Repo: darkedges/pf12.3-biscuit-datalog-tokens , plugin source in pf-biscuit-generator/ Part 1 argued for a hybrid: PingFederate issues JWTs at the edge, and token exchange turns them into Biscuits for everything inside. This part builds the one piece PingFederate doesn't ship, a token generator that mints a Biscuit. It's a few hundred lines of Java. Most of the interesting decisions aren't in the Java, though. They're about what you let into the authority block. 1. The ...