# ∞Directory configuration file

Type: object
No Additional Properties

##

Type: string
Must match regular expression: `^\./.*\.schema\.json$`

Must be at least `1` characters long

Must be at most `64` characters long

##

Type: object
No Additional Properties

##

## One of

Type: null

If null http.*_key authentication methods will be disabled.

Type: string

Api key secret used to protect api endpoints, this secret will be used as http Basic authentication with 'infinite' login. It will be preferred over OAuth2 method if both are specified.

Must be at least `1` characters long

##

Type: array of object

Must contain a maximum of `7` items

No Additional Items

#### Each item of this array must be:

#### Directory VHost

Type: object

optional directory api vhost for backend or administration usage, if specified this vhost will not accept client security schemes. Using separate vhosts allows to implement custom security rules (mTLS, ip filtering, ...) on the http gate based on api usage.

No Additional Properties

##

Type: object

Allow to disable specified api endpoints.

No Additional Properties

##

Type: boolean Default: false

If set, docstoreeditor gui (/directory/docstoreeditor) will be available. This gui should not be used in production.

##

Type: boolean Default: false

Unset this to disable /directory/api/directorysession/requestsuperadminregistrationcode and /directory/api/backend/registersuperadmin.

##

Type: boolean Default: false

If set, web api documentation will be available under /directory/webapidoc/. This is not recommanded for production servers.

##

Allows to restrict security flows accepted on this vhost

## One of

Type: null

Accept all security schemes

Type: array of enum (of string)

List of security flows accepted by the ∞Directory.

Must contain a minimum of `1` items

No Additional Items

#### Each item of this array must be:

Type: enum (of string)

#### Must be one of:

- "app.admin"
- "app.client"
- "back.admin"
- "back.connector"
- "back.infinite"

##

Allows to restrict security schemes accepted on this vhost

## One of

Type: null

Accept all security schemes

Type: array of enum (of string)

List of security schemes accepted by the ∞Directory.

Must contain a minimum of `1` items

No Additional Items

#### Each item of this array must be:

Type: enum (of string)

#### Must be one of:

- "http.directory_key"
- "http.m2m_bearer"
- "http.session_bearer"
- "infinitebearer.data_session"
- "infinitebearer.data_session_download_token"
- "infinitebearer.data_session_extended"
- "infinitebearer.directory_session"
- "infinitebearer.directory_session_download_token"
- "infinitebearer.directory_session_extended"
- "infiniteprivate"

##

Type: string

directory api url for public usage. The port has to be explicited as this attribute is part of the license.

Must match regular expression: `^https?:\/\/[^@\/A-Z]+?(:[1-9][0-9]{0,4})(\/.*)?\/directory$`

Must be at most `1024` characters long

##

Type: integer

bind port for ∞Directory api http implementation

Value must be greater or equal to `1` and lesser or equal to `65535`

##

Type: boolean Default: false

If true, authorization and vhost check will be disabled for /api/getversion endpoint. This is useful to run healthcheck of containers behind a load balancer were load balancer will use internal IP or hostname.

##

#### Host search order

Type: array of enum (of string)

Define which headers should be used to determine host and port used by the client.Unfortunately 2 sets of headers ('Forwarded' and 'X-Forwarded-*') exist for reverse proxy. So depending on your infrastructure you might need to change evaluation order. Evaluation will stop on the first header found. If no headers were found the 'Host' header will be used. Sometimes exotic configuration (like AWS) may preserve the Host header, add X-forwarded-port and discard X-forwarded-Host, in this case, the policy host-with-x-forwarded-port may be used.

All items must be unique

No Additional Items

#### Each item of this array must be:

Type: enum (of string)

#### Must be one of:

- "forwarded"
- "x-forwarded-*"
- "host-with-x-forwarded-port"

##

Type: boolean Default: true

enables log of received http requests

##

Type: integer

how long (in secondes) a bearer is kept in cache

Value must be greater or equal to `0` and lesser or equal to `500`

##

Type: boolean Default: false

specify if directory api http implementation should listen on any addresses, if false only loopback will be bound

##

#### Directory VHost

Type: object

main directory vhost always used by client applications. If a backendvhost security schemes is defined, implicit restrictions will be applied to this vhost. Should use HTTPS !

