Rauthy

https://sebadob.github.io/rauthy
Admin
Rauthy is a lightweight Identity Provider supporting OpenID Connect, OAuth 2.0, and PAM with...
Tokens:96,091
Snippets:1,298
Trust Score:8.3
Update:3 months ago
Show doc for...
Tokens:
Raw
### Encryption Configuration Example

Source: https://sebadob.github.io/rauthy/getting_started/k8s.html

Example format for encryption keys in the configuration file.

```toml
[encryption]
keys = ["XLCcaQ/f2xmq/nxVFgJN0CN311miyvVlBxXOQISyw1nPEPOqiI="]
key_active = "XLCcaQ"
```

--------------------------------

### Rauthy Encryption Keys Configuration Example

Source: https://sebadob.github.io/rauthy/config/encryption.html

Example of how to structure the `encryption.keys` in your configuration file, including multiple keys.

```ini
[encryption]
key = [
  "Wx1zrbLF/5vTaB7LdUSg1aTecmqHJOu2+RnU6zgTwNkDQU52Y3JM=",
  "6uf5QebA/9DsKMoq8A+Gn2WQrTcSpz5sg751yYs3IJlkw3dn0rII=",
]

```

--------------------------------

### Start Rauthy with Docker

Source: https://sebadob.github.io/rauthy/getting_started/docker.html

Starts a local Rauthy instance with a default, insecure configuration suitable only for localhost testing.

```bash
docker run -it --rm -e LOCAL_TEST=true -p 8443:8443 ghcr.io/sebadob/rauthy:0.36.0
```

--------------------------------

### Authorization Header Example

Source: https://sebadob.github.io/rauthy/config/logging.html

An example of how to format the Authorization header when accessing the events stream.

```http
Authorization: API-Key events$SUcpBxcPmfwH9z1Kb4ExOUYDSXpxOj9mFLadjuQ1049XaWzdWB328aa97k2nj21E
```

--------------------------------

### Example Rauthy Encryption Configuration

Source: https://sebadob.github.io/rauthy/config/encryption.html

Example configuration for Rauthy's encryption settings. It includes a list of encryption keys and specifies the currently active key.

```ini
[encryption]
keys = ["90eb6d69/U9wZG4GS/94pVh6iTH1ijf+kj+tXJHKkQNsp5eImMQI="]
key_active = "90eb6d69"
```

--------------------------------

### Full Ephemeral Client JSON Example

Source: https://sebadob.github.io/rauthy/work/ephemeral_clients.html

A complete JSON configuration demonstrating all available fields for an ephemeral client.

```json
{
  "client_id": "https://example.com/my_ephemeral_client.json",
  "client_name": "My Ephemeral Client",
  "client_uri": "https://this.is.where",
  "contacts": [
    "mail@ephemeral.info"
  ],
  "redirect_uris": [
    "https://this.is.where/my/website/is"
  ],
  "post_logout_redirect_uris": [
    "https://this.is.where"
  ],
  "default_max_age": 300,
  "scope": "openid email custom",
  "require_auth_time": true,
  "access_token_signed_response_alg": "RS256",
  "id_token_signed_response_alg": "RS256"
}
```

--------------------------------

### Example environment variable output

Source: https://sebadob.github.io/rauthy/print.html

Sample output format for secrets retrieved via the env flag.

```text
RAUTHY_BOOTSTRAP_CLIENT_MY_SERVICE_SECRET=...
RAUTHY_BOOTSTRAP_USER_ADMIN_EXAMPLE_COM_PASSWORD=...
RAUTHY_BOOTSTRAP_API_KEY_PROVISION_TOKEN=...
```

--------------------------------

### Example JSON Event Output

Source: https://sebadob.github.io/rauthy/config/logging.html

This is an example of the JSON output you might receive when querying for events.

```json
{
  "name": "events",
  "created": 1720428190,
  "expires": null,
  "access": [
    {
      "group": "Events",
      "access_rights": [
        "read"
      ]
    }
  ]
}
```

