afaics it's just `provider="authenticator"` on the firewall node