Configuration

Cratis AuthProxy is configured entirely through the Cratis:AuthProxy section of appsettings.json (or equivalent environment variables using the Cratis__AuthProxy__ prefix).

{
  "Cratis": {
    "AuthProxy": {
      "Authentication": { ... },
      "Authorization": { ... },
      "TenantResolutions": [ ... ],
      "TenantVerification": { ... },
      "Tenants": { ... },
      "Services": { ... },
      "Invite": { ... },
      "PagesPath": "",
      "DataProtectionKeysPath": ""
    }
  }
}

Topic	Description
Authentication	OIDC providers, OAuth 2.0 providers such as GitHub, and JWT Bearer configuration.
Authorization	Requiring a claim — a role, a group, a GitHub organization or team — before any request is forwarded.
Tenancy	How the auth proxy resolves the current tenant from each request, and how to verify tenant existence.
Tenant Selection Page	How selection-based tenant resolution works and how to build/override select-tenant.html.
Services	Routing requests to backend and frontend services.
Lobby	Invite and registration flows that hand users off to the lobby experience.
Well-Known Pages	Built-in HTML pages (provider selection, errors, tenant not found) and how to override them via a mounted volume.