--------------------------------

### User Configuration with Generated Password

Source: https://sebadob.github.io/rauthy/config/bootstrap.html

Example JSON configuration for a user requesting a generated password.

```json
[
  {
    "email": "admin@example.com",
    "password": "generate",
    "roles": ["admin"],
    "enabled": true,
    "email_verified": true
  }
]
```

--------------------------------

### Manage Docker Compose Lifecycle

Source: https://sebadob.github.io/rauthy/getting_started/docker.html

Commands to start, monitor, and stop the Rauthy container stack.

```bash
docker compose up -d
```

```bash
docker compose logs -f rauthy
```

```bash
docker compose down
```

--------------------------------

### Hash a password for bootstrapping

Source: https://sebadob.github.io/rauthy/config/cli.html

Use this command to generate a hashed password for initial system setup. The tool uses secure defaults for hashing parameters.

```bash
rauthy hash-password
```

--------------------------------

### Configure Bootstrap API Key

Source: https://sebadob.github.io/rauthy/config/config.html

Example of the base64 encoded string for the bootstrap API key configuration.

```toml
api_key = 'ewogICJuYW1lIjogImJvb3RzdHJhcCIsCiAgImV4cCI6IDE3MzU1OTk2MDAsCiAgImFjY2VzcyI6IFsKICAgIHsKICAgICAgImdyb3VwIjogIkNsaWVudHMiLAogICAgICAiYWNjZXNzX3JpZ2h0cyI6IFsKICAgICAgICAicmVhZCIsCiAgICAgICAgImNyZWF0ZSIsCiAgICAgICAgInVwZGF0ZSIsCiAgICAgICAgImRlbGV0ZSIKICAgICAgXQogICAgfSwKICAgIHsKICAgICAgImdyb3VwIjogIlJvbGVzIiwKICAgICAgImFjY2Vzc19yaWdodHMiOiBbCiAgICAgICAgInJlYWQiLAogICAgICAgICJjcmVhdGUiLAogICAgICAgICJ1cGRhdGUiLAogICAgICAgICJkZWxldGUiCiAgICAgIF0KICAgIH0sCiAgICB7CiAgICAgICJncm91cCI6ICJHcm91cHMiLAogICAgICAiYWNjZXNzX3JpZ2h0cyI6IFsKICAgICAgICAicmVhZCIsCiAgICAgICAgImNyZWF0ZSIsCiAgICAgICAgInVwZGF0ZSIsCiAgICAgICAgImRlbGV0ZSIKICAgICAgXQogICAgfQogIF0KfQ=='
```

--------------------------------

### Client Configuration with Generated Secret

Source: https://sebadob.github.io/rauthy/config/bootstrap.html

Example JSON configuration for a confidential client requesting a generated secret.

```json
[
  {
    "id": "my-service",
    "name": "My Service",
    "secret": "generate",
    "redirect_uris": ["https://my-service.example.com/callback"],
    "enabled": true,
    "flows_enabled": ["authorization_code", "refresh_token"],
    "access_token_alg": "EdDSA",
    "id_token_alg": "EdDSA",
    "auth_code_lifetime": 60,
    "access_token_lifetime": 3600,
    "scopes": ["openid", "profile", "email"],
    "default_scopes": ["openid", "profile", "email"],
    "force_mfa": false
  }
]
```

--------------------------------

### GET /auth/v1/users/register

Source: https://sebadob.github.io/rauthy/print.html

Redirects the user to the Rauthy registration form. By appending a redirect_uri query parameter, the user is returned to the specified application after registration or password setup.

```APIDOC
## GET /auth/v1/users/register

### Description
Redirects the user to the Rauthy registration form. The user will be redirected back to the provided URI after successful registration or password/passkey setup.

### Method
GET

### Endpoint
/auth/v1/users/register

### Parameters
#### Query Parameters
- **redirect_uri** (string) - Optional - The URI to redirect the user to after registration completion.
```

