## Cron schedule of the job that cleans expired Duo contexts from the database. Does nothing if Duo MFA is disabled or set to use the legacy iframe prompt.

## Defaults to every minute. Set blank to disable this job.

# DUO_CONTEXT_PURGE_SCHEDULE="30 * * * * *"

#

## Cron schedule of the job that cleans sso nonce from incomplete flow

## Defaults to daily (20 minutes after midnight). Set blank to disable this job.

# PURGE_INCOMPLETE_SSO_NONCE="0 20 0 * * *"

########################

### General settings ###

## Setting this to true will enforce the Single Org Policy to be enabled before you can enable the Reset Password policy.

# ENFORCE_SINGLE_ORG_WITH_RESET_PW_POLICY=false

#####################################

### SSO settings (OpenID Connect) ###

#####################################

## Controls whether users can login using an OpenID Connect identity provider

# SSO_ENABLED=false

## Prevent users from logging in directly without going through SSO

# SSO_ONLY=false

## On SSO Signup if a user with a matching email already exists make the association

# SSO_SIGNUPS_MATCH_EMAIL=true

## Allow unknown email verification status. Allowing this with `SSO_SIGNUPS_MATCH_EMAIL=true` open potential account takeover.

# SSO_ALLOW_UNKNOWN_EMAIL_VERIFICATION=false

## Base URL of the OIDC server (auto-discovery is used)

## - Should not include the `/.well-known/openid-configuration` part and no trailing `/`

## - ${SSO_AUTHORITY}/.well-known/openid-configuration should return a json document: https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderConfigurationResponse

# SSO_AUTHORITY=https://auth.example.com

## Authorization request scopes. Optional SSO scopes, override if email and profile are not enough (`openid` is implicit).

#SSO_SCOPES="email profile"

## Additional authorization url parameters (ex: to obtain a `refresh_token` with Google Auth).

# SSO_AUTHORIZE_EXTRA_PARAMS="access_type=offline&prompt=consent"

## Activate PKCE for the Auth Code flow.

# SSO_PKCE=true

## Regex for additional trusted Id token audience (by default only the client_id is trusted).

# SSO_AUDIENCE_TRUSTED='^$'

## Set your Client ID and Client Key

# SSO_CLIENT_ID=11111

# SSO_CLIENT_SECRET=AAAAAAAAAAAAAAAAAAAAAAAA

## Optional Master password policy (minComplexity=[0-4]), `enforceOnLogin` is not supported at the moment.

# SSO_MASTER_PASSWORD_POLICY='{"enforceOnLogin":false,"minComplexity":3,"minLength":12,"requireLower":false,"requireNumbers":false,"requireSpecial":false,"requireUpper":false}'

## Use sso only for authentication not the session lifecycle

# SSO_AUTH_ONLY_NOT_SESSION=false

## Client cache for discovery endpoint. Duration in seconds (0 to disable).

# SSO_CLIENT_CACHE_EXPIRATION=0

## Log all the tokens, LOG_LEVEL=debug is required

# SSO_DEBUG_TOKENS=false

########################

### MFA/2FA settings ###

########################