Use existing provisioner flag instead of redefining one

command/ca/policy/actions/cn.go

@@ -56,7 +56,7 @@ $ step ca policy authority x509 deny cn "My Bad CA Name"
 			commonNamesAction,
 		),
 		Flags: []cli.Flag{
-			provisionerFilterFlag,
+			flags.Provisioner,
 			flags.EABKeyID,
 			flags.EABReference,
 			cli.BoolFlag{

command/ca/policy/actions/dns.go

@@ -74,7 +74,7 @@ $ step ca policy authority ssh host allow dns "badsshhost.local"
 			dnsAction,
 		),
 		Flags: []cli.Flag{
-			provisionerFilterFlag,
+			flags.Provisioner,
 			flags.EABKeyID,
 			flags.EABReference,
 			cli.BoolFlag{

command/ca/policy/actions/emails.go

@@ -63,7 +63,7 @@ $ step ca policy provisioner ssh user deny email @example.com --provisioner my_p
 			emailAction,
 		),
 		Flags: []cli.Flag{
-			provisionerFilterFlag,
+			flags.Provisioner,
 			cli.BoolFlag{
 				Name:  "remove",
 				Usage: `removes the provided emails from the policy instead of adding them`,

command/ca/policy/actions/ips.go

@@ -94,7 +94,7 @@ $ step ca policy authority ssh host deny ip 192.168.0.40
 			ipAction,
 		),
 		Flags: []cli.Flag{
-			provisionerFilterFlag,
+			flags.Provisioner,
 			flags.EABKeyID,
 			flags.EABReference,
 			cli.BoolFlag{

command/ca/policy/actions/policy.go

@@ -7,7 +7,6 @@ import (
 	"errors"
 	"fmt"
 
-	"github.com/urfave/cli"
 	"google.golang.org/protobuf/encoding/protojson"
 
 	"github.com/smallstep/certificates/ca"
@@ -18,11 +17,6 @@ import (
 	"github.com/smallstep/cli/internal/command"
 )
 
-var provisionerFilterFlag = cli.StringFlag{
-	Name:  "provisioner",
-	Usage: `The provisioner <name>`,
-}
-
 func retrieveAndUnsetProvisionerFlagIfRequired(ctx context.Context) string {
 	// when managing policies on the authority level there's no need
 	// to select a provisioner, so the flag does not need to be unset.
@@ -33,11 +27,14 @@ func retrieveAndUnsetProvisionerFlagIfRequired(ctx context.Context) string {
 	clictx := command.CLIContextFromContext(ctx)
 	provisioner := clictx.String("provisioner")
 
-	// unset the provisioner flag value, so that it's not used
+	// unset the provisioner and issuer flag values, so that they're not used
 	// automatically in token flows.
 	if err := clictx.Set("provisioner", ""); err != nil {
 		panic(fmt.Errorf("failed unsetting provisioner flag: %w", err))
 	}
+	if err := clictx.Set("issuer", ""); err != nil {
+		panic(fmt.Errorf("failed unsetting issuer flag: %w", err))
+	}
 
 	return provisioner
 }

command/ca/policy/actions/principals.go

@@ -58,7 +58,7 @@ $ step ca policy provisioner ssh host deny principal root --provisioner my_ssh_u
 			principalAction,
 		),
 		Flags: []cli.Flag{
-			provisionerFilterFlag,
+			flags.Provisioner,
 			cli.BoolFlag{
 				Name:  "remove",
 				Usage: `removes the provided Principals from the policy instead of adding them`,

command/ca/policy/actions/remove.go

@@ -55,7 +55,7 @@ $ step ca policy acme remove --provisioner my_acme_provisioner --eab-key-id "lUO
 			removeAction,
 		),
 		Flags: []cli.Flag{
-			provisionerFilterFlag,
+			flags.Provisioner,
 			flags.EABKeyID,
 			flags.EABReference,
 			flags.AdminCert,

command/ca/policy/actions/uris.go

@@ -53,7 +53,7 @@ $ step ca policy provisioner x509 allow uri "*.example.com" --provisioner my_pro
 			uriAction,
 		),
 		Flags: []cli.Flag{
-			provisionerFilterFlag,
+			flags.Provisioner,
 			cli.BoolFlag{
 				Name:  "remove",
 				Usage: `removes the provided URIs from the policy instead of adding them`,

command/ca/policy/actions/view.go

@@ -56,7 +56,7 @@ $ step ca policy acme view --provisioner my_acme_provisioner --eab-key-id "lUOTG
 			viewAction,
 		),
 		Flags: []cli.Flag{
-			provisionerFilterFlag,
+			flags.Provisioner,
 			flags.EABKeyID,
 			flags.EABReference,
 			flags.AdminCert,