"Dynamic" OAUTH2.TokenAudience accessTokenType?

[Scott Cantor]

> On Sep 22, 2026, at 1:31 AM, Simon Lundström via users <users at shibboleth.net> wrote:
> 
> one can only use MetadataDrivenConfiguration right?

Metadata-driven settings simply leverage the built-in support by which most/all settings can be derived with a Function/Predicate, so...no, not really, you can do it yourself.

> There are no other ways to support this use case (short of extending the IDP that is)?

We don't consider that capability an extension, as it's trivial, and we treat Java development capability as a basic prerequisite for running this software as we have since day one.

> Also MDDriven is first matching wins right? So the MDDriven overrides first and then the secure default in relying-party.xml?

No. All static/direct settings override any functional/dynamic injection of the setting.

Property-based defaults typically are wired in as a "default" value for the metadata-derived Function that's injected to return when no tag is found.

-- Scott