SecureAuth configuration reference
Regardless of the deployment type you run, SecureAuth uses one configuration reference. Use it to adjust SecureAuth settings to your business needs.
The reference below lists the configuration keys you can set, each with its default value and a short description. It is generated from the SecureAuth source on each docs build, so it matches the current release.
Set configuration with environment variables
Every configuration key can also be set as an environment variable. Write the key path in uppercase and replace each dot with an underscore:
| Configuration key | Environment variable |
|---|---|
server.port | SERVER_PORT |
logging.level | LOGGING_LEVEL |
sql.url | SQL_URL |
Separate list values with commas, for example REDIS_ADDRS=redis-1:6379,redis-2:6379. An environment variable overrides the same key from a configuration file.
Configuration reference
Set your own secrets
secrets.key, system.secret and hashing.salt have built-in defaults, and those defaults are public. Every production deployment must set its own random values, generated for that installation and kept secret.
Platform configuration reference
config.yaml
# logging
logging:
level: info # logging level (panic, fatal, error, warn, info, debug, trace)
# http server
server:
system_tenant: system # name of the system tenant
url: https://localhost:8443 # server url template
mtls_url: "" # mtls server url template
vanity_url_template: "" # vanity url template (https://{{vanityID}}.vanity.example.com)
vanity_mtls_url_template: "" # vanity mtls url template (https://{{vanityID}}.mtls.vanity.example.com)
assets_url: "" # url template to cdn with static files
image_proxy_url: "" # url template to image proxy
grpc_url: localhost:9443 # grpc url
workforce_idp_domain: "" # workforce idp domain
faye_url: "" # faye url
port: 8443 # http server port
grpc_port: 9443 # grpc server port
do_not_print_audit_logs_for_static_files: true # do not print audit logs for static files
timeout: 10s # http server timeout
etag_backoff: 200ms # etag backoff duration
etag_retries: 25 # max number of etag retries
audit_logs: true # enable audit logs
cloudflare_headers: false # enable support for cloudflare headers (cf-iplatitude etc)
client_ip_info_header: false # trust the X-Client-Ip-Info header, the platform contract of key=value pairs (country_code, city, lat, long, asnum) compatible with Akamai EdgeScape, set by a trusted edge proxy; honoured on vanity and custom domains only, never on the default platform domain
disable_audit_logs_in_stdout: false # disable publishing audit logs to stdout
http_logs: false # enable http request and response logging
max_size_bytes: 1048576 # max size of http request body
dangerous_disable_tls: false # disable tls
disable_cache: false # disable cache
disable_gzip: true # disable http gzip encoding
disable_csrf: false # disable csrf protection
disable_security: false # disable security middleware
client_auth_type: RequestClientCert # mtls http server client auth type
# http server tls
certificate:
password: "" # key passphrase
cert_path: ./certs/srv/cert.pem # path to the certificate PEM file
key_path: ./certs/srv/cert-key.pem # path to the key PEM file
cert: "" # base64 encoded cert PEM
key: "" # base64 encoded key PEM
generated_key_type: rsa # type for generated key if cert and key are not provided (rsa or ecda)
disable_monitoring: false # disable /metrics endpoint
http_metrics_per_tenant: false # enable http metrics per tenant
disable_async_processing: false # disable async processing (streams,queue)
disable_cron_jobs: false # disable cron jobs
# http security configuration (github.com/unrolled/secure)
security:
browserxssfilter: true
contenttypenosniff: true
forcestsheader: false
framedeny: true
isdevelopment: false
sslredirect: true
sslforcehost: false
ssltemporaryredirect: false
stsincludesubdomains: true
stspreload: true
contentsecuritypolicyreportonly: ""
custombrowserxssvalue: ""
customframeoptionsvalue: SAMEORIGIN
publickey: ""
referrerpolicy: same-origin
featurepolicy: ""
permissionspolicy: accelerometer=(),camera=(),encrypted-media=(),fullscreen=(),geolocation=(),gyroscope=(),hid=(),magnetometer=(),microphone=(),midi=(),payment=(),picture-in-picture=(),screen-wake-lock=(),serial=(),usb=()
crossoriginopenerpolicy: ""
sslhost: ""
allowedhosts: []
allowedhostsareregex: false
hostsproxyheaders:
- X-Forwarded-Host
sslproxyheaders:
X-Forwarded-Proto: https
stsseconds: 31536000
expectctheader: ""
securecontextkey: ""
# cors configuration
cors:
allowedorigins:
- '*'
allowedheaders:
- Content-Type
- Authorization
- If-Match
allowedmethods:
- GET
- POST
- PUT
- DELETE
# gateway authorizer packages
packages:
apigeeedge:
file: /enforcement/apigee-edge-authorizer.zip # path to package file
url: "" # url to package
username: "" # basic auth username for url
password: "" # basic auth password for url
apigeex:
file: /enforcement/apigee-x-authorizer.zip # path to package file
url: "" # url to package
username: "" # basic auth username for url
password: "" # basic auth password for url
aws:
file: /enforcement/cloudentity-mp-aws-gw-authorizer.zip # path to package file
url: "" # url to package
username: "" # basic auth username for url
password: "" # basic auth password for url
istio:
file: /enforcement/istio-authorizer.zip # path to package file
url: "" # url to package
username: "" # basic auth username for url
password: "" # basic auth password for url
kong:
file: /enforcement/kong-authorizer.zip # path to package file
url: "" # url to package
username: "" # basic auth username for url
password: "" # basic auth password for url
kusk:
file: /enforcement/standalone-authorizer.zip # path to package file
url: "" # url to package
username: "" # basic auth username for url
password: "" # basic auth password for url
mcp_standalone:
file: /enforcement/standalone-authorizer.zip # path to package file
url: "" # url to package
username: "" # basic auth username for url
password: "" # basic auth password for url
pyron:
file: /enforcement/pyron-authorizer.zip # path to package file
url: "" # url to package
username: "" # basic auth username for url
password: "" # basic auth password for url
standalone:
file: /enforcement/standalone-authorizer.zip # path to package file
url: "" # url to package
username: "" # basic auth username for url
password: "" # basic auth password for url
# openbanking packages
openbanking_packages:
cdr:
file: /packages/openbanking/openbanking-quickstart-cdr.zip # path to package file
url: "" # url to package
username: "" # basic auth username for url
password: "" # basic auth password for url
fdx:
file: /packages/openbanking/openbanking-quickstart-fdx.zip # path to package file
url: "" # url to package
username: "" # basic auth username for url
password: "" # basic auth password for url
generic:
file: /packages/openbanking/openbanking-quickstart-generic.zip # path to package file
url: "" # url to package
username: "" # basic auth username for url
password: "" # basic auth password for url
templates_dir: ./web/templates # path to dir with templates
translations_dir: ./web/translations # path to dir with translations
static_dir: ./web/static # path to the dir with static files for templates
app_static_dir: ./web/app/build/static # path to the dir with static files for react frontend app
app_dir: ./web/app/build # path to the dir with react frontend app for acp
app_embed_dir: ./web/app/build-embed # path to the dir with embeddable web components bundle
swagger_dir: ./web/swagger # path to the dir with swagger ui
swagger_path_template: ./api/handler/{{module}}.yaml # path to the swagger-{{module}}.yaml
redirect_to_default_tenant: false # enable redirection to default tenant
client_certificate_header: "" # default client http TLS certificate header name
client_certificate_format_header: X-SSL-CERT-FORMAT # format of tls certificate injected as a header
region: default # The name of the region in which this node is running
# external integrations configuration
integrations:
# Google Analytics configuration
google_analytics:
enabled: false # enabled
measurement_id: "" # measurement id
# Google Custom Search JSON API configuration
google_images:
api_key: "" # Google Custom Search JSON API key
cx: "" # The identifier of the Google Programmable Search Engine.
