Product documentation
Federation members configuration
Generated reference for the oauthy.* configuration bound by Federation members.
Federation members configuration
Per-provider OIDC / SAML connectors a tenant attaches (Entra ID, Okta, Google, Apple, GitHub, LDAP, ERP, SAML, ...).
oauthy.federation.adfs
Owner: federation-members/adfs · Source: servers/federation-members/adfs/src/main/kotlin/com/devnow/oauthy/federation/adfs/config/AdfsMemberProperties.kt
Tenant-side configuration for the ADFS federation member.
| Property | Type | Default | Description |
|---|---|---|---|
oauthy.federation.adfs.tenant.idp-metadata-url | String | "" | URL of the ADFS Federation Metadata document. |
oauthy.federation.adfs.tenant.idp-metadata-xml | String | "" | Inline metadata XML. |
oauthy.federation.adfs.tenant.entity-id | String | "" | The SP entity ID. |
oauthy.federation.adfs.tenant.assertion-consumer-service-url | String | "" | The Thoryn ACS callback URL — where ADFS POSTs the SAML response. |
oauthy.federation.adfs.tenant.want-assertions-encrypted | Boolean | false | Whether ADFS encrypts the SAML assertion. |
oauthy.federation.adfs.tenant.want-authn-requests-signed | Boolean | false | Whether the connector signs its AuthnRequests. |
oauthy.federation.adfs.clients[].client-id | String | "hub-client" | |
oauthy.federation.adfs.clients[].client-secret | String | "hub-secret" | |
oauthy.federation.adfs.clients[].redirect-uri | String | "http://localhost:8080/login/oauth2/code/adfs" |
oauthy.federation.apple
Owner: federation-members/apple · Source: servers/federation-members/apple/src/main/kotlin/com/devnow/oauthy/federation/apple/config/AppleProperties.kt
Configuration for the Apple federation member.
| Property | Type | Default | Description |
|---|---|---|---|
oauthy.federation.apple.team-id | String | "" | Apple Team ID (10-character string from Apple Developer portal). |
oauthy.federation.apple.client-id | String | "" | Apple Service ID / OAuth2 client_id (e.g. |
oauthy.federation.apple.vault-key-path | String | "secret/thoryn/apple/p256-private-key" | Vault KV path containing the PKCS#8 PEM-encoded P-256 private key. |
oauthy.federation.apple.clients[].client-id | String | "hub-client" | |
oauthy.federation.apple.clients[].client-secret | String | "hub-secret" | |
oauthy.federation.apple.clients[].redirect-uri | String | "http://localhost:8080/login/oauth2/code/apple-member" | |
oauthy.federation.apple.public-base-url | String | "" | SSO-832: public origin (scheme://host[:port]) of this Apple federation member instance. |
oauthy.federation.dummy
Owner: federation-members/dummy-member · Source: servers/federation-members/dummy-member/src/main/kotlin/com/devnow/oauthy/federation/dummy/config/DummyMemberProperties.kt
| Property | Type | Default | Description |
|---|---|---|---|
oauthy.federation.dummy.clients[].client-id | String | "hub-client" | |
oauthy.federation.dummy.clients[].client-secret | String | "hub-secret" | |
oauthy.federation.dummy.clients[].redirect-uri | String | "http://localhost:8080/login/oauth2/code/hub-client" | |
oauthy.federation.dummy.users[].username | String | "testuser" | |
oauthy.federation.dummy.users[].password | String | "testpass" |
oauthy.federation.erp
Owner: federation-members/erp-connector · Source: servers/federation-members/erp-connector/src/main/kotlin/com/devnow/oauthy/federation/erp/config/ErpConnectorProperties.kt
| Property | Type | Default | Description |
|---|---|---|---|
oauthy.federation.erp.issuer | String | "http://localhost:9004" | |
oauthy.federation.erp.api-key | String | "erp-dev-secret" | |
oauthy.federation.erp.oidc.allowed-claims | List<String> | (empty) | |
oauthy.federation.erp.oidc.demo-password | String | "erp-demo-pass" | |
oauthy.federation.erp.oidc.claim-key-for-login | String | "employee_id" | |
oauthy.federation.erp.oidc.clients[].client-id | String | "" | |
oauthy.federation.erp.oidc.clients[].client-secret | String | "" | |
oauthy.federation.erp.oidc.clients[].redirect-uri | String | "" | |
oauthy.federation.erp.connector.type | ConnectorType | ConnectorType.MEMORY | |
oauthy.federation.erp.connector.memory.entries[].claim-key | String | "" | |
oauthy.federation.erp.connector.memory.entries[].claim-value | String | "" | |
oauthy.federation.erp.connector.memory.entries[].attributes | Map<String, Any> | (empty) | |
