## Documentation

- About
- Read First
  - What is IdentityServer
  - Installation Scenarios
- Migrations
- Bootstrapping
- Configuration & Integration
  - AdminUI Settings
  - Configuring AdminUI
  - Configuring AdminUI (NuGet)
  - Integrating with Identity Server
  - Integrating with Identity Server Custom Schema
  - Integrating with Quickstarts
  - Enabling Logging
- Installation
  - IIS
  - Azure
    - Install in Azure
    - Create Azure Web App
  - Docker
  - NuGet
- Custom Database Connections
- Custom Identity Store
  - Overview
  - Partial Implementation
  - Full Implementation
  - Tenancy With Entity Framework
  - NoSql Implementation (MongoDB)
- Custom CSP
- Users
  - Searching for Users
  - Adding Users
  - Editing Users
  - Deleting Users
  - Merge Users
  - Set User Password
  - Session Management
  - User Reports
  - Bulk User Import
- Roles
  - Creating Roles
  - Managing Roles
  - Managing Users in a Role
  - Managing Role Claims
- Claim Types
- Clients
  - Searching for Clients
  - Adding Clients
  - Adding a SAML Client
  - Adding a WS-Fed Client
  - Editing Clients
  - Deleting Clients
  - Clone Client
- Import and Export
  - Exporting Clients
  - Importing Clients
  - Importing Client Configuration with Secrets
  - Importing SAML Clients with Certificates
  - Import and Export Via the API
- Dynamic Authentication Providers
  - What is Dynamic Authentication
  - Enabling or disabling Dynamic Authentication
  - Add a Dynamic Provider
    - First Steps
    - Adding OIDC Provider
    - Adding SAML Provider
  - Edit a Dynamic Provider
    - Accessing edit view
    - Editing a OIDC Provider
    - Editing a SAML Provider
  - Deleting a Provider
  - Searching for Provider
- Resources
  - Searching for Resources
  - Creating Resources
  - Editing resources
- Webhooks
  - Webhooks
  - Endpoint Configuration
- MCP
  - Overview
  - Default Server Prompt Instructions
- User Settings Endpoints
- Access Policy
- Keys
- Auditing
- FAQs
- Troubleshooting
  - Unable to start AdminUI
  - Unable to contact IdentityServer
  - Unable to contact API
  - Unable to log in

### AdminUI Settings

- -AdminUI Settings Structure
- -Logging Settings
- -Database Settings
- -AdminUI Configuration
- -Data Protection
- -MCP Server
- -TargetIdentityServer4 Flag Deprecated from v7.0

AdminUI is configured using a set of variables that can be provided in various ways, these methods are described here, and if using the NuGet package there is an additional method of configuring AdminUI here.

## AdminUI Settings Structure

Note: In AdminUI 4.2.0 and 5.1.0 onwards, the env.js file is no longer used for configuration and changes do not need to be made to this file. It can be removed if you choose.

### Logging Settings

- `AzureAppServiceLogging` (Optional) Used for debugging the API - see the enable logging page for more details.
- `LoggingMinimumLevel` Defaults to `info`. Supported logging levels are
  1. `debug`
  2. `info`
  3. `warning`
  4. `error`
  5. `critical`
- `LoggingOutputTemplate` Defaults to `[{Timestamp:dd-MM-yyyy HH:mm:ss} {Level}] {Message}{NewLine}{Exception}`. For more infomation see the serilog docs.

