Authentication configuration reference - Red Hat Ansible Automation Platform

JWT configuration

Table 1. JWT configuration variables
Variable	Default	Description
`APP_JWT_PRIVATE_KEY_PATH`	-	Path to ES256 private key PEM file
`APP_JWT_PRIVATE_KEY_BASE64`	-	Base64-encoded ES256 private key PEM string (alternative)
`APP_JWT_KEY_ID`	-	Key ID for JWT header (`kid` claim)
`APP_JWT_ACCESS_TOKEN_LIFETIME_MINUTES`	`15`	Access token lifetime (min: 1, max: 60)
`APP_JWT_REFRESH_TOKEN_LIFETIME_HOURS`	`8`	Refresh token lifetime (min: 1, max: 720)
`APP_JWT_BACKUP_KEYS`	`[]`	Backup key configs for key rotation (JSON array)

Session and cookies

Table 2. Session and cookie variables
Variable	Default	Description
`APP_SERVER_SCHEME`	-	`https` or`http`. Sets the`Secure` flag on the refresh token cookie when`https`.
`APP_COOKIE_DOMAIN`	None	Domain attribute for the refresh token cookie. None sets a host-only cookie.

Sessions are persisted in the PostgreSQL database. No separate session store (such as Redis) is required.

Administration

Table 3. Administration variables
Variable	Default	Description
`APP_ADMIN_PASSWORD_PATH`	-	Required. Path to file containing the bootstrap admin password.

OIDC

Table 4. OIDC variables
Variable	Default	Description
`APP_OIDC_ALLOW_PRIVATE_NETWORKS`	`false`	Allow identity provider URLs that resolve to private IP addresses. Set to`true` for internal identity providers.
`APP_OIDC_POST_LOGOUT_REDIRECT_URI`	Server base URL	Global post-logout redirect URI for RP-initiated logout. Must be an allowed CORS origin. If not set, defaults to the server's base URL derived from`APP_SERVER_SCHEME`,`APP_SERVER_HOST`, and`APP_SERVER_PORT`.

Security

Table 5. Security variables
Variable	Default	Description
`APP_CORS_ALLOW_ORIGINS`	-	Explicit list of allowed origins (JSON array). Wildcard`*` is rejected when credentials are enabled.

Runtime settings

The following authentication settings are configurable at runtime through Settings > Authentication in the UI or through the settings API. Changes take effect immediately without restarting automation orchestrator.

Table 6. Runtime authentication settings
Setting key	Default	Description
`authentication.local_login_enabled`	`true`	Controls whether non-builtin local users can log in with a password. When disabled, only built-in accounts (such as admin) can authenticate with a password. Identity provider users are not affected.