Product documentation
Authorization hub configuration
Generated reference for the oauthy.* configuration bound by Authorization hub.
Authorization hub configuration
The OAuth 2.0 / OIDC identity broker (Spring Authorization Server). Tenancy, rate limiting, client provisioning, and security-event forwarding.
oauthy.account-consent.service-identity.k8s
Owner: authorization-hub · Source: servers/authorization-hub/src/main/kotlin/com/devnow/oauthy/consent/AccountConsentServiceIdentityProperties.kt
SSO-2564 (C5, epic SSO-2559) — configuration for the projected-SA gate on the hub's end-user consent seam (GET/DELETE /internal/account/consents, InternalAccountConsentController).
| Property | Type | Default | Description |
|---|---|---|---|
oauthy.account-consent.service-identity.k8s.enabled | Boolean | false | Gate for the whole channel. |
oauthy.account-consent.service-identity.k8s.issuer | String | "https://kubernetes.default.svc.cluster.local" | Expected iss claim — the cluster SA issuer. |
oauthy.account-consent.service-identity.k8s.jwks-uri | String | "https://kubernetes.default.svc/openid/v1/jwks" | In-cluster OIDC JWKS address the decoder fetches the cluster keys from. |
oauthy.account-consent.service-identity.k8s.audience | String | "hub-internal-auth" | Audience identity-service's projected token for this channel is pinned to (hub-internal-auth) — the shared identity→hub channel (SSO-2399). |
oauthy.account-consent.service-identity.k8s.allowed-sub | String | "^system:serviceaccount:thoryn:thoryn-identity-audit-emitter$" | Anchored exact-match caller allow-list — identity-service's pod ServiceAccount. |
oauthy.account-consent.service-identity.k8s.ca-path | String | "/var/run/secrets/kubernetes.io/serviceaccount/ca.crt" | Cluster CA bundle path for the JWKS TLS trust. |
oauthy.account-consent.service-identity.k8s.token-path | String | "/var/run/secrets/kubernetes.io/serviceaccount/token" | Projected SA token presented as a Bearer on the JWKS fetch. |
oauthy.account-consent.service-identity.k8s.connect-timeout | Duration | Duration.ofSeconds(2) | Connect timeout for the JWKS fetch. |
oauthy.account-consent.service-identity.k8s.read-timeout | Duration | Duration.ofSeconds(2) | Read timeout for the JWKS fetch. |
oauthy.account-linking.service-identity.k8s
Owner: authorization-hub · Source: servers/authorization-hub/src/main/kotlin/com/devnow/oauthy/accountlinking/AccountLinkIntentServiceIdentityProperties.kt
SSO-2399 (slice 4b of SSO-2384 / D2 federated-invitation-accept) — configuration for the projected-SA gate on the hub's invite-accept mint endpoint (POST /internal/account-link-intents, InternalAccountLinkIntentController).
| Property | Type | Default | Description |
|---|---|---|---|
oauthy.account-linking.service-identity.k8s.enabled | Boolean | false | Gate for the whole channel. |
oauthy.account-linking.service-identity.k8s.issuer | String | "https://kubernetes.default.svc.cluster.local" | Expected iss claim — the cluster SA issuer (SSO-1477). |
oauthy.account-linking.service-identity.k8s.jwks-uri | String | "https://kubernetes.default.svc/openid/v1/jwks" | In-cluster OIDC JWKS address the decoder fetches the cluster keys from. |
oauthy.account-linking.service-identity.k8s.audience | String | "hub-internal-auth" | Audience identity-service's projected token for this channel is pinned to (hub-internal-auth). |
oauthy.account-linking.service-identity.k8s.allowed-sub | String | "^system:serviceaccount:thoryn:thoryn-identity-audit-emitter$" | Anchored (^…$) exact-match caller allow-list — identity-service's ServiceAccount (thoryn-identity-audit-emitter, the pod SA under which the kubelet mints this channel's token). |
oauthy.account-linking.service-identity.k8s.ca-path | String | "/var/run/secrets/kubernetes.io/serviceaccount/ca.crt" | Cluster CA bundle path for the JWKS TLS trust (SSO-1468). |
oauthy.account-linking.service-identity.k8s.token-path | String | "/var/run/secrets/kubernetes.io/serviceaccount/token" | Projected SA token presented as a Bearer on the JWKS fetch (SSO-1471). |
oauthy.account-linking.service-identity.k8s.connect-timeout | Duration | Duration.ofSeconds(2) | Connect timeout for the JWKS fetch (SSO-1468 blast-radius bound). |
oauthy.account-linking.service-identity.k8s.read-timeout | Duration | Duration.ofSeconds(2) | Read timeout for the JWKS fetch (SSO-1468 blast-radius bound). |
oauthy.applications.service-identity.k8s
Owner: authorization-hub · Source: servers/authorization-hub/src/main/kotlin/com/devnow/oauthy/applications/InternalApplicationsServiceIdentityProperties.kt
SSO-2219 — configuration for the service-identity ingress lock on the hub's /internal/applications/[] surface (the OAuth-client CRUD + claims-webhook proxy that product-api calls).