--------------------------------

### Start Rauthy container with volumes

Source: https://sebadob.github.io/rauthy/getting_started/docker.html

Launch the Rauthy container in detached mode with persistent volume mounts for configuration and data.

```bash
docker run -d \
    -v $(pwd)/rauthy/config.toml:/app/config.toml \
    -v $(pwd)/rauthy/data:/app/data \
    -p 8443:8443 \
    --name rauthy \
    ghcr.io/sebadob/rauthy:0.36.0
```

--------------------------------

### GET /Groups

Source: https://sebadob.github.io/rauthy/print.html

Retrieves groups from the client system.

```APIDOC
## GET /Groups

### Description
Retrieves a list of groups from the client system, optionally filtered by externalId or displayName.

### Method
GET

### Endpoint
/Groups

### Query Parameters
- **filter** (string) - Optional - Filter criteria
```

--------------------------------

### Construct Registration URL with Redirect Hint

Source: https://sebadob.github.io/rauthy/config/user_reg.html

Append the `redirect_uri` query parameter to the Rauthy registration URL to guide users back to your application after registration or password reset.

```url
https://iam.example.com/auth/v1/users/register?redirect_uri=https%3A%2F%2Fgithub.com
```

--------------------------------

### Set Active Encryption Key Configuration

Source: https://sebadob.github.io/rauthy/config/encryption.html

Example of setting the `key_active` parameter to specify the default encryption key ID.

```ini
[encryption]
key_active = "Wx1zrbLF"

```

--------------------------------

### Example API Key Response

Source: https://sebadob.github.io/rauthy/print.html

The JSON structure returned when querying API key details.

```json
{
  "name": "events",
  "created": 1720428190,
  "expires": null,
  "access": [
    {
      "group": "Events",
      "access_rights": [
        "read"
      ]
    }
  ]
}
```

--------------------------------

### Configure Failed Login Event Level

Source: https://sebadob.github.io/rauthy/print.html

Example of overriding the default event level for failed login attempts.

```toml
__
[events]
# default: notice
# overwritten by: EVENT_LEVEL_FAILED_LOGINS_7
level_failed_logins_7 = 'notice'
```

--------------------------------

### Configure Matrix Event Notifications

Source: https://sebadob.github.io/rauthy/config/logging.html

Set these parameters to enable and configure notifications to a Matrix server. Ensure `matrix_user_id` and `matrix_room_id` are always provided. Depending on your Matrix setup, either `matrix_access_token` or `matrix_user_password` is required. If both are provided, `matrix_access_token` takes precedence. If these fields are empty, no messages will be sent to Matrix.

```ini
matrix_user_id = ''
# Format: `!<random string>:<server address>`
# overwritten by: EVENT_MATRIX_ROOM_ID
matrix_room_id = ''
# overwritten by: EVENT_MATRIX_ACCESS_TOKEN
matrix_access_token = ''
# overwritten by: EVENT_MATRIX_USER_PASSWORD
matrix_user_password = ''
# URL of your Matrix server.
# default: https://matrix.org
# overwritten by: EVENT_MATRIX_SERVER_URL
matrix_server_url = 'https://matrix.org'

# Optional path to a PEM Root CA certificate file for the
# Matrix client.
#
# overwritten by: EVENT_MATRIX_ROOT_CA_PATH
matrix_root_ca_path = 'tls/root.cert.pem'

# May be set to disable the TLS validation for the Matrix
# client.
#
# default: false
# overwritten by: EVENT_MATRIX_DANGER_DISABLE_TLS_VALIDATION
matrix_danger_disable_tls_validation = false

# The default behavior is, that Rauthy will panic at startup
# if it cannot connect to a configured Matrix server. The
# reason is that event notifications cannot be dropped silently.
#
# However, if you use a self-hosted Matrix server which uses
# Rauthy as its OIDC provider and both instances went offline,
# you will have a chicken-and-egg problem:
# - Rauthy cannot connect to Matrix and will panic
# - Your Matrix server cannot connect to Rauthy and will panic
# To solve this issue, you can temporarily set this value to
# 'true' and revert back, after the system is online again.
#
# default: false
# overwritten by: EVENT_MATRIX_ERROR_NO_PANIC
matrix_error_no_panic = false
```