No Additional Properties

##

Type: object

Allow to disable specified api endpoints.

No Additional Properties

##

Type: boolean Default: false

If set, docstoreeditor gui (/directory/docstoreeditor) will be available. This gui should not be used in production.

##

Type: boolean Default: false

Unset this to disable /directory/api/directorysession/requestsuperadminregistrationcode and /directory/api/backend/registersuperadmin.

##

Type: boolean Default: false

If set, web api documentation will be available under /directory/webapidoc/. This is not recommanded for production servers.

##

Allows to restrict security flows accepted on this vhost

## One of

Type: null

Accept all security schemes

Type: array of enum (of string)

List of security flows accepted by the ∞Directory.

Must contain a minimum of `1` items

No Additional Items

#### Each item of this array must be:

Type: enum (of string)

#### Must be one of:

- "app.admin"
- "app.client"
- "back.admin"
- "back.connector"
- "back.infinite"

##

Allows to restrict security schemes accepted on this vhost

## One of

Type: null

Accept all security schemes

Type: array of enum (of string)

List of security schemes accepted by the ∞Directory.

Must contain a minimum of `1` items

No Additional Items

#### Each item of this array must be:

Type: enum (of string)

#### Must be one of:

- "http.directory_key"
- "http.m2m_bearer"
- "http.session_bearer"
- "infinitebearer.data_session"
- "infinitebearer.data_session_download_token"
- "infinitebearer.data_session_extended"
- "infinitebearer.directory_session"
- "infinitebearer.directory_session_download_token"
- "infinitebearer.directory_session_extended"
- "infiniteprivate"

##

Type: string

directory api url for public usage. The port has to be explicited as this attribute is part of the license.

Must match regular expression: `^https?:\/\/[^@\/A-Z]+?(:[1-9][0-9]{0,4})(\/.*)?\/directory$`

Must be at most `1024` characters long

##

## One of

Type: object

filer storage implemented using OS or network share filesystem. Used folder should be dedicated to this ∞Directory as it will automatically create/delete files !

No Additional Properties

##

Type: string

folder in which data will be stored. If relative, will be resolved relative to job file.

Must be at least `1` characters long

##

Type: const
Specific value: `"filesystem"`
Type: object

filer storage implemented using a Microsoft Azure storage account. This storage account should be dedicated to this ∞Directory as it will automatically create/delete blob containers !

No Additional Properties

##

#### Http client override configuration

Type: object

http configuration for calls to Azure blob rest api

No Additional Properties

##

Default: null

## One of

Type: null

Use global configuration

Type: object
No Additional Properties

##

Type: string

file path to client PEM certificate

Must be at least `1` characters long

##

Type: string

file path to client PEM private key

Must be at least `1` characters long

##

Type: string

private key password if any

Type: object
No Additional Properties

##

Type: string

file path to client P12 certificate

Must be at least `1` characters long

##

Type: string

private key password if any

Type: enum (of boolean)

Disable use of certificate

#### Must be one of:

- false

##

Default: null

## One of

Type: null

Use global configuration

Type: string

Enforce use of provided http proxy for http calls

Must match regular expression: `^https?:\/\/.*$`

Must be at most `1024` characters long

Type: enum (of boolean)

Disable use of any http proxy for http calls

#### Must be one of:

- false

Type: enum (of boolean)

Enforce use of the automatic http proxy configuration from the system for http calls

#### Must be one of:

- true

##

Default: null

## One of

Type: null

Use global configuration

Type: boolean

Set this value to false to disable ssl peer verification

##

Type: string

azure storage shared key. Example is the default shared_key for Azurite emulator.

