Keyboard shortcuts

Press ← or → to navigate between chapters

Press S or / to search in the book

Press ? to show this help

Press Esc to hide this help

Light OAuth

light-oauth issues and validates OAuth/OIDC tokens and exposes the JWKS used by other services. The Compose deployments normally publish HTTPS on host port 6881.

Configuration

InputPurpose
LIGHT_RS_CONFIG_DIRMounted bootstrap/template directory.
RUST_LOGRust logging filter.
OAUTH_LOG_ANSIEnables or disables ANSI log output.
Portal database roleReads OAuth client, key and user projections from the Portal database.
Config files and TLS materialListener, handler, certificate and client settings.

OAuth normally starts after PostgreSQL and, where applicable, operational secret initialization. Config Server and most authenticated services depend on OAuth readiness because they require JWKS or tokens.

Operational notes

  • The configured JWKS URL must resolve from inside each consuming container; localhost refers to that consumer, not the OAuth container.
  • Issuer, audience, host name and certificate SAN must describe the same environment.
  • OAuth key and client projections must exist before health at the transport layer is treated as authentication readiness.
  • Never copy a Portal token between service identities merely to make startup pass. Each service token must have its intended subject, service ID and scope.