configuration-identity-stores

Configuration Identity Stores

Purpose

Use this skill to configure local identity store <name> and ldap identity store <name> blocks. The dispatcher is caddyfile_identity.go; the store parser is caddyfile_identity_store.go.

Use configuration-users to configure static user <username> entries, password imports, API keys, and stored challenge rules. For password verification, credential versions, management/profile mutations, reload invalidation, and Caddy qualification, read local identity compatibility. Check github.com/greenpau/go-authcrunch/pkg/ids when changing this skill: ids.IdentityStoreConfig.Validate admits only local and ldap stores and validates the authcrunch parameter names produced by the Caddyfile parser.

For SQLite password accounts and trusted offline administration, read SQLite identities. The bundled module uses root runtime injection and preserves its own kind, epoch and password-only capabilities. The separate SQLite API-key authenticator does not create portal password accounts.

Local Stores

Local stores require realm and path in the authcrunch config. The full Caddyfile form is:

{
	security {
		local identity store localdb {
			realm local
			path assets/config/users.json
		}
	}
}

The local shortcut is valid and sets realm local plus the user file path. Only local stores support this shortcut:

local identity store localdb assets/config/users.json

Add users inline only when the Caddyfile should own the local account data:

user alice {
	name "Alice Example"
	email [email protected]
	password {env.ALICE_PASSWORD} overwrite
	roles authp/user authp/admin
}

Local store-level options supported by authcrunch are login_icon, username_recovery_enabled, password_recovery_enabled, contact_support_enabled, support_link, and support_email. In Caddyfile, set those with icon, enable username recovery, enable password recovery, enable contact support, support link, and support email.