Must match regular expression: `^(?:[A-Za-z0-9+\/]{4})*(?:[A-Za-z0-9+\/]{2}==|[A-Za-z0-9+\/]{3}=)?$`

Must be at most `4194304` characters long

##

Type: string

azure storage account name. Storage account name could not be deduced from the url as url format might differ due to use of reverse proxy or azurite. Example is the default storage account for Azurite emulator.

Must be at least `1` characters long

##

Type: const
Specific value: `"azureblob"`

##

Type: string

azure storage account url.

Must be at least `1` characters long

Type: object

Filer storage implemented using an Amazon S3 or Minio bucket storage. This bucket should be dedicated to this ∞Directory !

No Additional Properties

##

Type: string

The 'public' access key

Must be at least `1` characters long

##

#### Http client override configuration

Type: object

http configuration for calls to bucket storage rest api

No Additional Properties

##

Default: null

## One of

Type: null

Use global configuration

Type: object
No Additional Properties

##

Type: string

file path to client PEM certificate

Must be at least `1` characters long

##

Type: string

file path to client PEM private key

Must be at least `1` characters long

##

Type: string

private key password if any

Type: object
No Additional Properties

##

Type: string

file path to client P12 certificate

Must be at least `1` characters long

##

Type: string

private key password if any

Type: enum (of boolean)

Disable use of certificate

#### Must be one of:

- false

##

Default: null

## One of

Type: null

Use global configuration

Type: string

Enforce use of provided http proxy for http calls

Must match regular expression: `^https?:\/\/.*$`

Must be at most `1024` characters long

Type: enum (of boolean)

Disable use of any http proxy for http calls

#### Must be one of:

- false

Type: enum (of boolean)

Enforce use of the automatic http proxy configuration from the system for http calls

#### Must be one of:

- true

##

Default: null

## One of

Type: null

Use global configuration

Type: boolean

Set this value to false to disable ssl peer verification

##

Type: string

AWS region, for Minio use us-east-1

Must be at least `1` characters long

##

Type: string

The 'private' secret key

Must be at least `1` characters long

##

Type: const
Specific value: `"s3bucket"`

##

Type: string

Bucket url.

Must be at least `1` characters long

##

#### Http client global configuration

Type: object

http configuration

No Additional Properties

##

Default: false

## One of

Type: object
No Additional Properties

##

Type: string

file path to client PEM certificate

Must be at least `1` characters long

##

Type: string

file path to client PEM private key

Must be at least `1` characters long

##

Type: string

private key password if any

Type: object
No Additional Properties

##

Type: string

file path to client P12 certificate

Must be at least `1` characters long

##

Type: string

private key password if any

Type: enum (of boolean)

Disable use of certificate

#### Must be one of:

- false

##

Default: false

## One of

Type: string

Enforce use of provided http proxy for http calls

Must match regular expression: `^https?:\/\/.*$`

Must be at most `1024` characters long

Type: enum (of boolean)

Disable use of any http proxy for http calls

#### Must be one of:

- false

Type: enum (of boolean)

Enforce use of the automatic http proxy configuration from the system for http calls

#### Must be one of:

- true

##

Type: boolean Default: true

Set this value to false to disable ssl peer verification

##

#### Log configuration

Type: object
No Additional Properties

##

Type: array of string Default: []

rfDebug output that should be omitted

All items must be unique

No Additional Items

#### Each item of this array must be:

Type: string

Must be at least `1` characters long

##

Type: boolean Default: false

`loglevel` should be used instead. Enables DEBUG log level. This SHOULD NOT BE MAINTAINED IN PRODUCTION as it will log sensitive data and have a negative impact on overall performances.

##

Default: ""

## One of

Type: string

change default log location. If relative, will be resolved relative to configuration or job file.

Must be at least `1` characters long

Type: string

use default log location

Must be at least `0` characters long

Must be at most `0` characters long

Type: null

disable file logging

##

Type: boolean Default: true

enable log output to console

##

Type: enum (of string) Default: "INFO"

Specifies log level. `INFO` > `DEBUG` > `TRACE`. A log level lower than `INFO` SHOULD NOT BE MAINTAINED IN PRODUCTION as it will log sensitive data and have a negative impact on overall performances.