rate_limiting_threshold: 0 # fine grained rate limiting threshold in number of requests per second
idempotency_ttl: 1m0s # idempotency ttl
access_token_clock_skew_leeway: 30s # tolerance for iat/nbf of a JWT access token issued by a node whose clock differs, 0 disables it
# sql encryption secret
secrets:
- id: "1" # secret id
key: <random 32-character value> # secret key
# pbkdf2 secret hashing configuration
hashing:
number_of_iterations: 4096 # number of iterations
key_length: 128 # key length
salt: <random value, at least 8 characters> # salt (at least 8 characters)
function: SHA-512 # SHA-1, SHA-224, SHA-256, SHA-384 or SHA-512
# system tenant
system:
secret: <random 32-character value> # system client secret
# limits
limits:
max_number_of_client_rotated_secrets: 1 # max number of client rotated secrets
# send otp per address global limit
send_otp_limit:
enabled: true # enable rate limiter
period: 1m0s # period
rate: 2 # rate
burst: 1 # max burst
# limits for admin websocket notifications
notifications:
audit_event: 3s
scope_grants: 3s
batch_size: 1000
# brute force limits
brute_force_limits:
enabled: true
mfa:
max_attempts: 5
block_duration: 1m0s
client_authentication:
max_attempts: 5
block_duration: 1m0s
device_handling:
max_attempts: 5
block_duration: 1m0s
identity_code_inspect:
max_attempts: 5
block_duration: 1m0s
identity_code_verify:
max_attempts: 5
block_duration: 1m0s
identity_change_password:
max_attempts: 5
block_duration: 1m0s
identity_confirm_password:
max_attempts: 5
block_duration: 1m0s
identity_verify_password:
max_attempts: 5
block_duration: 1m0s
identity_registration:
max_attempts: 5
block_duration: 1m0s
identity_set_credential:
max_attempts: 5
block_duration: 1m0s
identity_self_register:
max_attempts: 5
block_duration: 1m0s
identity_activate_self_registered:
max_attempts: 5
block_duration: 1m0s
identity_self_activation:
max_attempts: 5
block_duration: 1m0s
identity_self_change_password:
max_attempts: 5
block_duration: 1m0s
identity_self_change_totp_secret:
max_attempts: 5
block_duration: 1m0s
identity_change_totp_secret:
max_attempts: 5
block_duration: 1m0s
identity_authentication:
max_attempts: 5
block_duration: 1m0s
identity_address_verification:
max_attempts: 5
block_duration: 1m0s
active_directory_authentication:
max_attempts: 5
block_duration: 1m0s
# feature flags
features:
swagger_ui: false # swagger ui
block_non_vanity_domain_access: false # block access to a tenant's resources from traffic not originating from the tenant's vanity domain
dedicated_faas: false # allow the usage of dedicated FaaS Rego/JS environments
client_secrets_stored_as_one_way_hash: false # stores client secrets as one-way hashes
admin_workspace_access: true # admin workspace access
system_workspace_access: true # system workspace access
insecure_token_exchange_public_clients: false # insecure token exchange public clients
disable_audit_events: false # disable audit events
cache_access_tokens: false # cache access tokens
cdr_disable_unique_software_id: false # disable unique software id for CDR
do_not_validate_cert_for_private_key_jwt: false # do not validate cert for private key jwt
drop_tokens_on_password_reset: false # drop tokens on password reset
scope_transient_otp: false # scope transient_otp
cloudentity_idp: false # SecureAuth IDP
mark_address_as_verified_on_any_proof_of_possession: true # mark address as verified on any proof of possession of the address
rar: false # rich authorization requests
connect_id: false # connectID profile
identity_assurance: false # identity assurance
connect_id_consent_page_face_lifting: false # connect ID consent page facelifting
cdr_arrangement_cache: false # arrangement cache for CDR
# http client
client:
timeout: 5s # http client timeout
retry_wait_min: 10ms # minimum time to wait between retries
retry_wait_max: 100ms # maximum time to wait between retries
retry_max: 2 # maximum number of retries
root_ca: "" # file path to the root ca that this client should trust (defaults to system root ca)
root_ca_pem: "" # PEM encoded root ca that this client should trust
insecure_skip_verify: false # disable cert verification
# client TLS configuration
tls:
certificate: "" # file path to the client certificate
key: "" # file path to the client key
certificate_pem: "" # client certificate PEM encoded
key_pem: "" # client key PEM encoded
disable_follow_redirects: false # disable follow redirects
disable_retry: false # disable retry
block_internal_targets: false # block dials to non-public IPs (IANA special-purpose ranges): loopback, private, CGNAT, link-local, metadata
# ipintel
ipintel:
url: "" # ipintel url
timeout: 10ms # timeout
# sql client
sql:
url: postgres://root@crdb:26257/defaultdb?sslmode=disable # sql connection url
type: "" # sql db type cockroachdb or postgresql
# urls to replicas in master/slave mode
replicas: []
max_open_conns: 8 # max number of open connection
max_idle_conns: 0 # max number of idle connection
# migrations configuration
migrations:
disable: false # disable migrations
path: ./migrations # path to the migrations
timeout: 1m0s # timeout for running migrations
down: false # DANGEROUS run all migrations down (removes all data from the database)
with_cockroachdb_enterprise: false # turn on cockroachdb enterprise features
# garbage collection ttl per table (default 24h)
gc: {}
cockroachdb_use_limit_ordering_for_streaming_group_by: false # enable optimizer_use_limit_ordering_for_streaming_group_by feature flag for cockroachdb available from version 22.2.3
transaction_isolation_level: serializable # transaction isolation level (serializable, read_committed)
# timescale client
timescale:
enabled: false # enable timescaledb
url: postgres://postgres:password@timescale/acp?sslmode=disable # sql connection url
# urls to replicas in master/slave mode
replicas: []
max_open_conns: 8 # max number of open connection
max_idle_conns: 0 # max number of idle connection
# migrations configuration
migrations:
disable: false # disable migrations
path: ./migrations/timescale # path to the migrations
timeout: 1m0s # timeout for running migrations
down: false # DANGEROUS run all migrations down (removes all data from the database)
data_retention: 26784h0m0s # data retention duration
# config-driven retention policies
retention:
enabled: false # when true, on every `acp sql migrate` each policy is applied only when its interval differs from the database;
# raw hypertable name to an INTERVAL such as 12 months or 2 years
hypertables:
audit_events: 12 months
faas_duration_ms: 12 months
http_request_duration_ms: 12 months
identity_stats: 12 months
pool_stats: 12 months
# continuous-aggregate view name to an INTERVAL such as 12 months or 2 years
continuous_aggregates:
access_tokens_12h_v3: 36 months
access_tokens_1h_v3: 12 months
access_tokens_1m_v3: 12 months
access_tokens_by_grant_type_12h_v3: 36 months
access_tokens_by_grant_type_1h_v3: 12 months
access_tokens_by_grant_type_1m_v3: 12 months
access_tokens_unique_users_12h: 36 months
access_tokens_unique_users_1h: 12 months
access_tokens_unique_users_1m: 12 months
access_tokens_unique_users_by_grant_type_12h: 36 months
access_tokens_unique_users_by_grant_type_1h: 12 months
access_tokens_unique_users_by_grant_type_1m: 12 months
authentications_12h: 36 months
authentications_1h: 12 months
authentications_1m: 12 months
authentications_by_browser_12h: 36 months
authentications_by_browser_1h: 12 months
authentications_by_browser_1m: 12 months
authentications_by_device_12h: 36 months
authentications_by_device_1h: 12 months
authentications_by_device_1m: 12 months
authentications_by_location_1_0_12h: 36 months
authentications_by_location_1_0_1h: 12 months
authentications_by_location_1_0_1m: 12 months
authentications_by_location_5_0_12h: 36 months
authentications_by_location_5_0_1h: 12 months
authentications_by_location_5_0_1m: 12 months
authentications_by_os_12h: 36 months
authentications_by_os_1h: 12 months
authentications_by_os_1m: 12 months
authentications_by_result_method_12h: 36 months
authentications_by_result_method_1h: 12 months
authentications_by_result_method_1m: 12 months
gateway_request_duration_12h: 36 months
gateway_request_duration_1h: 12 months
gateway_request_duration_1m: 12 months
gateway_request_duration_by_result_12h: 36 months
gateway_request_duration_by_result_1h: 12 months
gateway_request_duration_by_result_1m: 12 months
identity_users_12h: 36 months
identity_users_1h: 12 months