--------------------------------

### Configure log_sync in TOML

Source: https://sebadob.github.io/rauthy/print.html

Set the log_sync parameter in the cluster configuration to define the flush strategy. The interval_200 example triggers flushes every 200ms.

```toml
[cluster]
# Setting for Raft Log syncing / flushing.
#
# This value is probably the most important, depending on your needs.
# It has a huge impact on both performance and consistency.
#
# You can set 3 different levels:
# - immediate
# - immediate_async
# - interval_<time_ms> (e.g. interval_200)
#
# If you run a single instance "Cluster", you most probably want
# `immediate` to have the highest degree of consistency. If set
# to `immediate`, the Raft will block until data has been flushed
# to disk.
# `immediate` has a very huge negative impact on throughput, and
# it puts a lot of stress on your disk, which is important to
# consider for SSDs.
#
# `immediate_async` puts the same amount of stress on your SSD
# and flushes all buffers to disk immediately after a single
# Raft Log was saved. Unlike `immediate`, however, it does not
# wait for completion and directly returns `success` to the
# Raft Engine. You have a tiny bit worse consistency guarantees
# in exchange for basically the same throughput as with `interval`
# syncing.
#
# The `interval_<ms>` option will not flush immediately. Flushes
# will be triggered by an external ticker task every <ms> ms, and
# then only if buffers are dirty, meaning if any data was updated
# since the last sync. This setting has the highest throughput
# and puts the lowest amount of stress on your SSD.
#
# CAUTION: You probably never want to use this setting for a
# single instance, since it may be the case that if you are
# unlucky and your app crashes before buffers are synced, you might
# lose the last few WAL entries. Even though very unlikely in the
# real world (can be force-produced though).
#
# default: immediate_async
# overwritten by: HQL_LOG_SYNC
log_sync = "interval_200"
```

--------------------------------

### Initialize Project Directory

Source: https://sebadob.github.io/rauthy/getting_started/k8s.html

Create and enter the project directory for Rauthy files.

```bash
mkdir rauthy && cd rauthy
```

--------------------------------

### Create StateSet Manifest File

Source: https://sebadob.github.io/rauthy/getting_started/k8s.html

Initialize the stateful set manifest file.

```bash
touch sts.yaml
```

--------------------------------

### Create Ingress Configuration File

Source: https://sebadob.github.io/rauthy/getting_started/k8s.html

Initializes the ingress.yaml file using the touch command.

```bash
touch ingress.yaml
```

--------------------------------

### Configure Rauthy Start Event Level

Source: https://sebadob.github.io/rauthy/config/logging.html

Set the event level when a Rauthy instance is started. The default level is 'info'.

```ini
# The level for the generated Event after a Rauthy
# instance has been started
#
# default: info
# overwritten by: EVENT_LEVEL_RAUTHY_START
level_rauthy_start = 'info'
```

--------------------------------

### Prepare Data Directory

Source: https://sebadob.github.io/rauthy/getting_started/k8s.html

Create a data directory and set ownership to the container user ID 10001.

```bash
mkdir data && sudo chown 10001:$(id -g) data
```

--------------------------------

### Prepare local directory for Rauthy data

Source: https://sebadob.github.io/rauthy/config/cli.html

Create a directory and set appropriate permissions to persist configuration files generated by the CLI.

```bash
mkdir rauthy_data && sudo chown -R 10001:$(id -g) rauthy_data
```

--------------------------------

### GET /Users/{id}

Source: https://sebadob.github.io/rauthy/print.html

Retrieves a specific user by ID.

```APIDOC
## GET /Users/{id}

### Description
Retrieves details for a specific user identified by their ID.

### Method
GET

### Endpoint
/Users/{id}

### Parameters
#### Path Parameters
- **id** (string) - Required - The unique identifier of the user
```