#### Must be one of:

- "INFO"
- "DEBUG"
- "TRACE"

##

#### Loki http log handler configuration

## One of

Type: null
Type: object

Configuration for Grafana Loki http push log handler

No Additional Properties

##

#### Http client override configuration

Type: object

http configuration for calls to calls to loki endpoint

No Additional Properties

##

Default: null

## One of

Type: null

Use global configuration

Type: object
No Additional Properties

##

Type: string

file path to client PEM certificate

Must be at least `1` characters long

##

Type: string

file path to client PEM private key

Must be at least `1` characters long

##

Type: string

private key password if any

Type: object
No Additional Properties

##

Type: string

file path to client P12 certificate

Must be at least `1` characters long

##

Type: string

private key password if any

Type: enum (of boolean)

Disable use of certificate

#### Must be one of:

- false

##

Default: null

## One of

Type: null

Use global configuration

Type: string

Enforce use of provided http proxy for http calls

Must match regular expression: `^https?:\/\/.*$`

Must be at most `1024` characters long

Type: enum (of boolean)

Disable use of any http proxy for http calls

#### Must be one of:

- false

Type: enum (of boolean)

Enforce use of the automatic http proxy configuration from the system for http calls

#### Must be one of:

- true

##

Default: null

## One of

Type: null

Use global configuration

Type: boolean

Set this value to false to disable ssl peer verification

##

Type: object

optional labels that will be added to loki streams

##

## Pattern Property

All properties whose name matches the following regular expression must respect the following conditions

Property name regular expression: `^(?!log$).*$`
Type: string

Must be at least `1` characters long

Must be at most `64` characters long

##

Additional Properties of any type are allowed.

Type: object

##

Type: string or null Default: null

loki connection login

##

Type: integer Default: 4096

maximum size in bytes of log message send to loki, if log entry is longer it will be truncated. If zero full message will not be truncated.

Value must be greater or equal to `0`

##

Type: string or null Default: null

loki connection password

##

Type: string

an url that should point to an endpoint compatible with POST /loki/api/v1/push, body will be gziped json, this endpoint is expected to return 200 or 204 on success. Url should not contains credentials.

Must match regular expression: `^https?:\/\/[^@\/]+?(\/.*)$`

Must be at most `1024` characters long

##

Type: integer Default: 64

Maximum log file size

Value must be greater or equal to `16` and lesser or equal to `1024`

##

Type: integer Default: 64

Number of backup log to keep, if -1 all logs will be kept

Value must be greater or equal to `-1` and lesser or equal to `512`

##

Type: enum (of string) Default: "weekly"

Enable time base log rotation

#### Must be one of:

- "disabled"
- "daily"
- "weekly"
- "monthly"

##

Type: object
No Additional Properties

##

#### OpenID connect common settings

Type: object

common OpenID connect settings

No Additional Properties

##

Type: string

OpenID Provider configuration url (https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderConfigurationRequest)

Must match regular expression: `^https:\/\/([^\/]*?)\/.*$`

Must be at most `1024` characters long

##

#### Http client override configuration

Type: object

http configuration for calls to calls to the OpenID server

No Additional Properties

##

Default: null

## One of

Type: null

Use global configuration

Type: object
No Additional Properties

##

Type: string

file path to client PEM certificate

Must be at least `1` characters long

##

Type: string

file path to client PEM private key

Must be at least `1` characters long

##

Type: string

private key password if any

Type: object
No Additional Properties

##

Type: string

file path to client P12 certificate

Must be at least `1` characters long

##

Type: string

private key password if any

Type: enum (of boolean)

Disable use of certificate

#### Must be one of:

- false

##

Default: null

## One of

Type: null

Use global configuration

Type: string

Enforce use of provided http proxy for http calls

Must match regular expression: `^https?:\/\/.*$`

Must be at most `1024` characters long

Type: enum (of boolean)

Disable use of any http proxy for http calls

#### Must be one of:

- false

Type: enum (of boolean)

Enforce use of the automatic http proxy configuration from the system for http calls

#### Must be one of:

- true

##

Default: null

## One of

Type: null

Use global configuration

Type: boolean

Set this value to false to disable ssl peer verification

##

## One of

Type: null

No OAuth2 configuration for machine to machine communication, http.m2m_bearer will be disabled and api key will be used.