leaked_credentials_12h: 36 months
leaked_credentials_1h: 12 months
leaked_credentials_1m: 12 months
leaked_credentials_by_category_12h: 36 months
leaked_credentials_by_category_1h: 12 months
leaked_credentials_by_category_1m: 12 months
loa_12h: 36 months
loa_1h: 12 months
loa_1m: 12 months
login_attempts_12h: 36 months
login_attempts_1h: 12 months
login_attempts_1m: 12 months
login_attempts_by_country_12h: 36 months
login_attempts_by_country_1h: 12 months
login_attempts_by_country_1m: 12 months
login_attempts_by_country_city_12h: 36 months
login_attempts_by_country_city_1h: 12 months
login_attempts_by_country_city_1m: 12 months
login_attempts_by_device_browser_12h: 36 months
login_attempts_by_device_browser_1h: 12 months
login_attempts_by_device_browser_1m: 12 months
login_attempts_by_device_os_12h: 36 months
login_attempts_by_device_os_1h: 12 months
login_attempts_by_device_os_1m: 12 months
login_attempts_by_device_type_12h: 36 months
login_attempts_by_device_type_1h: 12 months
login_attempts_by_device_type_1m: 12 months
login_attempts_by_grid_1_0_12h: 36 months
login_attempts_by_grid_1_0_1h: 12 months
login_attempts_by_grid_1_0_1m: 12 months
login_attempts_by_grid_5_0_12h: 36 months
login_attempts_by_grid_5_0_1h: 12 months
login_attempts_by_grid_5_0_1m: 12 months
login_attempts_by_idp_12h: 36 months
login_attempts_by_idp_1h: 12 months
login_attempts_by_idp_1m: 12 months
login_successes_12h: 36 months
login_successes_1h: 12 months
login_successes_1m: 12 months
login_successes_by_country_12h: 36 months
login_successes_by_country_1h: 12 months
login_successes_by_country_1m: 12 months
login_successes_by_country_city_12h: 36 months
login_successes_by_country_city_1h: 12 months
login_successes_by_country_city_1m: 12 months
login_successes_by_device_browser_12h: 36 months
login_successes_by_device_browser_1h: 12 months
login_successes_by_device_browser_1m: 12 months
login_successes_by_device_os_12h: 36 months
login_successes_by_device_os_1h: 12 months
login_successes_by_device_os_1m: 12 months
login_successes_by_device_type_12h: 36 months
login_successes_by_device_type_1h: 12 months
login_successes_by_device_type_1m: 12 months
login_successes_by_grid_1_0_12h: 36 months
login_successes_by_grid_1_0_1h: 12 months
login_successes_by_grid_1_0_1m: 12 months
login_successes_by_grid_5_0_12h: 36 months
login_successes_by_grid_5_0_1h: 12 months
login_successes_by_grid_5_0_1m: 12 months
login_successes_by_idp_12h: 36 months
login_successes_by_idp_1h: 12 months
login_successes_by_idp_1m: 12 months
login_successes_by_method_12h: 36 months
login_successes_by_method_1h: 12 months
login_successes_by_method_1m: 12 months
otp_operation_12h: 36 months
otp_operation_1h: 12 months
otp_operation_1m: 12 months
otp_operation_by_operation_12h: 36 months
otp_operation_by_operation_1h: 12 months
otp_operation_by_operation_1m: 12 months
policy_validation_12h: 36 months
policy_validation_1h: 12 months
policy_validation_1m: 12 months
policy_validation_by_result_12h: 36 months
policy_validation_by_result_1h: 12 months
policy_validation_by_result_1m: 12 months
pool_users_12h: 36 months
restricted_countries_12h: 36 months
restricted_countries_1h: 12 months
restricted_countries_1m: 12 months
restricted_countries_by_country_12h: 36 months
restricted_countries_by_country_1h: 12 months
restricted_countries_by_country_1m: 12 months
top_cities_12h: 36 months
top_cities_1h: 12 months
top_cities_1m: 12 months
top_clients_12h: 36 months
top_clients_1h: 12 months
top_clients_1m: 12 months
top_countries_12h: 36 months
top_countries_1h: 12 months
top_countries_1m: 12 months
top_users_with_authentication_failures_12h: 36 months
top_users_with_authentication_failures_12h_v2: 36 months
top_users_with_authentication_failures_1h: 12 months
top_users_with_authentication_failures_1h_v2: 12 months
top_users_with_authentication_failures_1m: 12 months
top_users_with_authentication_failures_1m_v2: 12 months
top_users_with_high_risk_12h: 36 months
top_users_with_high_risk_1h: 12 months
top_users_with_high_risk_1m: 12 months
top_users_with_password_resets_12h: 36 months
top_users_with_password_resets_12h_v2: 36 months
top_users_with_password_resets_1h: 12 months
top_users_with_password_resets_1h_v2: 12 months
top_users_with_password_resets_1m: 12 months
top_users_with_password_resets_1m_v2: 12 months
total_faas_duration_12h: 36 months
total_faas_duration_1h: 12 months
total_faas_duration_1m: 12 months
total_faas_duration_by_function_12h: 36 months
total_faas_duration_by_function_1h: 12 months
total_faas_duration_by_function_1m: 12 months
total_http_request_duration_12h: 36 months
total_http_request_duration_1h: 12 months
total_http_request_duration_1m: 12 months
total_http_request_duration_by_api_12h: 36 months
total_http_request_duration_by_api_1h: 12 months
total_http_request_duration_by_api_1m: 12 months
total_http_request_duration_by_category_12h: 36 months
total_http_request_duration_by_category_1h: 12 months
total_http_request_duration_by_category_1m: 12 months
total_http_request_duration_by_code_12h: 36 months
total_http_request_duration_by_code_1h: 12 months
total_http_request_duration_by_code_1m: 12 months
total_http_request_duration_external_errors_12h: 36 months
total_http_request_duration_external_errors_1h: 12 months
total_http_request_duration_external_errors_1m: 12 months
total_http_request_duration_external_errors_by_api_12h: 36 months
total_http_request_duration_external_errors_by_api_1h: 12 months
total_http_request_duration_external_errors_by_api_1m: 12 months
total_http_request_duration_external_errors_by_category_12h: 36 months
total_http_request_duration_external_errors_by_category_1h: 12 months
total_http_request_duration_external_errors_by_category_1m: 12 months
total_http_request_duration_external_errors_by_code_12h: 36 months
total_http_request_duration_external_errors_by_code_1h: 12 months
total_http_request_duration_external_errors_by_code_1m: 12 months
user_access_tokens_12h: 36 months
user_authentications_12h: 36 months
user_authentications_by_method_12h: 36 months
user_loa_12h: 36 months
# secondary timescale client
secondary_timescale:
enabled: false # enable timescaledb
url: "" # sql connection url
# urls to replicas in master/slave mode
replicas: []
max_open_conns: 0 # max number of open connection
max_idle_conns: 0 # max number of idle connection
# migrations configuration
migrations:
disable: false # disable migrations
path: "" # path to the migrations
timeout: 0s # timeout for running migrations
down: false # DANGEROUS run all migrations down (removes all data from the database)
data_retention: 0s # data retention duration
# config-driven retention policies
retention:
enabled: false # when true, on every `acp sql migrate` each policy is applied only when its interval differs from the database;
# raw hypertable name to an INTERVAL such as 12 months or 2 years
hypertables: {}
# continuous-aggregate view name to an INTERVAL such as 12 months or 2 years
continuous_aggregates: {}
# spicedb client for external permissions (permission systems)
spicedb:
enabled: false # enable spicedb
dry_run: false # turn off enforcement
url: spicedb:50051 # spicedb endpoint url
token: secret # bearer token
ca: "" # path to the root ca
insecure_skip_verify: false # skip tls verification
allow_tracing: false # allow with_tracing on permission-system check RPCs (enforced by the permission systems gRPC facade only); disabled by default as debug traces expose the full schema of an instance shared by multiple tenants — enable only on single-tenant deployments
# spicedb client for internal permissions (roles)
internal_spicedb:
enabled: false # enable spicedb
dry_run: false # turn off enforcement
url: internal-spicedb:50051 # spicedb endpoint url
token: secret # bearer token
ca: "" # path to the root ca
insecure_skip_verify: false # skip tls verification
allow_tracing: false # allow with_tracing on permission-system check RPCs (enforced by the permission systems gRPC facade only); disabled by default as debug traces expose the full schema of an instance shared by multiple tenants — enable only on single-tenant deployments
# redis client
redis:
id: redis # redis database id
region: local # region id
scan_count: 100 # Number of entries fetched using SCAN
push_limit: 1024 # at-least-once delivery queue push limit
# Either a single address or a seed list of host:port addresses
addrs:
- redis:6379
db: 0 # Database to be selected after connecting to the server.