--------------------------------

### GET /Groups/{id}

Source: https://sebadob.github.io/rauthy/print.html

Retrieves a specific group by ID.

```APIDOC
## GET /Groups/{id}

### Description
Retrieves details for a specific group.

### Method
GET

### Endpoint
/Groups/{id}

### Parameters
#### Path Parameters
- **id** (string) - Required - The unique identifier of the group
```

--------------------------------

### Create persistent data directories

Source: https://sebadob.github.io/rauthy/getting_started/docker.html

Initialize the local directory structure for Rauthy data and TLS certificates.

```bash
mkdir -p rauthy/data rauthy/tls
```

--------------------------------

### View generated configuration

Source: https://sebadob.github.io/rauthy/getting_started/docker.html

Display the contents of the generated configuration file.

```bash
sudo cat rauthy/data/config-generated.toml
```

--------------------------------

### Verify Rauthy CLI installation

Source: https://sebadob.github.io/rauthy/getting_started/docker.html

Check that the Rauthy CLI is accessible via the alias.

```bash
rauthy --help
```

--------------------------------

### Accessing CLI Help

Source: https://sebadob.github.io/rauthy/config/cli.html

Displays the help menu for the Rauthy CLI using cargo or the binary directly.

```bash
cargo run -- --help
```

```bash
rauthy --help
```

--------------------------------

### GET /Users

Source: https://sebadob.github.io/rauthy/print.html

Retrieves users from the client system. Supports filtering by externalId or userName.

```APIDOC
## GET /Users

### Description
Retrieves a list of users from the client system. Rauthy uses this to check for existing users via filters.

### Method
GET

### Endpoint
/Users

### Query Parameters
- **filter** (string) - Required - Filter criteria (e.g., externalId, userName)
```

--------------------------------

### Display Nioca X509 Help

Source: https://sebadob.github.io/rauthy/config/tls.html

Run this command to view the full feature set and customization options for the Nioca x509 command-line tool.

```bash
nioca x509 -h
```

--------------------------------

### View Nioca help

Source: https://sebadob.github.io/rauthy/print.html

Displays the help menu for the Nioca x509 command.

```bash
nioca x509 -h
```

--------------------------------

### Enable Swagger UI

Source: https://sebadob.github.io/rauthy/config/tuning.html

Set `swagger_ui_enable` to `true` to enable the Swagger UI for API documentation. This consumes approximately 13MB of additional memory and is initialized at startup if enabled.

```toml
[server]
swagger_ui_enable = false
```

