checkId: check.core.auth.config plugin: stellaops.doctor.core severity: warn tags: [security, authentication, configuration]

Authentication Configuration

Doctor check check.core.auth.config — for operators validating that a Stella Ops deployment’s authentication and authorization settings are sound before exposing the control plane.

What It Checks

Verifies that authentication and authorization configuration is valid. The check inspects three configuration sections (Authentication, Authority, Identity) and validates:

• JWT settings (under Authentication:Jwt): ensures Issuer and Audience are set, the SecretKey is at least 32 characters long, and the key does not contain common weak values such as “secret” or “changeme”.
• OpenID Connect settings (under Authentication:OpenIdConnect): ensures the Authority URL is configured.
• Authority provider settings (under Authority): reports which providers are enabled via EnabledProviders.

The check only runs when at least one of the three auth configuration sections exists. If none exist, it reports an informational result noting that authentication may not be configured.

Why It Matters

Misconfigured authentication allows unauthorized access to the Stella Ops control plane. A missing JWT issuer or audience disables token validation. A short or default signing key can be brute-forced or guessed, enabling token forgery. Without a properly configured OIDC authority, federated login flows will fail entirely.

Common Causes

• JWT Issuer not configured
• JWT Audience not configured
• JWT SecretKey is shorter than 32 characters
• JWT SecretKey contains common weak values like “secret” or “changeme”
• OpenIdConnect Authority URL is missing
• Using development defaults in production

How to Fix

Docker Compose

Set the appropriate environment variables in your service definition inside docker-compose.yml or the .env file:

environment:
  Authentication__Jwt__Issuer: "https://stella-ops.local"
  Authentication__Jwt__Audience: "stellaops-api"
  Authentication__Jwt__SecretKey: "<generate-a-strong-key-at-least-32-chars>"
  Authentication__OpenIdConnect__Authority: "https://authority.stella-ops.local"

Generate a strong key:

openssl rand -base64 48

Bare Metal / systemd

Edit appsettings.json or appsettings.Production.json:

{
  "Authentication": {
    "Jwt": {
      "Issuer": "https://stella-ops.yourdomain.com",
      "Audience": "stellaops-api",
      "SecretKey": "<strong-key-at-least-32-characters>"
    },
    "OpenIdConnect": {
      "Authority": "https://authority.yourdomain.com"
    }
  }
}

Restart the service:

sudo systemctl restart stellaops-platform

Kubernetes / Helm

Set values in your Helm values.yaml:

authentication:
  jwt:
    issuer: "https://stella-ops.yourdomain.com"
    audience: "stellaops-api"
    signingKeySecret: "stellaops-jwt-secret"  # reference a Kubernetes Secret
  oidc:
    authority: "https://authority.yourdomain.com"

Create the signing key secret:

kubectl create secret generic stellaops-jwt-secret \
  --from-literal=key="$(openssl rand -base64 48)"

Verification

stella doctor run --check check.core.auth.config

Related Checks

• check.security.jwt.config — deep validation of JWT signing, algorithm, and expiration settings
• check.security.secrets — ensures secrets like JWT keys are not stored as plain text in config
• check.security.password.policy — validates password complexity requirements

See the Doctor reference for the full check catalog, CLI usage, and export bundles.