Database-Managed Configuration¶
Many federation-specific settings are stored in the database rather than the config file. They can be changed at runtime without restarting LightHouse.
Management Tools¶
Three tools manage database-backed configuration:
| Tool | Use case |
|---|---|
| Admin API | Runtime management via HTTP — create, update, delete individual settings. |
lhsetup |
Interactive CLI wizard — prompts for all DB-managed values; ideal for initial setup. |
lhmigrate config2db |
Non-interactive migration from an existing (legacy) config file to the database. |
Configurable Sections¶
| Section | Description |
|---|---|
signing |
Signing algorithm, RSA key length, key rotation (incl. key announcement lead time) |
entity-configuration |
Entity configuration lifetime, entity metadata, authority hints, extra entity config claims |
trust-marks |
Published trust marks, trust mark specs & subjects, trust mark types, issuers, owners |
trust-anchors |
Trust anchor repository (entity IDs, JWKS, automatic JWKS refreshing) |
federation-endpoints |
Federation endpoint paths, URLs, auth settings, and type-specific configuration |
subordinates |
General subordinate statement config (lifetime, constraints, metadata policies, additional claims) and per-subordinate JWKS refresh settings |
Use lhsetup --only=<section> or --skip=<section> to select specific
sections. See the lhsetup documentation for the
full list of section names.