master_name: "" # The sentinel master name.
username: "" # username
password: "" # password
sentinel_password: "" # sentinel password
max_retries: 3 # max retires
min_retry_backoff: 8ms # min retry backoff
max_retry_backoff: 512ms # max retry backoff
dial_timeout: 5s # dial timeout
read_timeout: 3s # read timeout
write_timeout: 3s # write timeout
pool_size: 0 # pool size
min_idle_conns: 0 # min idle connections
max_conn_age: 0s # max connection age
pool_timeout: 4s # pool timeout
idle_timeout: 5m0s # idle timeout
max_redirects: 3 # max redirects
read_only: false # read only
route_by_latency: false # route by latency
route_randomly: false # route randomly
# redis search indexes
indexes:
- name: tokens # redis search index name
# redis search index prefixes
prefix:
- access_tokens
- authorization_codes
- device_codes
- openid_tokens
- pkce_sessions
- refresh_tokens
- authorize_requesters
# redis search tags for index
tags:
- tenant_id
- server_id
- client_id
- subject
- token_type
- collection
- consent_id
- consent_type
- customer_id
- sso_session_id
- signature_id
- name: users # redis search index name
# redis search index prefixes
prefix:
- users
- user_identifiers
- user_verified_addresses
- user_codes
# redis search tags for index
tags:
- tenant_id
- pool_id
- user_id
- name: sessions # redis search index name
# redis search index prefixes
prefix:
- sso_sessions
# redis search tags for index
tags:
- tenant_id
- server_id
- subject
- session_id
- name: mfa_sessions # redis search index name
# redis search index prefixes
prefix:
- mfa_sessions
# redis search tags for index
tags:
- tenant_id
- user_pool_id
- user_id
# redis streams configuration
streams:
number_of_workers: 8 # number of workers for stream handlers
max_length: 100000 # max length for streams
# custom max length per stream
custom_max_lengths:
audit: 200000
max_ttl: 24h0m0s # max ttl for entries in streams
trim_interval: 1m0s # trim max ttl interval
disable_trim: false # disable trimming
count: 128 # number of events to read from a stream
block: 1s # duration until timeout
handler_timeout: 30s # stream handler timeout
stats_interval: 10s # streams stats interval
# streams auto claim count
auto_claim:
interval: 1s # streams auto claim interval
min_idle: 30s # streams auto claim min idle
count: 100 # streams auto claim count
sleep: 100ms # sleep between reads
max_retries: 10 # max number of retries
prefix: "" # redis stream name prefix
auto_ack: false # automatically ack all messages when there is no error
# etags configuration
etag:
duration: 1m0s # max duration to wait for confirmation
size: 10000 # max size of confirmations queue
# redis tls configuration
tls:
enabled: false # enable tls
cert: "" # path to the public key cert PEM file
key: "" # path to the private key PEM file
ca: "" # path to the root ca PEM file
insecure_skip_verify: false # skip host name verification
max_backoff_retries: 5 # constant backoff max number of retries
backoff_duration: 10ms # constant backoff duration
# consumer group configuration - option to override global settings for a given consumer group
consumer_groups:
analytics:
disabled: false # if true than this handler is disabled
timeout: 0s # timeout for all handlers in a given consumer group, 0 for default timeout
batch_size: 4 # count of messages in a singe batch, 0 for default size
max_retries: -1
max_length: 0 # max length for streams
number_of_workers: 0 # number of workers for stream handlers
audit_logs:
disabled: false # if true than this handler is disabled
timeout: 0s # timeout for all handlers in a given consumer group, 0 for default timeout
batch_size: 0 # count of messages in a singe batch, 0 for default size
max_retries: -1
max_length: 0 # max length for streams
number_of_workers: 0 # number of workers for stream handlers
audit_logs_timescale:
disabled: false # if true than this handler is disabled
timeout: 0s # timeout for all handlers in a given consumer group, 0 for default timeout
batch_size: 200 # count of messages in a singe batch, 0 for default size
max_retries: -1
max_length: 0 # max length for streams
number_of_workers: 0 # number of workers for stream handlers
gateway:
disabled: false # if true than this handler is disabled
timeout: 0s # timeout for all handlers in a given consumer group, 0 for default timeout
batch_size: 100 # count of messages in a singe batch, 0 for default size
max_retries: 0
max_length: 0 # max length for streams
number_of_workers: 0 # number of workers for stream handlers
identity_cleanup:
disabled: false # if true than this handler is disabled
timeout: 0s # timeout for all handlers in a given consumer group, 0 for default timeout
batch_size: 1 # count of messages in a singe batch, 0 for default size
max_retries: 0
max_length: 0 # max length for streams
number_of_workers: 0 # number of workers for stream handlers
identity_messenger:
disabled: false # if true than this handler is disabled
timeout: 2m0s # timeout for all handlers in a given consumer group, 0 for default timeout
batch_size: 4 # count of messages in a singe batch, 0 for default size
max_retries: 3
max_length: 0 # max length for streams
number_of_workers: 4 # number of workers for stream handlers
risk_engine:
disabled: false # if true than this handler is disabled
timeout: 30s # timeout for all handlers in a given consumer group, 0 for default timeout
batch_size: 32 # count of messages in a singe batch, 0 for default size
max_retries: 2
max_length: 0 # max length for streams
number_of_workers: 4 # number of workers for stream handlers
webhook_notification:
disabled: false # if true than this handler is disabled
timeout: 30s # timeout for all handlers in a given consumer group, 0 for default timeout
batch_size: 12 # count of messages in a singe batch, 0 for default size
max_retries: 0
max_length: 0 # max length for streams
number_of_workers: 0 # number of workers for stream handlers
workforce:
disabled: false # if true than this handler is disabled
timeout: 1m0s # timeout for all handlers in a given consumer group, 0 for default timeout
batch_size: 1 # count of messages in a singe batch, 0 for default size
max_retries: 0
max_length: 0 # max length for streams
number_of_workers: 0 # number of workers for stream handlers
# nats client
nats:
enabled: false # enable nats
name: acp # client name
realm: default # the event subject prefix identifying this deployment's domain
url: nats://127.0.0.1:4222 # url
# tls
tls:
enabled: false # enable tls
root_ca_file: "" # path to the root ca file
cert_file: "" # path to the client cert file
key_file: "" # path to the client key file
insecure_skip_verify: false # skip tls verification
# default stream config
default_stream_config:
max_bytes: 107374182400 # maximum number of bytes for the stream
max_age: 168h0m0s # maximum age of messages in the stream
max_msg_size: 1048576 # maximum message size
replicas: 3 # replicas for the stream
# default consumer config
default_consumer_config:
ack_wait: 1m0s # how long the server will wait for an ack before redelivering a message
max_deliver: -1 # maximum number of delivery attempts for a message (-1 for unlimited)
next_max_wait: 100ms # timeout for reading the next message
inactive_threshold: 0s # duration after which the server cleans up the consumer if it has been inactive