| Property | Type | Default | Description |
|---|---|---|---|
oauthy.applications.service-identity.k8s.enabled | Boolean | false | Gate for the whole channel. |
oauthy.applications.service-identity.k8s.header-name | String | "X-Thoryn-Service-Authorization" | Request header carrying product-api's projected SA token (value Bearer <token> or a bare token). |
oauthy.applications.service-identity.k8s.issuer | String | "https://kubernetes.default.svc.cluster.local" | Expected iss claim — the cluster SA issuer (SSO-1477). |
oauthy.applications.service-identity.k8s.jwks-uri | String | "https://kubernetes.default.svc/openid/v1/jwks" | In-cluster OIDC JWKS address the decoder fetches the cluster keys from. |
oauthy.applications.service-identity.k8s.audience | String | "hub-applications-facade" | Audience product-api's service-identity projected token is pinned to (hub-applications-facade). |
oauthy.applications.service-identity.k8s.allowed-sub | String | "^system:serviceaccount:thoryn:thoryn-product-api$" | Anchored (^…$) exact-match caller allow-list — product-api's ServiceAccount. |
oauthy.applications.service-identity.k8s.ca-path | String | "/var/run/secrets/kubernetes.io/serviceaccount/ca.crt" | Cluster CA bundle path for the JWKS TLS trust (SSO-1468). |
oauthy.applications.service-identity.k8s.token-path | String | "/var/run/secrets/kubernetes.io/serviceaccount/token" | Projected SA token presented as a Bearer on the JWKS fetch (SSO-1471). |
oauthy.applications.service-identity.k8s.connect-timeout | Duration | Duration.ofSeconds(2) | Connect timeout for the JWKS fetch (SSO-1468 blast-radius bound). |
oauthy.applications.service-identity.k8s.read-timeout | Duration | Duration.ofSeconds(2) | Read timeout for the JWKS fetch (SSO-1468 blast-radius bound). |
oauthy.hooks
Owner: authorization-hub · Source: servers/authorization-hub/src/main/kotlin/com/devnow/oauthy/hooks/HookEngineProperties.kt
SSO-1956 (Actions/Hooks H2) — engine-level configuration for the inline hook executor.
| Property | Type | Default | Description |
|---|---|---|---|
oauthy.hooks.rate-limit.per-tenant-per-minute | Int | 0 | Maximum inline-hook invocations per tenant per stage per minute. |
oauthy.hub
Owner: authorization-hub · Source: servers/authorization-hub/src/main/kotlin/com/devnow/oauthy/clients/HubClientProperties.kt
Hub-side OAuth-client tunables (SSO-1507, extended by SSO-1451).
| Property | Type | Default | Description |
|---|---|---|---|
oauthy.hub.platform-client-ids | Set<String> | setOf("self-service-bff", "thoryn-cli", "delegation-service-issuer-client") | platformClientIds is the allowlist of platform OAuth clients that must resolve under every tenant, not just the default tenant they are seeded under. |
oauthy.hub.scope-conformance.enabled | Boolean | true | run the check on startup at all (default true). |
oauthy.hub.scope-conformance.fail-on-gap | Boolean | false | when true, a gap fails hub readiness (opt-in, default false). |
oauthy.hub.scope-conformance.expected-scopes | Map<String, Set<String>> | DEFAULT_EXPECTED_SCOPES | per-client login-scope manifest (clientId -> scopes). |
oauthy.hub.infra-secret-reconciler
Owner: authorization-hub · Source: servers/authorization-hub/src/main/kotlin/com/devnow/oauthy/clients/HubInfraClientSecretReconcilerProperties.kt
SSO-2137 (epic SSO-2101, Vault-at-deploy) — the strong, deploy-injected plaintext secrets for the Class-A live prod infra clients, read by HubInfraClientSecretReconciler at startup.