#### OpenID Connect M2M settings

Type: object

Configure OAuth2 machine to machine identification using OpenID Connect client credentials flow. See http.m2m_bearer authentication method. Those settings will be used to acquire a token and to validate received tokens.

No Additional Properties

##

Type: object

specifies additional query parameters that should be added to oidc endpoint calls

No Additional Properties

##

Type: object

additional query parameters for token_endpoint

No Additional Properties

##

## Pattern Property

All properties whose name matches the following regular expression must respect the following conditions

Property name regular expression: `^(?!scope$).*$`
Type: string

##

Type: string Default: ""

Additional scope string that will be passed to the OpenID server on the token call to obtain and access_token. infinite.* scopes will be added automatically.

Must match regular expression: `^(()|([\x21\x23-\x5B\x5d-\x7e]+)( [\x21\x23-\x5B\x5d-\x7e]+)*)$`

Must be at least `0` characters long

Must be at most `1024` characters long

##

Type: array of enum (of string)

List of algorithm that will be allowed for JWT (idtoken and accesstoken) delivered by the OpenID server

All items must be unique

No Additional Items

#### Each item of this array must be:

Type: enum (of string)

#### Must be one of:

- "RS256"
- "RS384"
- "RS512"

##

Type: string

OpenID application id

Must be at least `1` characters long

##

Type: string

OpenID application secret

Must be at least `1` characters long

##

Default: null

## One of

Type: null

audience (aud) value is assumed to contain client_id.

Type: const

disable aud field validation. Not recommanded but could be usefull when dealing with a weird oidc server.

Specific value: `false`
Type: string

value that should be contained in access tokens aud field.

Must be at least `1` characters long

Type: array of string

list of potential aud field values. At least one should be equal to access tokens aud field.

Must contain a minimum of `1` items

Must contain a maximum of `16` items

No Additional Items

#### Each item of this array must be:

Type: string

value that should be contained in access tokens aud field.

Must be at least `1` characters long

##

Default: null

## One of

Type: null

Authorized party (azp) value is assumed to contain client_id

Type: const

disable azp field validation. Not recommanded but could be usefull when dealing with a weird oidc server.

Specific value: `false`
Type: array of string

list of accepted azp values, at least one should be contained in access tokens azp field

Must contain a minimum of `1` items

Must contain a maximum of `32` items

All items must be unique

No Additional Items

#### Each item of this array must be:

Type: string

Must be at least `1` characters long

##

Default: null

## One of

Type: null

issuer (iss) value will be retrieved from configuration endpoint.

Type: const

disable iss field validation. Not recommanded but could be usefull when dealing with a weird oidc server.

Specific value: `false`
Type: string

value that should be contained in access tokens iss field.

Must be at least `1` characters long

Type: array of string

list of potential iss field values. At least one should be equal to access tokens iss field.

Must contain a minimum of `1` items

Must contain a maximum of `16` items

No Additional Items

#### Each item of this array must be:

Type: string

value that should be contained in access tokens iss field.

