configuration-ticket-providers

Ticket Identity Providers

Scope and trust boundary

Use identity provider sqlite <name> for login tickets issued by an authenticated, authorized application. The application owns its user authentication and chooses the verified subject and roles. Caddy owns portal routing, policy and access-token signing. This adapter installs no issuer service, anonymous issuance endpoint or issuance command. Read trusted application integration when implementing the application's public Go API consumer.

The global identity dispatcher loads security.identity_providers.sqlite. Its flat block delegates to the selected AuthCrunch ticket parser. Native JSON uses apps.security.identity_providers with driver: sqlite; the runtime provider reports kind sqlite-ticket and protocol driver ticket. These names are distinct. Ordinary OAuth and SAML declarations retain their own parsers.

Configuration and deployment

{
 log {
  output stdout
  format filter {
   wrap json
   fields {
    request>uri delete
    resp_headers>Location delete
   }
  }
 }
 security {
  identity provider sqlite trusted-app {
   realm application
   path /var/lib/caddy-security/tickets/login.db
   public_origin https://login.example.test
   issuer_url https://issuer.example.test/signin
   base_path /auth
   cookie_name APP_LOGIN_BINDING
   timeout 1s
  }
  authentication portal myportal {
   crypto key sign-verify {env.JWT_SHARED_KEY}
   enable identity provider trusted-app
  }
  authorization policy app-policy {
   crypto key verify {env.JWT_SHARED_KEY}
   set auth url https://login.example.test/auth
   allow roles authp/user
  }
 }
}

login.example.test {
 log {
  output stdout
  format filter {
   wrap json
   fields {
    request>uri delete
    resp_headers>Location delete
   }
  }
 }
 @portal path /auth /auth/*
 handle @portal {
  authenticate with myportal at /auth
 }
 handle /app* {
  authorize with app-policy
  respond "Authenticated application"
 }
}