--------------------------------

### Full List of Configurable Event Levels

Source: https://sebadob.github.io/rauthy/print.html

Complete reference for all available event level configurations and their default values.

```toml
__
[events]
# The level for the generated Event after a backchannel
# logout has failed after exceeding all retries.
#
# default: critical
# overwritten by: EVENT_LEVEL_BACKCHANNEL_LOGOUT_FAILED
level_backchannel_logout_failed = 'critical'
# The level for the generated Event after a user was
# force-logged-out by an admin.
#
# default: notice
# overwritten by: EVENT_LEVEL_FORCE_LOGOUT
level_force_logout = 'notice'
# The level for the generated Event after an IP has
# been blacklisted
#
# default: warning
# overwritten by: EVENT_LEVEL_IP_BLACKLISTED
level_ip_blacklisted = 'warning'
# The level for the generated Event after the JWKS has
# been rotated
#
# default: notice
# overwritten by: EVENT_LEVEL_JWKS_ROTATE
level_jwks_rotate = 'notice'
# The level for the generated Event after a login from
# a new location for a user.
#
# default: notice
# overwritten by: EVENT_LEVEL_NEW_LOGIN_LOCATION
level_new_login_location = 'notice'
# The level for the generated Event after a new user has
# been registered.
#
# default: info
# overwritten by: EVENT_LEVEL_NEW_USER
level_new_user = 'info'
# The level for the generated Event after a user has
# changed his E-Mail
#
# default: notice
# overwritten by: EVENT_LEVEL_USER_EMAIL_CHANGE
level_user_email_change = 'notice'
# The level for the generated Event after a user has
# reset its password
#
# default: notice
# overwritten by: EVENT_LEVEL_USER_PASSWORD_RESET
level_user_password_reset = 'notice'
# The level for the generated Event after a user has
# been given the 'rauthy_admin' role
#
# default: notice
# overwritten by: EVENT_LEVEL_RAUTHY_ADMIN
level_rauthy_admin = 'notice'
# The level for the generated Event after a Rauthy
# entered a healthy state (again)
#
# default: notice
# overwritten by: EVENT_LEVEL_RAUTHY_HEALTHY
level_rauthy_healthy = 'notice'
# The level for the generated Event after a Rauthy
# instance has been started
#
# default: info
# overwritten by: EVENT_LEVEL_RAUTHY_START
level_rauthy_start = 'info'
# The level for the generated Event after a Rauthy
# entered an unhealthy state
#
# default: critical
# overwritten by: EVENT_LEVEL_RAUTHY_UNHEALTHY
level_rauthy_unhealthy = 'critical'
# The level for the generated Event after a new App
# version has been found
#
# default: notice
# overwritten by: EVENT_LEVEL_RAUTHY_VERSION
level_rauthy_version = 'notice'
# The level for the generated Event after DB secrets
# have been migrated to a new key
#
# default: notice
# overwritten by: EVENT_LEVEL_SECRETS_MIGRATED
level_secrets_migrated = 'notice'
# The level for the generated Event after a user revoked
# an illegal login with the link from the notification
# E-Mail for "login from unknown location"
#
# default: warning
# overwritten by: EVENT_LEVEL_USER_LOGIN_REVOKE
level_user_login_revoke = 'warning'
# The level for the generated Event after a SCIM
# update task ultimately failed after exceeding
# all retries.
#
# default: critical
# overwritten by: EVENT_LEVEL_SCIM_TASK_FAILED
level_scim_task_failed = 'critical'
# The level for the generated Event after Rauthy
# detected a suspicious API scanning request.
#
# default: notice
# overwritten by: EVENT_LEVEL_SUSPICIOUS_REQUEST
level_suspicious_request = 'notice'
# The level for the generated Event after a new JWT
# Token was issued.
#
# default: info
# overwritten by: EVENT_LEVEL_TOKEN_ISSUED
level_token_issued = 'info'

# The level for the generated Event after certain
# amounts of false logins from an IP
#
# default: critical
# overwritten by: EVENT_LEVEL_FAILED_LOGINS_25
level_failed_logins_25 = 'critical'
# default: critical
# overwritten by: EVENT_LEVEL_FAILED_LOGINS_20
level_failed_logins_20 = 'critical'
# default: warning
# overwritten by: EVENT_LEVEL_FAILED_LOGINS_15
level_failed_logins_15 = 'warning'
# default: warning
# overwritten by: EVENT_LEVEL_FAILED_LOGINS_10
level_failed_logins_10 = 'warning'
# default: notice
# overwritten by: EVENT_LEVEL_FAILED_LOGINS_7
level_failed_logins_7 = 'notice'
# default: info
# overwritten by: EVENT_LEVEL_FAILED_LOGIN
level_failed_login = 'info'
```

--------------------------------

### GET /auth/v1/clients/{id}/forward_auth/callback

Source: https://sebadob.github.io/rauthy/print.html

Handles the callback phase of the forward authentication flow to establish session cookies.

```APIDOC
## GET /auth/v1/clients/{id}/forward_auth/callback

### Description
Completes the authentication flow by creating new session cookies bound to the original Rauthy session and redirecting the user to the original requested URI.

### Method
GET

### Endpoint
/auth/v1/clients/{id}/forward_auth/callback

### Parameters
#### Path Parameters
- **id** (string) - Required - The client identifier.
```

--------------------------------

### Move and Set Permissions for Config

Source: https://sebadob.github.io/rauthy/getting_started/k8s.html

Move the configuration file to the project root and update ownership.

```bash
sudo mv data/config-generated.toml config.toml && \
sudo chown $(id -u):$(id -g) config.toml
```

