Configuration

Cratis AuthProxy is configured entirely through the Cratis:AuthProxy section of appsettings.json (or equivalent environment variables using the Cratis__AuthProxy__ prefix).

{
  "Cratis": {
    "AuthProxy": {
      "Authentication": { ... },
      "Authorization": { ... },
      "Admission": { ... },
      "TenantResolutions": [ ... ],
      "TenantVerification": { ... },
      "Tenants": { ... },
      "Services": { ... },
      "Session": { ... },
      "SignIn": { ... },
      "Logout": { ... },
      "Ingress": { ... },
      "Invite": { ... },
      "Management": { ... },
      "ActivityTimeout": "00:05:00",
      "PagesPath": "",
      "DataProtectionKeysPath": "",
      "DataProtection": { ... }
    }
  }
}

Topic	Description
Authentication	OIDC providers, OAuth 2.0 providers such as GitHub, JWT Bearer configuration, and bearer routes for access tokens from an external authorization server.
Authorization	Requiring a claim — a role, a group, a GitHub organization or team — before any request is forwarded.
Admission	Answering nothing at all until a caller presents a capability your own verifier admits, for a deployment whose existence is not meant to be discoverable.
Tenancy	How the auth proxy resolves the current tenant from each request, and how to verify tenant existence.
Tenant Selection Page	How selection-based tenant resolution works and how to build/override select-tenant.html.
Data Protection Keys	Sharing the key ring that encrypts sessions and tokens between replicas: a file system, Azure Blob Storage or Redis, with optional Azure Key Vault key protection.
Trusted Proxies	Which callers may speak for the client through X-Forwarded-For and X-Forwarded-Proto, and how many hops to follow.
Services	Routing requests to backend and frontend services, and the idle timeout that applies to proxied requests, WebSockets and SSE streams.
One Proxy, Several Hosts	Giving each application its own host behind one AuthProxy and one sign-in, with a shared session cookie and a single identity-provider callback.
Management Listener	An opt-in private listener carrying liveness and readiness endpoints, so a probe tests more than “a process accepted a socket”.
Lobby	Invite and registration flows that hand users off to the lobby experience.
Well-Known Pages	Built-in HTML pages (provider selection, errors, tenant not found) and how to override them via a mounted volume.