Root Configuration

To run ProAuth, access to a supported database server is required. ProAuth supports SQL Server and PostgreSQL. The provider is selected globally with Data:DefaultConnection:Provider (Data__DefaultConnection__Provider as an environment variable) and supports SqlServer or PostgreSql. It applies to the ProAuth database and all UserStore databases.

If ProAuth is deployed to the cluster by the Helm package, an initializer job is executed before the ProAuth deployment starts. The initializer uses EF Core migrations for the configured provider. It creates or updates the ProAuth database schema and then scans for existing UserStore instances by looking for UserStore connection strings in the options. If UserStore instances are found, their schemas are also migrated.

ProAuth stores its own objects in the proauth schema. UserStore objects are stored in the userstore schema. The default deployment still uses separate databases for ProAuth and UserStores, but both schemas can also exist in the same physical database when the configured connection strings point to the same database.

After the schema deployment job has completed successfully, the ProAuth deployment starts. During the deployment of ProAuth by the Helm package, a connection string is required which has access to the ProAuth database.

If ProAuth starts for the first time on an empty database, the Root DataInitializer is executed in ProAuth. The Root DataInitializer sets up a minimal ProAuth configuration, which finally contains a Root ClientApp, with which ProAuth can be set up automated customer specific.

Root DataInitializer

The goal of the ProAuth Root DataInitializer is to setup an initial Root ClientApp with SysAdmin privileges. With this ClientApp, it's possible to configure ProAuth automated through the API.

The ProAuth Root DataInitializer sets up following configuration:

• Default Certificate (provided by settings)
• Root Customer
  • Root ClientApp
  • Invitation ClientApp
  • Root Subscription
    • Root Tenant
    • Forward ClaimRule
  • ServerCookie IDP