### Database Settings

- `DbProvider` Supported types and their values are:
  1. `SqlServer`
  2. `MySql` (Note: AdminUI requires the MySQL setting `lower_case_table_names` to be `false`)
  3. `PostgreSql`
- `IdentityConnectionString` The connection string for the Identity database (Users, Claim Types, Roles etc.)
- `IdentityServerConnectionString` The connection string for the IdentityServer database (Clients, Resources, Persited Grants etc.)
- `OperationalConnectionString` (Optional) The connection string for the Persisted Grants DbContext. If not supplied, AdminUI will use the `IdentityServerConnectionString`
- `DataProtectionConnectionString` (Optional) The connection string for the DataProtectionKey DbContext. If not supplied, AdminUI will use the `IdentityServerConnectionString`. Only needs configuring if you are using a database to store protection keys.
- `AuditRecordsConnectionString` The database connection string for AdminUI audits, if missing will default to the `IdentityServerConnectionString`
- `StoredProcedureSchemaPrefix` (Optional, only for SqlServer provider) Changes schema name for the stored procedures in `SqlServer` database providers.
- `OperationalStoreSchemaName` (Optional) Changes schema name for the Operational Store. If you are planning to use this, read about custom database schema names.
- `ConfigurationStoreSchemaName` (Optional) Changes schema name for the Configuration Store. If you are planning to use this, read about custom database schema names.
- `TimoutLengthInSeconds` (Optional) Specifies the migration command timeout duration in seconds when running AdminUI migrations. It defaults to null, meaning the default setting for ConnectionTimeout is used.

### AdminUI Configuration

- `AuthorityUrl` The IdentityServer installation protecting AdminUI
- `UiUrl` The AdminUI website
- `AdminUIClientId` The AdminUI client ID, defaults to `admin_ui`
- `AdminUICustomScopeName` The AdminUI custom scope name, default value is `admin_api`
- `AdminUIProfileCustomScopeName` The AdminUI profile custom scope name, default value is `admin_ui_profile`
- `AdminUIClientSecret` The AdminUI client shared secret value in plain text
- `WebhookClientId` The Webhook client ID, defaults to `admin_ui_webhooks`
- `WebhookClientSecret` The Webhook client secret, defaults to a new GUID
- `AdminUIJwtTypes` Configures supported JWT types in AdminUI, possible values:
  1. `All` (Default) Suppports both Bearer and DPoP tokens
  2. `Bearer` Supports only Bearer tokens
  3. `DPoP` Supports only DPoP tokens
- `AuditRecordsCulture` Language used for generation of audit records, possible values:
  1. `en-GB` (Default) English
  2. `de` German
  3. `zh-TW` Chinese (Traditional)
  4. `zh-CN` Chinese (Simplified)
  5. `es` Spanish
  6. `fr` French
- `AuditReadActions` Defaults to `true`. If `false`, no audit records will be generated for read actions (e.g when a user views resources though AdminUI)
- `RequireHttpsMetadata` When `true` ensures IdentityServer discovery endpoint uses TLS. Should be true for production
- `PasswordResetEndpoint` ...
- `RegistrationConfirmationEndpoint` ...
- `ResetMFAEndpoint` ...
- `LicenseKey` A valid license key for AdminUI
- `DisableBootstrap` If `true`, bootstrapping will not run on app startup. More information about bootstrapping can be found here. Defaults to `false`.
- `ServeUi` If `true`, SPA will be served by AdminUI using packaged static files. Defaults to `true`.
- `DisableUiHttpsCheck` If `true`, warning logs when https is not in use are disabled. Defaults to `false`.
- `PasswordPolicy`
  - `RequireDigit` Defaults to `true`
  - `RequireLowercase` Defaults to `true`
  - `RequireNonAlphanumeric` Defaults to `true`
  - `RequireUppercase` Defaults to `true`
  - `RequiredLength` Defaults to `6`
  - `RequiredUniqueChars` Defaults to `1`
- `UsernamePolicy`
  - `AllowedUserNameCharacters` - Defaults to `abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-._@+`
  - `RequireUniqueEmail` - Defaults to `true`. Decides if user emails should be unique or not.
  - `RequireEmail` - Defaults to `true`. Decides if emails are required for users.
- `ReferenceTokenOptions`
  - `UseReferenceTokens` ...
  - `Secret` ...
- `FeatureFlags`
  - `DefaultUserValidation` - Defaults to `true`. If set to false AdminUI will not prompt you to remove the default user if present.
  - `AddUserPassword` Defaults to `false`. If `true`, allows for setting a users password on creation (this is for demo purposes only, do not use in production), see more here
  - `EnableEnforcerAuthorization` - Defaults to `false`. If set to true will use the Enforcer authorization engine for more fine grained access control. More info can be found in our 6.3 release article
  - `EnableSharedScopes` - Defaults to `false`. If set to `true` AdminUI will allow scopes to be shared between protected resources.
  - `EnableSessionManagement` - Defaults to `true`. Allows the management of the IdentityServer Duende session management feature. If set to `false` AdminUI will not show the SessionManagment tables when viewing or editing users.
  - `EnableDynamicAuthentication` - Defaults to `Disabled`. Allows the management of Dynamic Authentication through AdminUI. Options are
    1. `Disabled` Dynamic Authentication is disabled.
    2. `Duende` Duende IdentityServer Dynamic Authentication is enabled.
    3. `Rsk` RSK Dynamic Authentication is enabled.
  - `EnableRoleClaims` - Defaults to `false`. Allows management of role claim in AdminUI.

