Trust Anchors¶
LightHouse maintains a common trust anchor repository in the database. This is the single source of truth for all trust anchors and their JWKS. See the Trust Anchor Repository feature documentation for additional details.
Fields¶
entity_id¶
string (URI) required
The entity ID of the trust anchor.
jwks¶
JWKS object optional (recommended)
The JWKS of the trust anchor, obtained out-of-band. If omitted, LightHouse will fetch it from the trust anchor's Entity Configuration on the first poll.
enable_jwks_update¶
boolean
false
When true, LightHouse periodically polls the trust anchor's Entity
Configuration and updates the stored JWKS when keys change. See
Automatic JWKS Refreshing
for details.
key_poll_interval¶
integer (seconds)
0 (derive from EC expiration)
Polling interval in seconds. When 0 (or <= 0), LightHouse derives the
interval from the trust anchor's Entity Configuration expiration time. See
Polling Interval for the
resolution logic.
Management¶
| Tool | Command |
|---|---|
| Admin API | GET /api/v1/admin/trust-anchors (list) |
| Admin API | POST /api/v1/admin/trust-anchors (create) |
| Admin API | GET/PUT/DELETE /api/v1/admin/trust-anchors/{entityID} |
| lhsetup | lhsetup --only=trust_anchors |
| config2db | lhmigrate config2db --only=trust_anchors |