max_ack_pending: 1000 # maximum number of outstanding unacknowledged messages
# backoff intervals for redelivery attempts
back_off:
- 5s
- 30s
- 1m0s
- 5m0s
workers: 4 # number of concurrent workers processing messages for this consumer
batch_size: 32 # batch size for batch processing of messages
batch_wait: 1s # wait time for batch processing of messages
timeout: 30s # worker timeout duration
# stream config overwrites per stream
stream_overwrites: {}
# consumer config overwrites per group
consumer_overwrites:
cdr:
ack_wait: 0s # how long the server will wait for an ack before redelivering a message
max_deliver: 20 # maximum number of delivery attempts for a message (-1 for unlimited)
next_max_wait: 0s # timeout for reading the next message
inactive_threshold: 0s # duration after which the server cleans up the consumer if it has been inactive
max_ack_pending: 0 # maximum number of outstanding unacknowledged messages
# backoff intervals for redelivery attempts
back_off: []
workers: 0 # number of concurrent workers processing messages for this consumer
batch_size: 0 # batch size for batch processing of messages
batch_wait: 0s # wait time for batch processing of messages
timeout: 0s # worker timeout duration
identity:
ack_wait: 0s # how long the server will wait for an ack before redelivering a message
max_deliver: 20 # maximum number of delivery attempts for a message (-1 for unlimited)
next_max_wait: 0s # timeout for reading the next message
inactive_threshold: 0s # duration after which the server cleans up the consumer if it has been inactive
max_ack_pending: 0 # maximum number of outstanding unacknowledged messages
# backoff intervals for redelivery attempts
back_off: []
workers: 0 # number of concurrent workers processing messages for this consumer
batch_size: 0 # batch size for batch processing of messages
batch_wait: 0s # wait time for batch processing of messages
timeout: 0s # worker timeout duration
identity_messenger:
ack_wait: 0s # how long the server will wait for an ack before redelivering a message
max_deliver: 5 # maximum number of delivery attempts for a message (-1 for unlimited)
next_max_wait: 0s # timeout for reading the next message
inactive_threshold: 0s # duration after which the server cleans up the consumer if it has been inactive
max_ack_pending: 0 # maximum number of outstanding unacknowledged messages
# backoff intervals for redelivery attempts
back_off: []
workers: 8 # number of concurrent workers processing messages for this consumer
batch_size: 0 # batch size for batch processing of messages
batch_wait: 0s # wait time for batch processing of messages
timeout: 0s # worker timeout duration
webhook_notification:
ack_wait: 0s # how long the server will wait for an ack before redelivering a message
max_deliver: 20 # maximum number of delivery attempts for a message (-1 for unlimited)
next_max_wait: 0s # timeout for reading the next message
inactive_threshold: 0s # duration after which the server cleans up the consumer if it has been inactive
max_ack_pending: 10000 # maximum number of outstanding unacknowledged messages
# backoff intervals for redelivery attempts
back_off: []
workers: 0 # number of concurrent workers processing messages for this consumer
batch_size: 0 # batch size for batch processing of messages
batch_wait: 0s # wait time for batch processing of messages
timeout: 0s # worker timeout duration
# optional local redis client (uses redis client configuration if addrs is empty)
local_redis:
id: local-redis # redis database id
region: local # region id
scan_count: 100 # Number of entries fetched using SCAN
push_limit: 1024 # at-least-once delivery queue push limit
# Either a single address or a seed list of host:port addresses
addrs: []
db: 0 # Database to be selected after connecting to the server.
master_name: "" # The sentinel master name.
username: "" # username
password: "" # password
sentinel_password: "" # sentinel password
max_retries: 3 # max retires
min_retry_backoff: 8ms # min retry backoff
max_retry_backoff: 512ms # max retry backoff
dial_timeout: 5s # dial timeout
read_timeout: 3s # read timeout
write_timeout: 3s # write timeout
pool_size: 0 # pool size
min_idle_conns: 0 # min idle connections
max_conn_age: 0s # max connection age
pool_timeout: 4s # pool timeout
idle_timeout: 5m0s # idle timeout
max_redirects: 3 # max redirects
read_only: false # read only
route_by_latency: false # route by latency
route_randomly: false # route randomly
# redis search indexes
indexes:
- name: tokens # redis search index name
# redis search index prefixes
prefix:
- access_tokens
- authorization_codes
- device_codes
- openid_tokens
- pkce_sessions
- refresh_tokens
- authorize_requesters
# redis search tags for index
tags:
- tenant_id
- server_id
- client_id
- subject
- token_type
- collection
- consent_id
- consent_type
- customer_id
- sso_session_id
- signature_id
- name: users # redis search index name
# redis search index prefixes
prefix:
- users
- user_identifiers
- user_verified_addresses
- user_codes
# redis search tags for index
tags:
- tenant_id
- pool_id
- user_id
- name: sessions # redis search index name
# redis search index prefixes
prefix:
- sso_sessions
# redis search tags for index
tags:
- tenant_id
- server_id
- subject
- session_id
- name: mfa_sessions # redis search index name
# redis search index prefixes
prefix:
- mfa_sessions
# redis search tags for index
tags:
- tenant_id
- user_pool_id
- user_id
# redis streams configuration
streams:
number_of_workers: 8 # number of workers for stream handlers
max_length: 100000 # max length for streams
# custom max length per stream
custom_max_lengths:
audit: 200000
max_ttl: 24h0m0s # max ttl for entries in streams
trim_interval: 1m0s # trim max ttl interval
disable_trim: false # disable trimming
count: 128 # number of events to read from a stream
block: 1s # duration until timeout
handler_timeout: 30s # stream handler timeout
stats_interval: 10s # streams stats interval
# streams auto claim count
auto_claim:
interval: 1s # streams auto claim interval
min_idle: 30s # streams auto claim min idle
count: 100 # streams auto claim count
sleep: 100ms # sleep between reads
max_retries: 10 # max number of retries
prefix: "" # redis stream name prefix
auto_ack: false # automatically ack all messages when there is no error
# etags configuration
etag:
duration: 1m0s # max duration to wait for confirmation
size: 10000 # max size of confirmations queue
# redis tls configuration
tls:
enabled: false # enable tls
cert: "" # path to the public key cert PEM file
key: "" # path to the private key PEM file
ca: "" # path to the root ca PEM file
insecure_skip_verify: false # skip host name verification
max_backoff_retries: 5 # constant backoff max number of retries
backoff_duration: 10ms # constant backoff duration
# consumer group configuration - option to override global settings for a given consumer group
consumer_groups:
analytics:
disabled: false # if true than this handler is disabled
timeout: 0s # timeout for all handlers in a given consumer group, 0 for default timeout
batch_size: 4 # count of messages in a singe batch, 0 for default size
max_retries: -1
max_length: 0 # max length for streams
number_of_workers: 0 # number of workers for stream handlers
