- metadata:
                    filter: istio_authn
                    path:
                    - key: request.auth.presenter
                    value:
                      stringMatch:
                        suffix: -suffix-presenter
                - metadata:
                    filter: istio_authn
                    path:
                    - key: request.auth.presenter

          notValues: ["not-audiences", "not-audiences-prefix-*", "*-not-suffix-audiences", "*"]
        - key: "request.auth.presenter"
          values: ["presenter", "presenter-prefix-*", "*-suffix-presenter", "*"]
          notValues: ["not-presenter", "not-presenter-prefix-*", "*-not-suffix-presenter", "*"]
        - key: "request.auth.claims[iss]"
          values: ["iss", "iss-prefix-*", "*-suffix-iss", "*"]

      notValues: ["not-audiences", "not-audiences-prefix-*", "*-not-suffix-audiences", "*"]
  - when:
    - key: "request.auth.presenter"
      values: ["presenter", "presenter-prefix-*", "*-suffix-presenter", "*"]
      notValues: ["not-presenter", "not-presenter-prefix-*", "*-not-suffix-presenter", "*"]
  - when:
    - key: "request.auth.claims[iss]"
      values: ["iss", "iss-prefix-*", "*-suffix-iss", "*"]

        notValues: ["not-requestPrincipals"]
      - key: "request.auth.audiences"
        values: ["audiences"]
        notValues: ["not-audiences"]
      - key: "request.auth.presenter"
        values: ["presenter"]
        notValues: ["not-presenter"]
      - key: "request.auth.claims[iss]"
        values: ["iss"]
        notValues: ["not-iss"]
      - key: "destination.ip"
        values: ["10.10.10.10"]

# - Allow request with permission claim of "write" or "append" to access path /permission
# - Allow request with valid JWT token to access path /jwt1
# - Allow request with valid JWT token of presenter bar to access path with suffix "/presenter"
# - Allow request with valid JWT token of audiences foo to access path with suffix "/audiences"

apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:

                            - stringMatch:
                                exact: presenter
                            - stringMatch:
                                prefix: presenter-prefix-
                            - stringMatch:
                                suffix: -suffix-presenter
                            - stringMatch:
                                safeRegex:

        notValues: ["not-requestPrincipals"]
      - key: "request.auth.audiences"
        values: ["audiences"]
        notValues: ["not-audiences"]
      - key: "request.auth.presenter"
        values: ["presenter"]
        notValues: ["not-presenter"]
      - key: "request.auth.claims[iss]"
        values: ["iss"]
        notValues: ["not-iss"]
      - key: "destination.ip"
        values: ["10.10.10.10"]

	attrRequestAudiences = "request.auth.audiences" // intended audience(s) for this authentication information.
	attrRequestPresenter = "request.auth.presenter" // authorized presenter of the credential.
	attrRequestClaims    = "request.auth.claims"    // claim name is surrounded by brackets, e.g. "request.auth.claims[iss]".

		},
		{
			name:  "requestPresenterGenerator",
			g:     requestPresenterGenerator{},
			key:   "request.auth.presenter",
			value: "foo",
			want: yamlPrincipal(t, `
         metadata:
          filter: istio_authn
          path:
          - key: request.auth.presenter
          value:
            stringMatch:
              exact: foo`),
		},
		{
			name:  "requestHeaderGenerator",

	attrRequestAudiences = "request.auth.audiences"      // intended audience(s) for this authentication information.
	attrRequestPresenter = "request.auth.presenter"      // authorized presenter of the credential.
	attrRequestClaims    = "request.auth.claims"         // claim name is surrounded by brackets, e.g. "request.auth.claims[iss]".