--------------------------------

### Generate Rauthy configuration

Source: https://sebadob.github.io/rauthy/getting_started/docker.html

Use the CLI to generate a basic configuration file in the data directory.

```bash
rauthy generate-config -o data/config-generated.toml
```

--------------------------------

### GET /auth/v1/clients/{id}/forward_auth

Source: https://sebadob.github.io/rauthy/print.html

Processes authentication requests by reading proxy-injected headers and validating sessions or CSRF tokens.

```APIDOC
## GET /auth/v1/clients/{id}/forward_auth

### Description
Processes authentication requests. It reads headers injected by the proxy to validate the request origin and perform CSRF checks.

### Method
GET

### Endpoint
/auth/v1/clients/{id}/forward_auth

### Parameters
#### Path Parameters
- **id** (string) - Required - The client identifier.

#### Query Parameters
- **danger_cookie_insecure** (boolean) - Optional - If set, makes the cookie insecure for local testing (do not use in production).
- **redirect_state** (integer) - Optional - Changes the status code returned if no session is found (e.g., 302 for Traefik compatibility).
```

--------------------------------

### Minimal Production Configuration

Source: https://sebadob.github.io/rauthy/print.html

A template for a minimal production configuration. Ensure all required secrets and keys are properly set before deployment.

```toml
[bootstrap]
# If set, the email of the default admin will be changed during
# the initialization of an empty production database.
#
# default: 'admin@localhost'
# overwritten by: BOOTSTRAP_ADMIN_EMAIL
admin_email = "admin@localhost"

[cluster]
# Can be set to 'k8s' to try to split off the node id from the hostname
# when Hiqlite is running as a StatefulSet inside Kubernetes.
#
# default: unset
# overwritten by: HQL_NODE_ID_FROM
#node_id_from = "k8s"

# The node id must exist in the nodes and there must always be
# at least a node with ID 1
# Will be ignored if `node_id_from = k8s`
#
# At least `node_id_from` or `node_id` are required.
#
# default: 0 (invalid)
# overwritten by: HQL_NODE_ID
node_id = 1

# All cluster member nodes. For a single instance deployment, 
# `"1 localhost:8100 localhost:8200"` will work just fine.
# Each array value must have the following format:
# `id addr_raft addr_api`
#
# default: ["1 localhost:8100 localhost:8200"]
# overwritten by: HQL_NODES
nodes = [
    "1 localhost:8100 localhost:8200",
    #    "2 localhost:8101 localhost:8201",
    #    "3 localhost:8102 localhost:8202",
]

# Secrets for Raft internal authentication as well as for the API.
# These must be at least 16 characters long and you should provide
# different ones for both variables.
#
# default: not set - required
# overwritten by: HQL_SECRET_RAFT
secret_raft = "SuperSecureSecret1337"
# default: not set - required
# overwritten by: HQL_SECRET_API
secret_api = "SuperSecureSecret1337"

[email]
# Rauthy will force TLS and try a downgrade to STARTTLS, if
# TLS fails. It will never allow an unencrypted connection.
# You might want to set `SMTP_DANGER_INSECURE=true` if you
# need this for local dev.
#
# overwritten by: SMTP_URL
smtp_url = "localhost"
# optional, default will be used depending on TLS / STARTTLS
# overwritten by: SMTP_PORT
#smtp_port = 
# overwritten by: SMTP_USERNAME
smtp_username = "username"
# overwritten by: SMTP_PASSWORD
smtp_password = "password"
# Format: "Rauthy <rauthy@localhost>"
# default: "Rauthy <rauthy@localhost>"
# overwritten by: SMTP_FROM
smtp_from = "Rauthy <rauthy@localhost>"

[encryption]
# You need to define at least one valid encryption key.
# These keys are used in various places, like for instance
# encrypting confidential client secrets in the database, or
# encryption cookies, and so on.
#
# The first part until the first `/` is the key ID.
# The ID must match '^[a-zA-Z0-9:_-]{2,20}$'
#
# The key itself begins after the first `/` has been found.
# The key must be exactly 32 bytes long, encoded as base64.
#
# You can find a more detailed explanation on how to generate
# keys in the documentation:
# 1. https://sebadob.github.io/rauthy/getting_started/k8s.html#create-and-apply-secrets
# 2. https://sebadob.github.io/rauthy/config/encryption.html
#
# You can provide multiple keys to make things like key
# rotation work. Be careful with removing old keys. Make sure
# that all secrets have been migrated beforehand.
# You can find a utility in the Admin UI to do this for you.
#
# overwritten by: ENC_KEYS - single String, \n separated values
keys = ["q6u26/M0NFQzhSSldCY01rckJNa1JYZ3g2NUFtSnNOVGdoU0E="]

# This identifies the key ID from the `ENC_KEYS` list, that
# should actively be used for new encryptions.
#
# overwritten by: ENC_KEY_ACTIVE
key_active = "q6u26"

[events]
# The E-Mail address event notifications should be sent to.
#
# overwritten by: EVENT_EMAIL
email = "admin@localhost"

[server]
# The scheme to use locally, valid values:
# http | https | http_https | unix_http | unix_https
# For more details about the UNIX domain socket, check out its
# documentation page.
#
# default: http_https
# overwritten by: LISTEN_SCHEME
scheme = "http"

# The Public URL of the whole deployment
# The LISTEN_SCHEME + PUB_URL must match the HTTP ORIGIN HEADER
# later on, which is especially important when running Rauthy
# behind a reverse proxy. In case of a non-standard port (80/443),
# you need to add the port to the PUB_URL
#
# default: not set - mandatory
# overwritten by: PUB_URL
pub_url = "localhost:8080"

# When rauthy is running behind a reverse proxy, set to true
#
# default: false
# overwritten by: PROXY_MODE
proxy_mode = false
```