audit_logs:
disabled: false # if true than this handler is disabled
timeout: 0s # timeout for all handlers in a given consumer group, 0 for default timeout
batch_size: 0 # count of messages in a singe batch, 0 for default size
max_retries: -1
max_length: 0 # max length for streams
number_of_workers: 0 # number of workers for stream handlers
audit_logs_timescale:
disabled: false # if true than this handler is disabled
timeout: 0s # timeout for all handlers in a given consumer group, 0 for default timeout
batch_size: 200 # count of messages in a singe batch, 0 for default size
max_retries: -1
max_length: 0 # max length for streams
number_of_workers: 0 # number of workers for stream handlers
gateway:
disabled: false # if true than this handler is disabled
timeout: 0s # timeout for all handlers in a given consumer group, 0 for default timeout
batch_size: 100 # count of messages in a singe batch, 0 for default size
max_retries: 0
max_length: 0 # max length for streams
number_of_workers: 0 # number of workers for stream handlers
identity_cleanup:
disabled: false # if true than this handler is disabled
timeout: 0s # timeout for all handlers in a given consumer group, 0 for default timeout
batch_size: 1 # count of messages in a singe batch, 0 for default size
max_retries: 0
max_length: 0 # max length for streams
number_of_workers: 0 # number of workers for stream handlers
identity_messenger:
disabled: false # if true than this handler is disabled
timeout: 2m0s # timeout for all handlers in a given consumer group, 0 for default timeout
batch_size: 4 # count of messages in a singe batch, 0 for default size
max_retries: 3
max_length: 0 # max length for streams
number_of_workers: 4 # number of workers for stream handlers
risk_engine:
disabled: false # if true than this handler is disabled
timeout: 30s # timeout for all handlers in a given consumer group, 0 for default timeout
batch_size: 32 # count of messages in a singe batch, 0 for default size
max_retries: 2
max_length: 0 # max length for streams
number_of_workers: 4 # number of workers for stream handlers
webhook_notification:
disabled: false # if true than this handler is disabled
timeout: 30s # timeout for all handlers in a given consumer group, 0 for default timeout
batch_size: 12 # count of messages in a singe batch, 0 for default size
max_retries: 0
max_length: 0 # max length for streams
number_of_workers: 0 # number of workers for stream handlers
workforce:
disabled: false # if true than this handler is disabled
timeout: 1m0s # timeout for all handlers in a given consumer group, 0 for default timeout
batch_size: 1 # count of messages in a singe batch, 0 for default size
max_retries: 0
max_length: 0 # max length for streams
number_of_workers: 0 # number of workers for stream handlers
# sql queue
queue:
disabled: false # disable queue worker pool
tenant_id: "" # Limit sql queue handler to a single tenant
count: 1 # number of pool workers
limit: 10 # poll limit
heartbeat_interval: 30s # heartbeat interval
expiration_interval: 1m0s # expiration interval
polling_interval: 1s # polling interval
max_backoff: 10s # max backoff
error_limit: 0.1 # error rate limit
# storage config
storage:
# refresh tokens storage configuration
refresh_tokens:
enabled: true # enable storing refresh tokens in sql, stored in kv if false
batch_limit: 1000 # refresh token batch delete limit
# expired consents storage configuration
consents:
batch_limit: 1000 # expired consents batch delete limit
# audit events strorage configuration
audit_events:
enabled: true # enable storing audit events in sql
# audit events retention config
retention:
enabled: true # enable audit events retention
global: true # when true, audit events retention is executed globally, not per tenant
batch_limit: 1000 # audit events retention batch delete limit
max_age: 168h0m0s # remove audit events older than max age
# recurring jobs
jobs:
auditEventsRetention:
tenant_id: system # tenant id
id: auditEventsRetention # job id
queue: execute_retention # queue name
cron: 15 * * * * # cron expression
# next execution time
scheduled_at: {}
# job starting from
starting_from: {}
paused: false # is paused
payload: null # payload
cdrArrangementsAutoRemoval:
tenant_id: system # tenant id
id: cdrArrangementsAutoRemoval # job id
queue: openbanking_cdr_arrangements_auto_removal # queue name
cron: 0 0 * * * # cron expression
# next execution time
scheduled_at: {}
# job starting from
starting_from: {}
paused: false # is paused
payload: null # payload
cdrExpiredArrangements:
tenant_id: system # tenant id
id: cdrExpiredArrangements # job id
queue: openbanking_set_expired_cdr_arrangements # queue name
cron: 0 * * * * # cron expression
# next execution time
scheduled_at: {}
# job starting from
starting_from: {}
paused: false # is paused
payload: null # payload
cdrSyncRegisters:
tenant_id: system # tenant id
id: cdrSyncRegisters # job id
queue: openbanking_cdr_sync_registers # queue name
cron: '*/4 * * * *' # cron expression
# next execution time
scheduled_at: {}
# job starting from
starting_from: {}
paused: false # is paused
payload: null # payload
cibaSimulatorExpiredAuthentications:
tenant_id: system # tenant id
id: cibaSimulatorExpiredAuthentications # job id
queue: ciba_simulator_remove_expired_authentications # queue name
cron: '*/1 * * * *' # cron expression
# next execution time
scheduled_at: {}
# job starting from
starting_from: {}
paused: false # is paused
payload: null # payload
expiredTokens:
tenant_id: system # tenant id
id: expiredTokens # job id
queue: remove_expired_refresh_tokens # queue name
cron: 0 * * * * # cron expression
# next execution time
scheduled_at: {}
# job starting from
starting_from: {}
paused: false # is paused
payload: null # payload
fdxExpiredConsents:
tenant_id: system # tenant id
id: fdxExpiredConsents # job id
queue: openbanking_set_expired_fdx_consents # queue name
cron: 0 * * * * # cron expression
# next execution time
scheduled_at: {}
# job starting from
starting_from: {}
paused: false # is paused
payload: null # payload
openbankingOrphanedConsents:
tenant_id: system # tenant id
id: openbankingOrphanedConsents # job id
queue: openbanking_remove_orphaned_consents # queue name
cron: 0 * * * * # cron expression
# next execution time
scheduled_at: {}
# job starting from
starting_from: {}
paused: false # is paused
payload: null # payload
poolStats:
tenant_id: system # tenant id
id: poolStats # job id
queue: pool_stats # queue name
cron: 45 3 * * * # cron expression
# next execution time
scheduled_at: {}
# job starting from
starting_from: {}
paused: false # is paused
payload: null # payload
tenantStats:
tenant_id: system # tenant id
id: tenantStats # job id
queue: tenant_stats # queue name
cron: 45 2 * * * # cron expression
# next execution time
scheduled_at: {}
# job starting from
starting_from: {}
paused: false # is paused
payload: null # payload
# lru cache
cache:
redis_ttl: 10m0s
local_ttl: 1m0s
local_max_size: 1000
locks: 256
disabled: false
count_limit: 0
# stats cache
stats:
redis_ttl: 1m0s
local_ttl: 10s
local_max_size: 1000
locks: 0
disabled: false
count_limit: 100000
# themes cache
themes_cache:
redis_ttl: 1h0m0s
local_ttl: 10m0s
local_max_size: 100
locks: 0
disabled: false
count_limit: 0
# faas provider
faas:
provider: ""