oauthy.federation.erp.connector.memory.entries[].valid | Boolean | true | |
oauthy.federation.erp.connector.jdbc.url | String | "" | |
oauthy.federation.erp.connector.jdbc.username | String | "" | |
oauthy.federation.erp.connector.jdbc.password | String | "" | |
oauthy.federation.erp.connector.jdbc.lookup-query | String | "SELECT * FROM users WHERE id = :value" | |
oauthy.federation.erp.connector.rest.base-url | String | "" | |
oauthy.federation.erp.connector.rest.lookup-path | String | "/lookup" | |
oauthy.federation.erp.connector.rest.method | String | "POST" | |
oauthy.federation.erp.connector.rest.claim-param | String | "id" | |
oauthy.federation.erp.connector.rest.auth-header | String | "" | |
oauthy.federation.erp.connector.rest.connect-timeout-ms | Long | 5000 | |
oauthy.federation.erp.connector.rest.read-timeout-ms | Long | 10000 | |
oauthy.federation.erp.connector.rest.response-attributes-paths | Map<String, String> | (empty) | |
oauthy.federation.erp.connector.rest.response-active-path | String | "" |
oauthy.federation.github
Owner: federation-members/github-member · Source: servers/federation-members/github-member/src/main/kotlin/com/devnow/oauthy/federation/github/config/GitHubMemberProperties.kt
| Property | Type | Default | Description |
|---|---|---|---|
oauthy.federation.github.clients[].client-id | String | required | |
oauthy.federation.github.clients[].client-secret | String | required | |
oauthy.federation.github.clients[].redirect-uri | String | required |
oauthy.federation.google
Owner: federation-members/google-workspace · Source: servers/federation-members/google-workspace/src/main/kotlin/com/devnow/oauthy/federation/google/config/GoogleWorkspaceMemberProperties.kt
Configuration properties for the Google Workspace federation member.
| Property | Type | Default | Description |
|---|---|---|---|
oauthy.federation.google.clients[].client-id | String | required | |
oauthy.federation.google.clients[].client-secret | String | required | |
oauthy.federation.google.clients[].redirect-uri | String | required | |
oauthy.federation.google.tenant.client-id | String | "" | OAuth client ID minted in Google Cloud Console (APIs & Services → Credentials → OAuth client ID). |
oauthy.federation.google.tenant.client-secret | String | "" | OAuth client secret paired with clientId. |
oauthy.federation.google.tenant.hosted-domain | String | "" | The customer's Google Workspace domain (e.g. |
oauthy.federation.google.tenant.issuer-override | String? | null | Optional override for the OIDC issuer; default is https://accounts.google.com. |
oauthy.federation.ldap
Owner: federation-members/ldap-connector · Source: servers/federation-members/ldap-connector/src/main/kotlin/com/devnow/oauthy/federation/ldap/LdapConnectorProperties.kt
| Property | Type | Default | Description |
|---|---|---|---|
oauthy.federation.ldap.issuer | String | "http://localhost:9003" | |
oauthy.federation.ldap.api-key | String | "ldap-dev-secret" | |
oauthy.federation.ldap.directory.url | String | "ldap://localhost:8389" | |
oauthy.federation.ldap.directory.base-dn | String | "ou=staff,dc=hospital,dc=demo" | |
oauthy.federation.ldap.directory.bind-dn | String? | null | |
oauthy.federation.ldap.directory.bind-password | String? | null | |
oauthy.federation.ldap.directory.filter-template | String | "(&(uid={value}))" | |
oauthy.federation.ldap.directory.claim-attribute | String | "uid" | |
oauthy.federation.ldap.directory.return-attributes | List<String> | listOf("uid", "givenName", "sn", "employeeType", "description") | |
oauthy.federation.ldap.directory.attribute-mappings | Map<String, String> | mapOf( "givenName" to "given_name", "sn" to "family_name", "uid" to "employee... | |
oauthy.federation.ldap.directory.active-attribute | String? | null | |
oauthy.federation.ldap.directory.active-value | String? | null | |
oauthy.federation.ldap.oidc.clients[].client-id | String | "" | |
oauthy.federation.ldap.oidc.clients[].client-secret | String | "" | |
oauthy.federation.ldap.oidc.clients[].redirect-uri | String | "" | |
oauthy.federation.ldap.oidc.demo-password | String | "demo-pass" |
oauthy.federation.pingfederate
Owner: federation-members/pingfederate · Source: servers/federation-members/pingfederate/src/main/kotlin/com/devnow/oauthy/federation/pingfederate/config/PingFederateMemberProperties.kt
Configuration properties for the PingFederate federation member.
