of the user or machine accessing the resource.
     Examples for Entra ID (AAD):
     - U2M flow (group access): If the subject claim is `groups`, this must be the Object ID of the group in Entra ID.
     - U2M flow (user access): If the subject claim is `oid`, this must be the Object ID of the user in Entra ID.
     - M2M flow (OAuth App access): If the subject claim is `azp`, this must be the client ID of the OAuth app registered in Entra ID.
  - `audiences` (array of string)
    The allowed token audiences, as specified in the 'aud' claim of federated tokens.
     The audience identifier is intended to represent the recipient of the token.
     Can be any non-empty string value. As long as the audience in the token matches at least one audience in the policy,
- `create_time` (string)
  System-generated timestamp indicating when the policy was created.
- `comment` (string)
  Description of the policy. This is a user-provided description.
  Example: `My federation policy description.`
- `update_time` (string)
  System-generated timestamp indicating when the policy was last updated.
- `id` (string)
  Unique, immutable system-generated identifier for the federation policy.

## Example

```json
{
  "name": "my-federation-policy1",
  "oidc_policy": {
    "issuer": "https://myidp.example.com/oidc",
    "subject_claim": "azp",
    "subject": "string",
    "audiences": [
      "string"
    ]
  },
  "create_time": "string",
  "comment": "My federation policy description.",
  "update_time": "string",
  "id": "string"
}
```