# Available node executor env versions (sorted from oldest to the newest).
node_env_versions:
- version: "6" # Environment version
valid_until: ""
# Nodejs package json
package_json:
# NodeJS dependencies
dependencies:
async: 3.2.6
async-lock: 1.4.1
aws-sdk: 2.1693.0
axios: 1.20.0
axios-retry: 4.4.1
body-parser: 1.20.9
chalk: 5.3.0
co: 4.6.0
debug: 4.3.5
express: 4.22.1
express-timeout-handler: 2.2.2
graphql: 16.9.0
immutable: 4.3.9
invariant: 2.2.4
js-yaml: 4.3.2
jsonwebtoken: 9.0.3
ldapjs: 3.0.7
lodash: 4.18.1
log4js: 6.9.1
lru_map: 0.4.1
minimist: 1.2.8
mongodb: 6.8.0
mongoose: 8.24.1
morgan: 1.12.1
mysql: 2.18.1
mz: 2.7.0
node-fetch: 3.3.2
qs: 6.16.1
ramda: 0.30.1
rxjs: 7.8.2
uglify-js: 3.19.3
underscore: 1.13.8
uuid: 11.1.1
validator: 13.15.35
ws: 8.21.0
xml2js: 0.6.2
# NodeJS engine version
engines:
node: v20 # NodeJS engine version
- version: "7" # Environment version
valid_until: ""
# Nodejs package json
package_json:
# NodeJS dependencies
dependencies:
'@authzed/authzed-node': 1.6.1
axios: 1.20.0
jsonwebtoken: 9.0.3
lodash: 4.18.1
uuid: 14.0.2
# NodeJS engine version
engines:
node: v24 # NodeJS engine version
# Available rego executor env versions (sorted from oldest to the newest).
rego_env_versions:
- version: "6" # Environment version
valid_until: ""
package_json: null # Nodejs package json
# fission function as a service provider
fission:
namespace: acp-faas # Kubernetes namespace where functions should be created
# Runtime configuration for runtime v1
envs:
js: nodejs # Name of the fission environment for JS
rego: rego # Name of the fission environment for Rego
# Runtime configuration for runtime v2
envs_v2:
js: nodejs-v2 # Name of the fission environment for JS
rego: rego-v2 # Name of the fission environment for Rego
url: http://router.fission # URL to the fission router
max_backoff_retries: 3 # Max backoff retries in case of 404 error
package_template: |- # k8s package template
apiVersion: fission.io/v1
kind: Package
metadata:
name: {{ .ID }}
namespace: {{ .Namespace }}
spec:
deployment:
literal: {{ .Base64EncodedBody }}
type: literal
environment:
name: {{ .Env }}
namespace: {{ .Namespace }}
status:
buildstatus: succeeded
function_template: |- # k8s function template
apiVersion: fission.io/v1
kind: Function
metadata:
name: {{ .ID }}
namespace: {{ .Namespace }}
spec:
InvokeStrategy:
ExecutionStrategy:
ExecutorType: poolmgr
SpecializationTimeout: 30
StrategyType: execution
concurrency: {{ .MaxPodsCount }}
requestsPerPod: {{ .MaxRequestsPerPod }}
environment:
name: {{ .Env }}
namespace: {{ .Namespace }}
functionTimeout: {{ .ExecutionTimeout }}
idletimeout: {{ .IdleTimeout }}
package:
packageref:
name: {{ .ID }}
namespace: {{ .Namespace }}
resourceversion: "{{ .ResourceVersion }}"
# kube config
kube:
timeout: 0s
kubeconfig: ""
max_pod_age: 0s # max pod age - set 0 to unlimited
# function settings
function_settings:
execution_timeout: 30s # max function execution time
idle_timeout: 1m0s # max function idle duration
max_pods_count: 2 # maximum pod count number
max_requests_per_pod: 5000 # maximum numer of requests per pod
# fission resource watcher configuration
resource_watcher:
interval: 1m0s # how often check for aged resources
timeout: 10s # check timeout
# risk engine configuration
risk_engine:
url: "" # risk engine internal url
tenant_id: "" # risk engine tenant id
api_key: "" # risk engine api key
timeout: 2s # risk engine client timeout
default_loa: 0 # default loa score when risk engine is disabled
# default loa score per tenant when risk engine is disabled
tenant_default_loa: {}
# docker function as a service provider
docker:
node_url: http://node-env:8888
rego_url: http://rego-env:8888
shared_node_url: http://node-env:8888
shared_rego_url: http://rego-env:8888
# opentelemetry configuration
otel:
service_name: acp # service name
exporter: jaeger # opentelemetry exporter (jaeger or otlp)
# enabled propagators (b3, baggage, tracecontext, ottrace, jaeger)
propagators:
- jaeger
# jaeger opentelemetry exporter
jaeger:
agent_host: localhost # agent host
agent_port: "6831" # agent port
header: uber-trace-id # header name
# opentelemetry protocol exporter
otlp:
endpoint: localhost:4318 # otlp endpoint
path: /v1/traces # otlp path
root_ca: "" # otlp root ca
# additional headers
headers: {}
insecure_skip_verify: false # disable cert verification
insecure_http: false # use http instead of https
# consul client https://github.com/hashicorp/consul/blob/master/api/api.go
consul:
address: 127.0.0.1:8500
scheme: http
pathprefix: ""
datacenter: ""
transport: null
httpclient: null
httpauth: null
waittime: 0s
token: ""
tokenfile: ""
namespace: ""
partition: ""
tlsconfig:
address: ""
cafile: ""
capath: ""
capem: []
certfile: ""
certpem: []
keyfile: ""
keypem: []
insecureskipverify: false
# vault client
vault:
address: "" # Address is the address of the Vault server.
agent_address: "" # AgentAddress is the address of the local Vault agent.
max_retries: 0 # MaxRetries controls the maximum number of times to retry when a 5xx error occurs.
timeout: 0s # Timeout is for setting custom timeout parameter in the HttpClient
token: "" # Access token
# TLSConfig contains the parameters needed to configure TLS on the HTTP client used to communicate with Vault.
tls:
cacert: ""
cacertbytes: []
capath: ""
clientcert: ""
clientkey: ""
tlsservername: ""
insecure: false
# Authentication
auth:
approle:
roleid: ""
secretid: ""
# embedded smtp gateway configuration
email:
from: Cloudentity <noreply@cloudentity.com> # From address
username: "" # Username
password: "" # Password
auth: PLAIN
host: smtp.gmail.com # SMTP server host
port: 25 # SMTP server port
timeout: 5s # Timeout
start_tls: false # Send an email over TLS using STARTTLS
insecure_skip_verify: false # Skip TLS cert verification
pool_size: 4 # Pool size
# advanced phone middleware configuration (providers with circuit breakers, fallback chains)
phone_advanced:
# phone provider chain
providers: []
delivery_correlation_ttl: 24h0m0s # how long to keep delivery correlation entries in Redis
# platform default message redaction policy
redaction:
content: default
address: default
# messaging config
messaging:
# email templates
emails:
# verify otp
otp:
subject: OTP # Email's subject
file_template: ./web/emails/ce.html # Path to the file template
text_template: Dear Customer, [[otp]] is your single-use verification code. # Text template used if tile template is not set
message_template: | # Default message template
<div class="heading2">We've received a OTP Code request.</div>
<div class="code-container">[[otp]]</div>
<div class="main-text">Here is the OTP code that you have requested.</div>
# Email's attachments
attachments: []
# activate account with code
activate_account_with_code:
subject: Account activation # Email's subject
file_template: ./web/emails/ce.html # Path to the file template
text_template: "" # Text template used if tile template is not set
message_template: | # Default message template
<div class="heading2">
Excellent!
