{"version":"2.1.228","anchor":"gateway-can-verify-caller-identity-against-an-allowlist-off-","canonical_anchor":"gateway-can-verify-caller-identity-against-an-allowlist-off-","heading":"Gateway can verify caller identity against an allowlist, off unless configured","tier":"soon","area":"Gateway","scope":null,"heads_up":null,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.228\/e\/gateway-can-verify-caller-identity-against-an-allowlist-off-","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.228","markdown":"### Gateway can verify caller identity against an allowlist, off unless configured\n\nThe gateway can check caller tokens against an organisation allowlist when you enable it in config.\n\n**What**\n\nThe gateway gained an optional identity-verification block named `cri`, with settings for the expected audience, an allowed-organisation list, and the key and issuer URLs used to check tokens. It only runs when `cri.enabled` is set to true in gateway config; otherwise the boot path is unchanged.\n\n**Details**\n\n- When enabled, the verifier is primed at startup, verified callers are tagged onto upstream requests, and responses for those callers are post-processed.\n- The gateway reads an `x-gateway-upstream-kind` header off upstream responses.\n- OIDC settings became optional, with the group and email claim names defaulting to `groups` and `email`.\n- The two desktop-policy 404 responses now share one error-response helper.\n\n**Evidence**\n\n`x-gateway-upstream-kind`\n\n- Area: Gateway\n- Names: `cri.enabled`\n- Tier: Nothing to try yet\n- Useful: 2\/5\n- Signal: 4\/5\n- Present in the build but not switched on"}