reference: add JWT identity providers entries

[wasaga]

updates reference.json for identity_providers (global) and the per-route allowlist

[netlify]

✅ Deploy Preview for pomerium-docs ready!

Name	Link
🔨 Latest commit	89f3994
🔍 Latest deploy log	https://app.netlify.com/projects/pomerium-docs/deploys/6ab161be69f6a1000853c75a
😎 Deploy Preview	https://deploy-preview-2365--pomerium-docs.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.
🤖 Make changes	Run an agent on this branch

---

To edit notification comments on pull requests, go to your Netlify project configuration.

[greptile-apps]

Confidence Score: 4/5

The PR is generally safe to merge, but the missing redirect and contradictory non-JWT guidance should be corrected to avoid broken external links and ambiguous operational documentation.

Findings

1.  Non-JWT Guidance Conflicts ▶

Summary

This PR adds global and per-route JWT identity-provider entries to the configuration reference and renames the per-route reference page for clarity.

• Adds searchable reference metadata for both identity-provider settings.
• Clarifies runtime matching and empty-allowlist semantics.
• Updates the per-route page URL, but does not preserve the former URL with a redirect.
• Introduces conflicting guidance about behavior on non-JWT routes.

_{Reviews (1) · Last reviewed commit: "reference: add JWT identity providers en..."}

[greptile-apps]

Comments Outside Diff

These findings sit on lines the diff does not cover, so they could not be posted inline. Each one leaves this list once its file changes.

•  Old URL Has No Redirect content/docs/reference/routes/identity-providers-per-route.mdx:4 ▶

  Renaming this page changes its published URL from /docs/reference/routes/identity-providers to /docs/reference/routes/identity-providers-per-route, and static/_redirects has no redirect for the former route. If anyone follows an existing bookmark, indexed result, or external link, the old URL will return 404. Please add a permanent redirect.

  A red test proving the redirect is missing:

  import assert from 'node:assert/strict';
  import fs from 'node:fs';
  
  const redirects = fs.readFileSync('static/_redirects', 'utf8');
  assert.match(
    redirects,
    /^\/docs\/reference\/routes\/identity-providers\s+\/docs\/reference\/routes\/identity-providers-per-route\s+301$/m,
    'the former published route must redirect to the renamed page',
  );

  This currently fails because static/_redirects contains no entry for the former route.