IdP Settings

OAuth2 / OIDC Settings
Base URL used in JWT "iss" claim
Use each request's own Host header instead of the Issuer URL above (discovery, tokens, device flow all agree per-hostname; dev convenience for setups reachable under more than one hostname).
Origins allowed to be reflected back by "Derive Issuer from Request". Empty = allow any Host header (dev convenience). A non-matching Host falls back to the Issuer URL above.
Overrides the device flow's verification_uri when "Derive Issuer from Request" is on, so a backend/container caller's Host doesn't leak into a URL the human's browser can't reach. Leave blank to keep following the request Host.
Trust X-Forwarded-Proto/Host/For from a single reverse-proxy hop in front of NanoIDP (applies ProxyFix). Only changes the derived issuer above when "Derive Issuer from Request" is also on; always affects rate-limit and audit-log client IP attribution. Only enable this behind exactly one trusted proxy - these headers are otherwise spoofable. Takes effect on the next app restart.
Default audience for JWT "aud" claim
How long tokens are valid (default: 60 minutes)
Reject /authorize requests without a PKCE code_challenge (on by default in stricter-dev and implied by oauth21).
Each refresh invalidates the used refresh token; reuse revokes its rotation family (forced on by oauth21).
Login Page Branding
Directory where per-client logo files are looked up by filename (<client_id>.svg/.png/.jpg/.webp). Leave blank to use the default (the app's own static/logos).
SAML Settings
SAML IdP Entity ID. Leave blank to derive it from the issuer (currently https://nanoidp.uat.smegui.k8sdev.world-direct.at/saml).
SAML Single Sign-On endpoint. Leave blank to derive it from the issuer (currently https://nanoidp.uat.smegui.k8sdev.world-direct.at/saml/sso).
Default Assertion Consumer Service URL
Enable XML signature on SAML responses. Disable for testing unsigned flows.
Enforce SAML 2.0 binding compliance. When enabled, rejects GET requests with uncompressed data.
Verify AuthnRequest signatures (both bindings) against the registered SP certificates; advertised as WantAuthnRequestsSigned in metadata.
PEM certificate files of SPs whose AuthnRequest signatures are accepted.
XML canonicalization algorithm for SAML signatures
Include the user's roles in SAML assertions and AttributeQuery responses. Off by default.
Name used when the export above is on. Common values: roles, Role, http://schemas.microsoft.com/ws/2008/06/identity/claims/role.
Include the user's groups in SAML assertions and AttributeQuery responses. Off by default.
Name used when the export above is on. Common values: groups, memberOf.
Login Mode
"Password" requires the configured password on /login, /authorize, /saml/sso and the device flow. "Persona" lists the configured users and logs in by selecting one instead - a local development/testing convenience, off by default, not intended for deployed environments. Unrelated to the OAuth password grant, which always still requires a password.
With Login Mode above set to "Persona", an OIDC /authorize request whose login_hint is persona-auto-login:USERNAME logs that user in directly - no picker, no HTML - for driving a real OIDC client library in automated integration tests. Opt-in, off by default; has no effect while Login Mode is "Password".
Allowed Identity Classes
One identity class per line (e.g., INTERNAL, EXTERNAL, PARTNER, SERVICE)
Preview Changes 
Click "Refresh" to preview changes
Security Settings (YAML-only)

These are fixed operator decisions set directly in settings.yaml's session: section - not editable from this page or the MCP update_settings tool. See the Security guide (docs/SECURITY.md) for details.

Config UI Login Gate (require_ui_login) Disabled
Invalid Bcrypt Hash Rejected (enforce_password_check) Disabled (plaintext fallback active)
Management Secret (management_secret) Not configured
IdP Endpoints
OIDC Discovery /.well-known/openid-configuration
JWKS Endpoint /.well-known/jwks.json
Token Endpoint /token
SAML Metadata /saml/metadata
SAML SSO /saml/sso