<b> Your account is almost ready.</b>
</div>
<div class="main-text">Enter the code below on the account activation page to activate you account.</div>
<div class="code-container">[[code]]</div>
# Email's attachments
attachments: []
# activate account with link
activate_account_with_link:
subject: Account activation # Email's subject
file_template: ./web/emails/ce.html # Path to the file template
text_template: "" # Text template used if tile template is not set
message_template: | # Default message template
<div class="heading2">
Excellent!
<b> Your account is almost ready.</b>
</div>
<div class="main-text">Just one more step to access it</div>
<div class="link-container">
<a href="[[link]]" rel="noopener noreferrer">Activate account</a>
</div>
<div class="helper-link-container">
Alternatively, copy this link and follow it in your browser
<div class="link-container-box">[[link]]</div>
</div>
# Email's attachments
attachments: []
# reset credentials with code
reset_credentials_with_code:
subject: Credentials reset # Email's subject
file_template: ./web/emails/ce.html # Path to the file template
text_template: "" # Text template used if tile template is not set
message_template: | # Default message template
<div class="heading2">Credentials reset</div>
<div class="main-text">
We've received a request to reset your credentials.<br />
Your credentials reset code is:
</div>
<div class="code-container">[[code]]</div>
# Email's attachments
attachments: []
# reset credentials with link
reset_credentials_with_link:
subject: Credentials reset # Email's subject
file_template: ./web/emails/ce.html # Path to the file template
text_template: "" # Text template used if tile template is not set
message_template: | # Default message template
<div class="heading2">Credentials reset</div>
<div class="main-text">We've received a request to reset your credentials.</div>
<div class="link-container">
<a href="[[link]]" rel="noopener noreferrer">Reset credentials</a>
</div>
<div class="helper-link-container">
Alternatively, copy this link and follow it in your browser
<div class="link-container-box">[[link]]</div>
</div>
# Email's attachments
attachments: []
# add credentials with code
add_credentials_with_code:
subject: Add credentials # Email's subject
file_template: ./web/emails/ce.html # Path to the file template
text_template: "" # Text template used if tile template is not set
message_template: | # Default message template
<div class="heading2">Credentials enrollment</div>
<div class="main-text">
We've received a request to add new credentials to your account.<br />
Your credentials enrollment code is:
</div>
<div class="code-container">[[code]]</div>
# Email's attachments
attachments: []
# add credentials with link
add_credentials_with_link:
subject: "" # Email's subject
file_template: ./web/emails/ce.html # Path to the file template
text_template: "" # Text template used if tile template is not set
message_template: | # Default message template
<div class="heading2">Credentials enrollment</div>
<div class="main-text">We've received a request to add new credentials to your account.</div>
<div class="link-container">
<a href="[[link]]" rel="noopener noreferrer">Add credentials</a>
</div>
<div class="helper-link-container">
Alternatively, copy this link and follow it in your browser
<div class="link-container-box">[[link]]</div>
</div>
# Email's attachments
attachments: []
# identifier used
identifier_used:
subject: Account already exists # Email's subject
file_template: ./web/emails/ce.html # Path to the file template
text_template: "" # Text template used if tile template is not set
message_template: | # Default message template
<div class="heading2">Account already exists</div>
<div class="main-text">The email you provided is already registered with an account.</div>
# Email's attachments
attachments: []
# address verification with link
address_verification_with_link:
subject: Address verification # Email's subject
file_template: ./web/emails/ce.html # Path to the file template
text_template: "" # Text template used if tile template is not set
message_template: | # Default message template
<div class="heading2">Address verification</div>
<div class="main-text">We've received a request to verify your address.</div>
<div class="link-container">
<a href="[[link]]" rel="noopener noreferrer">Verify address</a>
</div>
<div class="helper-link-container">
Alternatively, copy this link and follow it in your browser
<div class="link-container-box">[[link]]</div>
</div>
# Email's attachments
attachments: []
# sms templates
smses:
default_source: "" # Platform-wide default SMS sender ID. When unset, callers substitute
# verify otp
otp:
message_template: Dear Customer, [[otp]] is your single-use verification code. # Message template
# activate account with code
activate_account_with_code:
message_template: Dear Customer, use [[code]] to activate your account. # Message template
# activate account with code
activate_account_with_link:
message_template: 'Dear Customer, use the link to activate your account: [[link]]' # Message template
# reset credentials with code
reset_credentials_with_code:
message_template: Dear Customer, use [[code]] to reset your credentials. # Message template
# reset credentials with code
reset_credentials_with_link:
message_template: 'Dear Customer, use the link to reset your credentials: [[link]]' # Message template
# add credentials with code
add_credentials_with_code:
message_template: Dear Customer, use [[code]] to add new credentials to your account. # Message template
# add credentials with code
add_credentials_with_link:
message_template: 'Dear Customer, use the link to add new credentials to your account: [[link]]' # Message template
# identifier used
identifier_used:
message_template: Dear Customer, this number is associated with an existing account. # Message template
# address verification with link
address_verification_with_link:
message_template: 'Dear Customer, use the link to verify your address: [[link]]' # Message template
# embedded IDPs
embedded_idps:
enabled: false # enabled
cookie_domain: "" # cookie domain
# github idp
github:
client_id: "" # client id
client_secret: "" # client secret
# google idp
google:
client_id: "" # client id
client_secret: "" # client secret
# linkedin
linkedin:
client_id: "" # client id
client_secret: "" # client secret
# X
x:
client_id: "" # client id
# Meta
meta:
client_id: "" # client id
client_secret: "" # client secret
# Apple
apple:
client_id: "" # client id
team_id: "" # team id
private_key: "" # base64 encoded private key in .p8 format
key_id: "" # key id
# Microsoft
microsoft:
client_id: "" # client id
client_secret: "" # client secret
# global rate limits
rate_limits:
oauth2:
enabled: false # enable rate limiter
period: 1m0s # period
rate: 60 # rate
burst: 10 # max burst
# rate limits cache
rate_limits_cache:
redis_ttl: 1h0m0s
local_ttl: 10m0s
local_max_size: 1000
locks: 0
disabled: false
count_limit: 0
# token exchange verifier
token_exchange_verifier:
idp_client_timeout: 5s # http client timeout when calling IDP endpoints
# subject config
subject:
default_format: legacy # subject default format for new workspaces
# identity pools captcha configuration
captcha:
enabled: false
site_key: ""
secret_key: ""
site_key_v3: ""
secret_key_v3: ""
threshold: 0.5
whitelist: []
# Limits for asynchronous delete of Identity Pools
async_delete_identity_pool:
delete_users_batch_size: 100
delete_users_iterations_count: 30
create_tenant_with_default_admin_identity_pool: true # Default Admin Identity Pool IDP for new tenant
# Webhooks handler configuration
webhooks:
client:
timeout: 2s # http client timeout
retry_wait_min: 0s # minimum time to wait between retries
retry_wait_max: 0s # maximum time to wait between retries
retry_max: 0 # maximum number of retries
root_ca: "" # file path to the root ca that this client should trust (defaults to system root ca)
root_ca_pem: "" # PEM encoded root ca that this client should trust
insecure_skip_verify: false # disable cert verification
# client TLS configuration
tls:
certificate: "" # file path to the client certificate
key: "" # file path to the client key
certificate_pem: "" # client certificate PEM encoded
key_pem: "" # client key PEM encoded
disable_follow_redirects: true # disable follow redirects
disable_retry: true # disable retry
block_internal_targets: false # block dials to non-public IPs (IANA special-purpose ranges): loopback, private, CGNAT, link-local, metadata