oz0 tenant oidc delegated-off-cluster
A delegated token names the person a job runs for (or a routine's team), with the agent as the actor; an on_behalf_of connection sends one to a service's token endpoint.
For: Operators and developers looking up a command.
A delegated token names the person a job runs for (or a routine's team), with the agent as the actor; an on_behalf_of connection sends one to a service's token endpoint. By default none leaves the cluster: such a token is refused for an audience or a token endpoint outside the cluster's own addresses. Turning this on is a governance change that loosens: it takes --reason and, with four eyes on, another admin's approval.
Whether a service may receive a person's identifier is the tenant's to decide.
Usage
oz0 tenant oidc delegated-off-cluster <tenant> on|off [flags]
Flags
| Flag | Type | Default | Description |
|---|---|---|---|
--decision-ref | string | the decision or case the change follows, such as a case number (at most 200 characters) | |
--json | bool | print JSON | |
--reason | string | why, required for every governance change (at most 500 characters; default $OZ0_REASON); the audit log keeps it |
Inherited flags
| Flag | Type | Default | Description |
|---|---|---|---|
--context | string | $OZ0_CONTEXT or <config dir>/orchestrator-zero/context.json | CLI context file written by server init |
--log-level | string | info | log level: debug, info, warn or error |
See all oz0 commands and the global flags.