Configure authentication

Authentication settings in deployment.yaml control how clients are verified before they can call ADS endpoints. By default, authentication is enabled. Configure the method using the spring.security section.

note

The authentication settings in this page secure access to ADS endpoints (inbound calls). For authentication used when ADS retrieves a domain from a remote source (outbound calls), see Configure authorization domains.

Basic authentication

Basic authentication restricts access to a single configured username and password.

caution

Basic authentication is not the preferred authentication method. If you use computationally intensive hashing algorithms, the performance of ADS will be affected.

Set name and password under spring.security.user:

spring:
  security:
    user:
      name: <username>
      password: <password>

Password encoding

ADS supports plain-text and hashed passwords. Prefix hashed values with the algorithm ID enclosed in curly braces.

• Plain text
• Bcrypt
• PBKDF2
• SHA-256

password: secret

or equivalently:

password: "{noop}secret"

password: "{bcrypt}$2a$10$dXJ3SW6G7P50lGmMkkmwe.20cQQubK3.HZWzG3YB1tlRy.fqvM/BG"

password: "{pbkdf2}5d923b44a6d129f3ddf3e3c8d294127278ab6152cd9804b3952a514d79e64e9a3dcbde72445e8ef6bf3b508fbf17fa4ed4d6b99ca763d8dc98124ef54761cb78"

password: "{sha256}97cde38028ad898ebc02e690819fa220e88c62e0699403e94fff291cfffaf8410849f27605abcbc0"

caution

Starting with ADS 26.2.0, {pbkdf2} password hashes use a 16-byte salt (96-character hex string), whereas earlier versions generated an 8-byte salt (80-character string). If you are upgrading from an earlier ADS version, existing {pbkdf2} hashes will fail authentication and must be regenerated. Other hash formats are unaffected. See section PBKDF2 password hash compatibility on Migration guide.

For the full list of supported algorithms, see the Spring Security password storage documentationOpens in a new tab.

Token-based authentication (JWT)

JSON Web Token (JWT) authentication is the recommended method for production deployments. ADS validates incoming tokens against a JSON Web Key Set (JWKS).

Configure JWT validation under spring.security.oauth2.resourceserver.jwt:

spring:
  security:
    oauth2:
      resourceserver:
        jwt:
          audiences: ads                                            # Optional
          jwk-set-uri: "https://localhost:1234/api/.well-known/jwks"  # Required
          jws-algorithms: RS256                                    # Optional, default: RS256

JWT verification properties

Property	Description	Required
audiences	The expected value of the JWT aud claim. ADS rejects tokens that do not include this audience.	Optional
jwk-set-uri	URL or local file: path to the JSON Web Key Set used to verify token signatures. Only file: and https: URIs are accepted.	Required
jws-algorithms	JSON Web Algorithm used for signature verification. Default: RS256.	Optional

info

ADS caches retrieved JWKs for 5 minutes and refreshes the key set 30 seconds before the cache expires. This background refresh prevents delays under heavy load.

For the full list of Spring OAuth2 resource server properties, see the Spring Boot documentationOpens in a new tab.

OAuth2 client credentials (outbound domain retrieval)

When ADS retrieves its authorization domain from a protected remote endpoint, configure an OAuth2 client registration under spring.security.oauth2.client. See Configure authorization domains: OAuth2 client credentials for full configuration details.

note

Token refresh is handled automatically. Before each domain retrieval request, ADS checks whether the current access token has expired and fetches a new one from the authorization server if needed. No additional configuration is required.

Disable authentication

To disable authentication entirely, set authentication.enabled to false:

authentication:
  enabled: false

Any spring.security entries are ignored when authentication is disabled.

danger

Disabling authentication exposes all ADS endpoints without any access control. Only use this in isolated development or test environments.

TLS client authentication (mTLS)

For mutual TLS (mTLS), where both the client and server present certificates, see Configure TLS: Mutual TLS.