| Property | Type | Default | Description |
|---|---|---|---|
oauthy.hub.infra-secret-reconciler.self-service-bff-secret | String? | null | strong plaintext for the self-service-bff client (the console BFF, thoryn-web). |
oauthy.hub.infra-secret-reconciler.thoryn-cli-secret | String? | null | strong plaintext for the thoryn-cli client (the thoryn CLI, thoryn-web). |
oauthy.hub.infra-secret-reconciler.product-api-internal-secret | String? | null | strong plaintext for the product-api-internal S2S client. |
oauthy.hub.infra-secret-reconciler.broker-provisioner-secret | String? | null | strong plaintext for the thoryn-vc-broker-provisioner client (V108 / SSO-2255). |
oauthy.hub.infra-secret-reconciler.require-product-api-internal-secret | Boolean | false | SSO-2137 Slice 2 prod fail-loud gate. |
oauthy.hub.webhook
Owner: authorization-hub · Source: servers/authorization-hub/src/main/kotlin/com/devnow/oauthy/webhook/WebhookEndpointUrlValidator.kt
SSO-1904 — hub-side webhook config: the operator-controlled in-cluster-host allowlist for claims-webhook endpoint URLs.
| Property | Type | Default | Description |
|---|---|---|---|
oauthy.hub.webhook.allowed-internal-hosts | Set<String> | (empty) | allowedInternalHosts is an EXACT-MATCH set of hostnames (no wildcards, no suffix matching, case-insensitive) that WebhookEndpointUrlValidator exempts from the private-address rejection of the SSO-772 SSRF policy — and from nothing else.... |
oauthy.jit-provisioning
Owner: authorization-hub · Source: servers/authorization-hub/src/main/kotlin/com/devnow/oauthy/provisioning/JitProvisioningProperties.kt
SSO-73 — hub-side storage for attribute-based JIT provisioning rules (v1).
| Property | Type | Default | Description |
|---|---|---|---|
oauthy.jit-provisioning.enabled | Boolean | true | master kill-switch; when false the engine emits no actions regardless of configured rules. |
oauthy.jit-provisioning.rules | Map<String, List<JitProvisioningRule>> | (empty) | tenant id → the ordered rules that apply to that tenant's federation logins. |
oauthy.ratelimit
Owner: authorization-hub · Source: servers/authorization-hub/src/main/kotlin/com/devnow/oauthy/ratelimit/RateLimitProperties.kt
| Property | Type | Default | Description |
|---|---|---|---|
oauthy.ratelimit.enabled | Boolean | true | |
oauthy.ratelimit.tenant-requests-per-minute | Long | 1000 | |
oauthy.ratelimit.client-requests-per-minute | Long | 100 | |
oauthy.ratelimit.ip-requests-per-minute | Long | 300 | |
oauthy.ratelimit.activate-user-code-max-attempts | Long | 10 | SSO-2301 — device verification (POST /activate) per-(tenant, user_code) brute-force cap (RFC 8628 §5.1). |
oauthy.ratelimit.activate-user-code-window-seconds | Long | 900 | SSO-2301 — fixed-window length for activateUserCodeMaxAttempts, in seconds (default 15 min). |
oauthy.security-events
Owner: authorization-hub · Source: servers/authorization-hub/src/main/kotlin/com/devnow/oauthy/observability/SecurityEventForwarderProperties.kt
SSO-1107 — configuration for cross-module security-event forwarding.
| Property | Type | Default | Description |
|---|---|---|---|
oauthy.security-events.identity-service.base-url | String | "" | Base URL of the identity-service, no trailing slash. |
oauthy.security-events.identity-service.bearer | String | "" | Bearer token forwarded as Authorization: Bearer <bearer> to authenticate the hub-to-identity-service call. |
oauthy.tenancy
Owner: authorization-hub · Source: servers/authorization-hub/src/main/kotlin/com/devnow/oauthy/tenancy/TenantProperties.kt
Tenancy configuration properties.
| Property | Type | Default | Description |
|---|---|---|---|
oauthy.tenancy.platform-domain | String | ".thoryn.io" | Subdomain suffix used for slug-based tenant resolution and issuer URI generation. |
oauthy.tenancy.in-cluster-service-hosts | Set<String> | (empty) | SSO-1566 — in-cluster Kubernetes Service hostnames that resolve to the default (platform) tenant, generalising the built-in localhost / 127.0.0.1 shortcut to the cluster-DNS name(s) a server-to-server caller uses. |
oauthy.tenancy.default-tenant-hosts | Set<String> | (empty) | SSO-1450 — EXTERNAL per-product-gateway / platform alias hostnames that resolve to the default (platform) tenant, the same tenant the platform apex host (hub.<env>) serves. |
Every property above is set as a YAML key under application.yml or, equivalently, as an environment variable using Spring's relaxed binding (oauthy.hub.platform-client-ids -> OAUTHY_HUB_PLATFORM_CLIENT_IDS). A _required_ default means the service will not start until the value is supplied.