Sketch of enhancing Istio authn policy to allow configuration of any ext_authz filter

policy.yml

apiVersion: "authentication.istio.io/v1alpha1"
kind: "Policy"
metadata:
  name: "authcode-sample-app-authn-policy"
spec:
  targets:
    - name: authcode-sample-app
  principalBinding: USE_ORIGIN
  origins:
    - jwt:
        issuer: https://oidc-provider.yourcompany.com/oauth/token
        jwksUri: https://oidc-provider.yourcompany.com/token_keys
        # This is the new part, which would add an envoy ext_authz filter
        authService:
          address: 127.0.0.1
          port_value: 10003