In the one-shot workflow IAM provides the results of the authentication to Airlock Gateway using the Gateway Control API. Among other settings, IAM defines how the Airlock Gateway should proceed with the one-shot workflow.
It can choose the command 'CONTINUE' or 'FINAL_RESPONSE' (see Airlock Gateway manual for details):
- FINAL_RESPONSE: Airlock Gateway responds with the answer as provided by IAM, i.e. with the status code, body, etc. that are set in the IAM response.
- CONTINUE: The 'usual' Airlock Gateway workworkflow is continued, i.e. Airlock Gateway checks if the required roles are present, checks deny rules, etc. and responds accordingly. For example, if the user does not have the required roles, Airlock Gateway responds with a 403. This is completely unrelated to the response generated by IAM.