We have many stand-alone services, such as staff-portal.company.com and "retail-portal.company.com," hosted in different subdomains. We are going to use a cloud identity platform as a single-sign-on system for the enterprise.
We can register multiple authorization domains in the Google Identity Platform console, but the audience of the return token audience is always firebase project-id which is not related to the requested domain. It means the tokens grant access to all services, which is unacceptable.
How can we set different audiences in the Google Identity-Platform token for each requested authorized domain?