Authentication Mode Configuration

This page covers how to set each service's authentication mode, for incoming requests and for calls to other services. For how the modes and STS work, see Authentication Architecture.

Security Warning

UNSAFE_NONE and UNSAFE_STATIC provide no tenant isolation or audit trails. Do not use in production.

Core

Set the authentication mode with app.auth.mode:

app:
  auth:
    mode: STS  # UNSAFE_NONE | UNSAFE_STATIC | STS

Static token

Also set app.auth.staticToken:

app:
  auth:
    mode: UNSAFE_STATIC
    staticToken: "your-token"

STS

Also configure the stsTokenValidation block:

app:
  auth:
    mode: STS
    stsTokenValidation:
      aud: one-core
      iss: "https://your-sts-host"
      jwksUri: "https://your-sts-host/.well-known/jwks.json"
      jwksRefreshAfterSeconds: 600
      jwksExpireAfterSeconds: 86400
      leewaySeconds: 60

WRPR and Bridge

WRPR and Bridge have identical configuration. Each service has two concerns: how it accepts incoming requests, and how it communicates with Core.

Inbound authentication

Set the authentication mode with auth.mode:

auth:
  mode: STS  # UNSAFE_NONE | UNSAFE_STATIC | STS

Static token

Also set auth.staticToken:

auth:
  mode: UNSAFE_STATIC
  staticToken: "your-token"

STS

Also configure the stsTokenValidation block:

auth:
  mode: STS
  stsTokenValidation:
    aud: one-wallet-relying-party-registry
    iss: "https://your-sts-host"
    jwksRefreshAfterSeconds: 600  # 10mins
    jwksExpireAfterSeconds: 86400 # 1 day
    jwksUri: "https://your-sts-host/.well-known/jwks.json"

Outbound to Core

Set core.api.authentication to match Core's authentication mode:

core:
  api:
    authentication: STS  # UNSAFE_NONE | UNSAFE_STATIC | STS

If Core is using static token, also provide the token:

core:
  api:
    authentication: UNSAFE_STATIC
    staticToken: "your-token"

BFF

BFF always uses STS for inbound authentication. Configure the stsTokenValidation block:

auth:
  stsTokenValidation:
    aud: one-bff-client
    iss: "https://your-sts-host"
    jwksRefreshAfterSeconds: 600
    jwksExpireAfterSeconds: 86400
    leewaySeconds: 60

Configure how BFF communicates with each downstream service to match that service's authentication mode:

core:
  api:
    authentication: STS  # UNSAFE_NONE | UNSAFE_STATIC | STS

bridge:
  api:
    authentication: STS  # UNSAFE_NONE | UNSAFE_STATIC | STS

wrpr:
  api:
    authentication: STS  # UNSAFE_NONE | UNSAFE_STATIC | STS

If any service is using static token, also provide the token for that service:

core:
  api:
    authentication: UNSAFE_STATIC
    staticToken: "your-token"

Related pages

Authentication Architecture	Authentication architecture and STS mode in depth
Integrate Okta	Reference configuration for Okta as your IAM provider
Integrate Keycloak	Reference configuration for Keycloak as your IAM provider
Technical User Delegation	Set up non-Core services to authenticate with your IAM as technical users