Must be at least `1` characters long

##

#### OpenID Connect user identification ∞Directory settings

Type: object

configure user identification and session access token using OpenID Connect code flow

No Additional Properties

##

Type: object

specifies additional query parameters that should be added to oidc endpoint calls

No Additional Properties

##

Type: object

additional query parameters for authorization_endpoint

##

Each additional property must conform to the following schema

Type: string

##

Type: object

additional query parameters for revocation_endpoint

##

Each additional property must conform to the following schema

Type: string

##

Type: object

additional query parameters for token_endpoint

No Additional Properties

##

## Pattern Property

All properties whose name matches the following regular expression must respect the following conditions

Property name regular expression: `^(?!scope$).*$`
Type: string

##

Type: object
No Additional Properties

##

Type: string

Additional scope string that will be passed to the OpenID server to obtain access_token that will be passed to the client

Must match regular expression: `^(()|([\x21\x23-\x5B\x5d-\x7e]+)( [\x21\x23-\x5B\x5d-\x7e]+)*)$`

Must be at least `0` characters long

Must be at most `1024` characters long

##

Type: string

Additional scope string that will be passed to the OpenID server on the authorize call to obtain first idtoken and accesstoken that will be passed to authentication_webhook

Must match regular expression: `^(()|([\x21\x23-\x5B\x5d-\x7e]+)( [\x21\x23-\x5B\x5d-\x7e]+)*)$`

Must be at least `0` characters long

Must be at most `1024` characters long

##

Type: array of enum (of string)

List of algorithm that will be allowed for JWT (idtoken and accesstoken) delivered by the OpenID server

All items must be unique

No Additional Items

#### Each item of this array must be:

Type: enum (of string)

#### Must be one of:

- "RS256"
- "RS384"
- "RS512"

##

## One of

Type: null

No authentication webhook

Type: object

Define authentication webhook that will be called on each user identification

No Additional Properties

##

#### Http client override configuration

Type: object

http configuration for calls to calls to the authentication webhook

No Additional Properties

##

Default: null

## One of

Type: null

Use global configuration

Type: object
No Additional Properties

##

Type: string

file path to client PEM certificate

Must be at least `1` characters long

##

Type: string

file path to client PEM private key

Must be at least `1` characters long

##

Type: string

private key password if any

Type: object
No Additional Properties

##

Type: string

file path to client P12 certificate

Must be at least `1` characters long

##

Type: string

private key password if any

Type: enum (of boolean)

Disable use of certificate

#### Must be one of:

- false

##

Default: null

## One of

Type: null

Use global configuration

Type: string

Enforce use of provided http proxy for http calls

Must match regular expression: `^https?:\/\/.*$`

Must be at most `1024` characters long

Type: enum (of boolean)

Disable use of any http proxy for http calls

#### Must be one of:

- false

Type: enum (of boolean)

Enforce use of the automatic http proxy configuration from the system for http calls

#### Must be one of:

- true

##

Default: null

## One of

Type: null

Use global configuration

Type: boolean

Set this value to false to disable ssl peer verification

##

Type: string
Must match regular expression: `^https:\/\/.*$`

Must be at most `1024` characters long

##

Type: string

OpenID application id

Must be at least `1` characters long

##

Type: string

OpenID application secret

Must be at least `1` characters long

##

## One of

Type: null

set to null if HS* sign algorithm are not allowed

Type: string

OpenID secret for HS* sign algorithm, only supported of id_token. If not null HS256, HS384 and HS512 alg will be accepted.

Must be at least `0` characters long

##

Type: object

Allows to copy and optionally remap id_token extra fields (except some sensitive ones) to standard fields to customize user information display. Object keys are extra field name to copy

No Additional Properties

##

## Pattern Property

All properties whose name matches the following regular expression must respect the following conditions

Property name regular expression: `^(?!client_id$|nonce$|aud$|azp$|exp$|iat$|nbf$|acr$|iss$).*$`

## One of

Type: enum (of string)

remap target field name.

#### Must be one of:

- "address"
- "email_verified"
- "email"
- "family_name"
- "given_name"
- "locale"
- "middle_name"
- "name"
- "nickname"
- "phone_number_verified"
- "phone_number"
- "picture"
- "preferred_username"
- "profile"
- "updated_at"
- "zoneinfo"

Type: null

only copy

##

Default: null

## One of

Type: null

audience (aud) value is assumed to contain client_id.

