Account Policy to Restrict Bearer Token Users

[tbeets]

Feature Request

In operator-mode configurations (JWT-based), an account owner can create bearer token User JWTs using the --bearer option of nsc or the the JWT client libraries.

Some operators may desire to create accounts that explicitly restrict the account owner from creating users with the bearer-token option.

Use Case:

Force client to present User JWT and perform a challenge-and-response authentication, i.e. sign nonce using possessed private NKEY.

Proposed Change:

Add an account-level claim that asserts that the account may not issue bearer User JWTs.

Who Benefits From The Change(s)?

Organizations/operators that have a policy against bearer token usage at runtime, but otherwise enable account owners to manage their own user lifecycle.

Alternative Approaches