| Property | Type | Default | Description |
|---|---|---|---|
oauthy.federation.pingfederate.clients[].client-id | String | required | |
oauthy.federation.pingfederate.clients[].client-secret | String | required | |
oauthy.federation.pingfederate.clients[].redirect-uri | String | required | |
oauthy.federation.pingfederate.tenant.registration-id | String | "pingfederate" | internal identifier used by Spring Security's SAML registration repository; defaults to "pingfederate". |
oauthy.federation.pingfederate.tenant.idp-metadata-url | String | "" | URL to fetch the PingFed IdP metadata (typical: https://pingfed.acme.com/pf/federation_metadata.ping). |
oauthy.federation.pingfederate.tenant.idp-metadata-xml | String | "" | pasted PingFed IdP metadata XML. |
oauthy.federation.pingfederate.tenant.entity-id | String | "" | the Thoryn SP's entity ID (advertised in SP metadata). |
oauthy.federation.pingfederate.tenant.assertion-consumer-service-url | String | "" | the Thoryn ACS URL (where PingFed POSTs the SAML response). |
oauthy.federation.pingfederate.tenant.want-assertions-encrypted | Boolean | true | whether the SP requires PingFed to encrypt the SAML assertion. |
oauthy.federation.pingfederate.tenant.attribute-mapping | Map<String, String> | (empty) | override map: PingFed source attribute → broker claim. |
oauthy.federation.saml
Owner: federation-members/saml-member · Source: servers/federation-members/saml-member/src/main/kotlin/com/devnow/oauthy/federation/saml/config/SamlMemberProperties.kt
| Property | Type | Default | Description |
|---|---|---|---|
oauthy.federation.saml.clients[].client-id | String | "hub-client" | |
oauthy.federation.saml.clients[].client-secret | String | "hub-secret" | |
oauthy.federation.saml.clients[].redirect-uri | String | "http://localhost:8080/login/oauth2/code/saml-member" | |
oauthy.federation.saml.identity-providers[].registration-id | String | required | |
oauthy.federation.saml.identity-providers[].entity-id | String | "" | |
oauthy.federation.saml.identity-providers[].sso-url | String | "" | |
oauthy.federation.saml.identity-providers[].certificate | String? | null | |
oauthy.federation.saml.identity-providers[].metadata-uri | String? | null | |
oauthy.federation.saml.identity-providers[].metadata-refresh-interval-seconds | Long | 86400 | |
oauthy.federation.saml.identity-providers[].want-authn-requests-signed | Boolean | true | |
oauthy.federation.saml.identity-providers[].want-assertions-encrypted | Boolean | false | |
oauthy.federation.saml.signing.keys[].alias | String | "default" | |
oauthy.federation.saml.signing.keys[].certificate | String | "" | |
oauthy.federation.saml.signing.keys[].private-key | String | "" | |
oauthy.federation.saml.signing.keys[].primary | Boolean | false | |
oauthy.federation.saml.signing.grace-period-days | Int | 30 | |
oauthy.federation.saml.signing.warning-threshold-days | Int | 30 |
Every property above is set as a YAML key under application.yml or, equivalently, as an environment variable using Spring's relaxed binding (oauthy.hub.platform-client-ids -> OAUTHY_HUB_PLATFORM_CLIENT_IDS). A _required_ default means the service will not start until the value is supplied.