> For the complete documentation index, see [llms.txt](https://docs.inrupt.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.inrupt.com/ess/3.1/installation/customize-configurations/customization-security/manage-identity-providers.md).

# Manage Token Issuer Allow/Deny Lists

{% hint style="info" %}
**ESS 3.0 Change**

The [Platform Management Service](/ess/3.1/services/service-platform-management.md) is the only service that accepts external OIDC tokens. All other ESS services exclusively trust ESS Access Tokens issued by the [Platform Management service](/ess/3.1/services/service-platform-management/token-exchange.md). Configure the allow/deny lists on the Platform Management service to control which Identity Providers are trusted.
{% endhint %}

The Platform Management Service can be configured with **`INRUPT_JWT_ISSUER_ALLOW_LIST`** and **`INRUPT_JWT_ISSUER_DENY_LIST`** to manage which external Identity Providers are trusted to issue tokens that can be exchanged for ESS Access Tokens.

## How the Lists Work

* If **`INRUPT_JWT_ISSUER_ALLOW_LIST`** is set, the Platform service only accepts tokens from issuers in the list (subject to the deny list).
* If **`INRUPT_JWT_ISSUER_ALLOW_LIST`** is unset, the Platform service accepts tokens from all issuers (subject to the deny list).
* If **`INRUPT_JWT_ISSUER_DENY_LIST`** is set, the Platform service rejects tokens from those issuers, even if they appear in the allow list. The deny list always takes precedence.

## Example: Update `INRUPT_JWT_ISSUER_ALLOW_LIST`

To restrict the Platform service to only accept tokens from specific Identity Providers:

1. Go to your ESS installation directory:

   ```sh
   cd ${HOME}/ess
   ```
2. Modify the **`kustomization.yaml`** (i.e., step 3 of the [Applying Your Customizations](/ess/3.1/installation/customize-configurations.md) procedure).\
   Specifically, add the highlighted content to the **`kustomization.yaml`** file to the **`patches`** section:

   <pre class="language-yaml"><code class="lang-yaml">
    # kustomization.yaml in your ESS installation directory
    # ...  Preceding content omitted for brevity 
    # ...
    patches:
   <strong>   - target:
   </strong><strong>       kind: Deployment
   </strong><strong>       name: ess-platform-management
   </strong><strong>     patch: |
   </strong><strong>       - op: add
   </strong><strong>         path: /spec/template/spec/containers/0/env/-
   </strong><strong>         value:
   </strong><strong>           name: INRUPT_JWT_ISSUER_ALLOW_LIST
   </strong><strong>           value: "https://login.example.com,https://accounts.google.com"
   </strong><strong> 
   </strong> 
   </code></pre>
3. Continue with the rest of the [Applying Your Customizations](/ess/3.1/installation/customize-configurations.md) procedure.

## Example: Update `INRUPT_JWT_ISSUER_DENY_LIST`

To block specific Identity Providers from being used for token exchange:

1. Go to your ESS installation directory:

   ```sh
   cd ${HOME}/ess
   ```
2. Modify the **`kustomization.yaml`** (i.e., step 3 of the [Applying Your Customizations](/ess/3.1/installation/customize-configurations.md) procedure).\
   Specifically, add the highlighted content to the **`kustomization.yaml`** file to the **`patches`** section:

   <pre class="language-yaml"><code class="lang-yaml">
    # kustomization.yaml in your ESS installation directory
    # ...  Preceding content omitted for brevity 
    # ...
    patches:
   <strong>   - target:
   </strong><strong>       kind: Deployment
   </strong><strong>       name: ess-platform-management
   </strong><strong>     patch: |
   </strong><strong>       - op: add
   </strong><strong>         path: /spec/template/spec/containers/0/env/-
   </strong><strong>         value:
   </strong><strong>           name: INRUPT_JWT_ISSUER_DENY_LIST
   </strong><strong>           value: "https://untrusted-idp.example.com"
   </strong><strong> 
   </strong> 
   </code></pre>
3. Continue with the rest of the [Applying Your Customizations](/ess/3.1/installation/customize-configurations.md) procedure.