--------------------------------

### Example JWT with Custom User Attributes

Source: https://sebadob.github.io/rauthy/work/custom_scopes_attributes.html

Displays a JWT token containing a custom attribute nested within the custom claim section.

```json
{
  "iat": 1721722389,
  "exp": 1721722399,
  "nbf": 1721722389,
  "iss": "http://localhost:8080/auth/v1",
  "sub": "za9UxpH7XVxqrtpEbThoqvn2",
  "aud": "rauthy",
  "nonce": "Fars0wPqrm9f6XimDKD08CPl",
  "azp": "rauthy",
  "typ": "Id",
  "amr": [
    "pwd"
  ],
  "auth_time": 1721722389,
  "at_hash": "Hd5ugcSzxwl1epF7Il3pEpq0gznnqs2SnSVZCdNw0EI",
  "preferred_username": "admin@localhost",
  "roles": [
    "rauthy_admin",
    "admin"
  ],
  "custom": {
    "my_attr": "This is Batman!"
  }
}
```

--------------------------------

### Enable User Registration in Configuration

Source: https://sebadob.github.io/rauthy/print.html

Set the enable flag to true within the [user_registration] section of the configuration file to allow public access to the registration endpoint.

```toml
[user_registration]
# If the User Registration endpoint should be accessible by anyone.
# If not, an admin must create each new user.
#
# default: false
# overwritten by: OPEN_USER_REG
enable = true
```

--------------------------------

### Client Credentials Flow JWT with Custom Claims

Source: https://sebadob.github.io/rauthy/work/custom_scopes_attributes.html

Example of an access token issued via client_credentials flow containing custom client claims.

```json
{
  "iat": 1721722389,
  "exp": 1721722399,
  "nbf": 1721722389,
  "iss": "http://localhost:8080/auth/v1",
  "sub": "my_client",
  "aud": "my_client",
  "azp": "my_client",
  "typ": "Bearer",
  "scope": "openid",
  "custom": {
    "tenant": "acme",
    "tier": "gold"
  }
}
```

--------------------------------

### Apply Kubernetes Configuration

Source: https://sebadob.github.io/rauthy/print.html

Commands to apply the updated configuration and stateful set files to the cluster.

```bash
kubectl apply -f config.yaml
kubectl apply -f sts.yaml
```
Tokens:
Raw