The PlainID IDP Token Enrichment Service integrates with Identity Providers (IDPs) to dynamically enrich users’ Authorizations. During authentication, entitlements calculated by PlainID Policies are translated into claims and included in the IDP-generated JWT, which is then used by Applications.
This pattern allows seamless, session-based access control without requiring the user or Application to interact directly with the PlainID platform. It supports advanced claim enrichment from multiple data sources and adapts to vendor-specific IDP configurations.
HTTPS
Note that this is a preproduction feature that is available to preproduction Tenants.
The IDP webhook receives identity events from your IDP and forwards them to the Agent. Enabling HTTPS puts native TLS on that connection to the Agent, so identity data moving through your PAA is encrypted end to end.
- Kubernetes: set
idpWebhook.ssl.enabled: truein your Helm values. - ECS: set
enable_https = truein yourterraform.tfvars, the same pack-wide flag you use for the rest of your PAA.
See Enabling HTTPS for PAA Services for how certificates are generated or supplied, and what this setting does and doesn't cover.
For detailed deployment and configuration guidance, see the IDP Token Enrichment article.