Type: const

disable aud field validation. Not recommanded but could be usefull when dealing with a weird oidc server.

Specific value: `false`
Type: string

value that should be contained in access tokens aud field.

Must be at least `1` characters long

Type: array of string

list of potential aud field values. At least one should be equal to access tokens aud field.

Must contain a minimum of `1` items

Must contain a maximum of `16` items

No Additional Items

#### Each item of this array must be:

Type: string

value that should be contained in access tokens aud field.

Must be at least `1` characters long

##

Default: null

## One of

Type: null

Authorized party (azp) value is assumed to contain client_id

Type: const

disable azp field validation. Not recommanded but could be usefull when dealing with a weird oidc server.

Specific value: `false`
Type: array of string

list of accepted azp values, at least one should be contained in access tokens azp field

Must contain a minimum of `1` items

Must contain a maximum of `32` items

All items must be unique

No Additional Items

#### Each item of this array must be:

Type: string

Must be at least `1` characters long

##

Default: null

## One of

Type: null

issuer (iss) value will be retrieved from configuration endpoint.

Type: const

disable iss field validation. Not recommanded but could be usefull when dealing with a weird oidc server.

Specific value: `false`
Type: string

value that should be contained in access tokens iss field.

Must be at least `1` characters long

Type: array of string

list of potential iss field values. At least one should be equal to access tokens iss field.

Must contain a minimum of `1` items

Must contain a maximum of `16` items

No Additional Items

#### Each item of this array must be:

Type: string

value that should be contained in access tokens iss field.

Must be at least `1` characters long

##

Type: boolean

Enable use of Proof Key for Code Exchange (rfc7636) (https://tools.ietf.org/html/rfc7636)

##

Type: boolean

Enable use of accesstoken (OpendID server should also return a refreshtoken) delivered by OpenID server to protect ∞Directory and ∞Proxy api calls from client applications (http.session_bearer security scheme). If disabled, tokens delivered by the Directory will be used.

##

Type: enum (of string)

Define which field of id token will be used as user unique id.
oidc : sub of OpenId id
email : user email /!\ email should not be reused later for an other user
azureoid : Azure AD user object id

#### Must be one of:

- "oidc"
- "email"
- "azureoid"

##

#### PostgreSQL configuration

Type: object
No Additional Properties

##

Type: integer Default: 15

maximum wait duration per host while trying to establish a connection. Value is in secondes.

Value must be greater or equal to `2`

##

Type: string

target database name

Must be at least `1` characters long

##

Type: array of object

list of host, allowing to specify primary and replicat servers. Connection attempt will respect list order, to distribute read-only load on hot standby servers, put them first in the list.

Must contain a minimum of `1` items

Must contain a maximum of `8` items

No Additional Items

#### Each item of this array must be:

Type: object
No Additional Properties

##

Type: string

hostname or ip

Must be at least `1` characters long

##

Type: integer

tcp port

Value must be greater or equal to `1` and lesser or equal to `65535`

##

Type: string

PostgreSQL database connection login, could be empty if using SSPI or GSS authentication.

Must be at least `0` characters long

##

Type: string

PostgreSQL database connection password, could be empty if using SSPI or GSS authentication.

Must be at least `0` characters long

##

Type: object
No Additional Properties

##

Default: false

## One of

Type: object
No Additional Properties

##

Type: string

file path to client PEM certificate

Must be at least `1` characters long

##

Type: string

file path to client PEM private key

Must be at least `1` characters long

##

Type: string

private key password if any

Type: object
No Additional Properties

##

Type: string

file path to client P12 certificate

Must be at least `1` characters long

##

Type: string

private key password if any

Type: enum (of boolean)

Disable use of certificate

#### Must be one of:

- false

##

Type: boolean

should we use ssl connection

##

Type: string Default: ""

file path to rootCA.crt that will be used to verify server certificat, if empty default libpq cert location will be used

##

Type: boolean Default: true

if disabled, server certificat will not be validated