Identity Reference

The current identity tree is:

identity:
  session:
    remember_me_ttl: duration
  frontend:
    enabled: bool
    encryption_secret: string
    assets:
      html_static_content_path: string
      language_resources: string
    localization:
      languages: [string]
      default_language: string
    links:
      terms_of_service_url: string
      privacy_policy_url: string
      password_forgotten_url: string
    security_headers:
      enabled: bool
  mfa:
    totp:
      issuer: string
      skew: int
    webauthn:
      rp_display_name: string
      rp_id: string
      rp_origins: [string]
      authenticator_attachment: string
      resident_key: string
      user_verification: string
  mfa_policy:
    levels:
      recovery_codes: int
      totp: int
      webauthn: int
  oidc: { ... }
  saml: { ... }

Important Migrations

Old path	Current path
idp.remember_me_ttl	identity.session.remember_me_ttl
server.frontend.enabled	identity.frontend.enabled
server.frontend.html_static_content_path	identity.frontend.assets.html_static_content_path
server.frontend.language_resources	identity.frontend.assets.language_resources
server.frontend.languages	identity.frontend.localization.languages
server.frontend.default_language	identity.frontend.localization.default_language
server.frontend.totp_issuer	identity.mfa.totp.issuer
server.frontend.totp_skew	identity.mfa.totp.skew
idp.webauthn	identity.mfa.webauthn
idp.oidc	identity.oidc
idp.saml2	identity.saml

WebAuthn

identity.mfa.webauthn controls the Relying Party configuration used during registration and login ceremonies.

MFA Assurance

identity.mfa_policy.levels defines the global method-to-assurance mapping. The built-in levels are recovery_codes: 1, totp: 2, and webauthn: 3.

OIDC clients and SAML service providers support these related fields:

Field	Meaning
require_mfa	Methods that must be registered before issuing a successful response.
supported_mfa	Methods eligible for challenges and registration. An empty list permits all available methods.
required_mfa_level	Minimum level of the fresh MFA proof for browser SSO.
mfa_policy.levels	Per-client or per-service-provider overrides merged over the global mapping.

See MFA Assurance Policy for evaluation order, validation, and examples.

Frontend Assets

Use identity.frontend.assets for template and language-resource paths.

OIDC and SAML

See:

• MFA Assurance Policy
• OIDC
• SAML