### Data Protection

- `DataProtection` Used for configuration of Cookie protection and persistence.
  - `ApplicationName` - Configures the aplication name for data protection, by default this is set to 'Rsk.AdminUI'. Setting to null will mean the name will not be set, this is the original behaviour pre v11 of AdminUI.
  - `Persistence` - The type of persistence can be FileSystem or Database, these require different setup as shown below
    - `Type` - FileSystem
    - `Location` - Location to persist keys
      OR
    - `Type` - Database
    - `DbProvider` Supported types and their values are:
      1. `SqlServer`
      2. `MySql` (Note: AdminUI requires the MySQL setting `lower_case_table_names` to be `false`)
      3. `PostgreSql`
  - `Protection` The certficate or keyvault that will protect the cookies. The two available types are KeyVault and Certifcate. A Certificate can be provided by location or by thumbprint.
    - `Type` - KeyVault
    - `KeyIdentifier` - The Azure KeyVault certificate identifier used for key encryption.
    - `ClientId` (not in new Settings Model, see) - The Application Client Id
    - `Vault` (not in new Settings Model, see) - The KeyVault public Uri
    - `Secret` (not in new Settings Model, see) - (Optional) The client secret to use for authentication. Optional valid only for Azure hosted scenarios
      OR
    - `Type` - Certificate (To protect with certificate you can provide either a thumbprint or a location)
    - `CertificateType` - Thumbprint
    - `Thumbprint` - The thumbprint of the certificate that is installed either for the user or the machine.
      OR
    - `Type` - Certificate (To protect with certificate you can provide either a thumbprint or a location)
    - `CertificateType` - File
    - `Location` - The location on disk of the certificate. We recommend using a PFX file as private key access is necessary.
    - `Password` (Optional) - The password for the certificate

### MCP Server

- `McpOptions` Used for configuration of the McpServer.
  - `Title` A human-readable display name to show users. Defaults to `AdminUI MCP Server API`
  - `RoutePath` The path from where the MCP Server runs. Defaults to `/mcp`
  - `ScopeName`: The base name of the MCP Scopes. Defaults to `admin_mcp`
  - `Instructions` Provides a description of the AdminUI MCP Server explaining how the LLM should use its tools. You can view the default instructions here

## TargetIdentityServer4 Flag `Deprecated from v7.0`

The TargetIdentityServer4 flag in the API Configuration is used to determine what version of IdentityServer you want your AdminUI to target. If you're working with an IdentityServer4 database, you'll want to set this flag to `true`. If you're working with a Duende IdentityServer database, you'll want to set this flag to `false`.

This configuration setting will change how AdminUI displays certain entities such as Protected Resources, as well as if it will display certain views.

This setting will also change what migrations will be run by the migration tool.

Previous Next