Project: sso (Provisioning / Key Management)
File: sso_authenticator_config.md

We currently use environment variables to read configuration options, below is a list of environment variables and their corresponding types that the sso authenticator will read. Defaults for the below settings can be found here: https://github.com/buzzfeed/sso/blob/main/internal/auth/configuration.go#L66-L117 ``` SESSIONCOOKIENAME - string - name associated with the session cookie SESSIONCOOKIESECRET - string - seed string for secure cookies SESSIONCOOKIEDOMAIN - string - cookie domain to force cookies to (ie: .yourcompany.com)* SESSION_KEY - string - seed string for secure auth codes SESSIONCOOKIESECURE - bool - set secure (HTTPS) cookie flag SESSIONCOOKIEHTTPONLY - bool - set 'httponly' cookie flag SESSIONCOOKIEREFRESH - time.Duration - duration to refresh the cookie after SESSIONCOOKIEEXPIRE - time.Duration - duration that cookie is valid for SESSION_LIFETIME - time.Duration - the session TTL ``` ``` CLIENTPROXYID - string - Client ID matching the SSO Proxy client ID CLIENTPROXYSECRET - string - Client secret matching the SSO Proxy client secret ``` ``` SERVER_SCHEME - string - scheme the server will use, e.g. `https` SERVER_HOST - string - host header that's required on incoming requests SERVER_PORT - string - port the http server listens on SERVERTIMEOUTREQUEST - time.Duration - overall request timeout SERVERTIMEOUTWRITE - time.Duration - write request timeout SERVERTIMEOUTREAD - time.Duration - read request timeout SERVERTIMEOUTSHUTDOWN - time.Duration - time to allow in-flight requests to complete before server shutdown ``` ``` AUTHORIZEPROXYDOMAINS - []string - only redirect to the specified proxy domains. AUTHORIZEEMAILDOMAINS - []string - authenticate emails with the specified domains. Use `*` to authenticate any email AUTHORIZEEMAILADDRESSES - []string - authenticate emails with the specified email addresses. Use `*` to authenticate any email ``` ``` METRICSSTATSDPORT - int - port that statsdclient listens on METRICSSTATSDHOST - string - hostname that statsd client uses ``` ``` LOGGING_ENABLE - bool - enable request logging LOGGING_LEVEL - string - level at which to log at, e.g. 'INFO' ``` `*` in the below variables acts as a logical idendifier to group configuration variables together for any one provider. This should be changed to an identifier that makes sense for your use case. ``` PROVIDER*TYPE - string - determines the type of provider (supported options: google, okta) PROVIDER*SLUG - string - unique provider 'slug' that is used to separate and create routes to individual providers. PROVIDER*CLIENT_ID - string - OAuth Client ID PROVIDER*CLIENT_SECRET - string - OAuth Client secret PROVIDER*SCOPE - string - OAuth scopes the provider will use. Default standard set of scopes pre-set in individual provider files; which this configuration variable overrides. ``` ``` PROVIDER*GOOGLE_CREDENTIALS - string - the path to the Google account's json credential file PROVIDER*GOOGLE_IMPERSONATE - string - the Google account to impersonate for API calls ``` ``` PROVIDER*OKTA_URL - string - the URL for your Okta domain, e.g. `<company>.okta.com` PROVIDER*OKTA_SERVER - string - the authorisation server ID ``` ``` PROVIDER*GROUPCACHEINTERVALREFRESH - time.Duration - cache TTL for the groups fillcache mechanism used to preemptively fill group caches PROVIDER*GROUPCACHEINTERVALPROVIDER - time.Duration - cache TTL for the group cache provider used for on demand group caching ```