Configure environments

Environments define cloud storage containers where you can deploy user flow configuration and the Orchestrators that will read that configuration for your applications. Create environments (e.g. dev, test, staging, and production), configure cloud storage containers, and assign orchestrators to those environments.

For additional information on environment variables that can be used in the configuration, see Environment Variables.

Best practices

We recommend using the following best practices when setting up your environment:

Create a new environment

From the sidebar, click Environments, and click the + icon next to the type of storage you would like to configure. If you are creating an evaluation environment, skip to Evaluation environment configuration.

The environment and orchestrator support the app you configure. If you are going to use the environment with a SAML app, you must include the SAML provider details in your environment configuration. If you are using the environment with an OIDC app, include the OIDC provider and, optionally, OIDC cache details in your environment configuration.

Settings are divided by section as follows.

General Settings

• Name: A friendly name for your environment. For this example, let’s use AWS-staging.
• Description: Additional description of the environment.
• Production: This checkbox denotes that this will be used as a Production environment.

Orchestrator Settings

• Max Lifetime Seconds: (Optional) This field represents the maximum number of seconds that can elapse post-authentication before the session’s authentication state becomes invalid.
• Idle Timeout: (Optional) This field represents the number of seconds a session may remain idle before timing out. If no value is set, or IdleTimeout is set to 0, then the session idle timeout is disabled.
• Cache Size: (Optional) This field limits the number of sessions maintained in memory. Defaults to 50,000 sessions.
• Orchestrator URL: (Required) This field is required when configuring the orchestrator as an OIDC or SAML provider. The orchestrator URL is used to define additional OIDC endpoints and SAML endpoints.
• Logout Endpoint: This optional field is the endpoint clients may call to trigger logout from all applications and IDPs. Maverics can automatically populate this based on the Orchestrator URL. Enter the value after the orchestrator URL only (for example, slo or logout).
• Post-Logout Redirect URL: This field is optional and represents the URL to redirect the client to after the single logout process is complete.Maverics can automatically populate this based on the Orchestrator URL.
• Health check endpoint: Specify the endpoint that external services can poll to determine the health of the orchestrator. When a GET request is made to this endpoint, a live orchestrator should return an HTTP 200 response. If this field is not set, the default endpoint of /status is used. (Note: The orchestrator must be manually restarted in order for this change to take effect.)
• Cookie Settings
  • Domain: (Optional) This field specifies the hosts to which the session cookie will be sent.
  • Name: A friendly name for the cookie.
  • HTTPOnly Attribute: (Optional) This field toggles the HTTPOnly cookie attribute for the session. If disabled, the session cookie will not have the HttpOnly attribute, allowing the cookie to be accessed via client side scripts
  • Secure Cookie Attribute: (Optional) This field toggles the Secure cookie attribute. If disabled, the session cookie will not have the Secure attribute, allowing the browser to send the cookie over an unencrypted HTTP request.
• Logging settings
  • Time format: Select your preferred formatting of log timestamps.
  • Level: Select the verbosity of the Orchestrator logs. For example, selecting “Error” will only show error logs (when debug mode is off).
  • Session tracker: Enable or disable a session identifier in log messages. This setting is useful when filtering logs to isolate a problem with a particular session. (Note: The identifier printed in the logs corresponds to a particular session, but it is not the actual session ID itself and cannot be used to impersonate a user’s session.)
• Telemetry: When enabled, orchestrators send telemetry data to Maverics. You can view this on the Orchestrator Telemetry page. After you have started your Orchestrator, click Redeploy on a user flow to refresh. This option is turned on by default.

Registration Endpoint

This toggle turns on the registration endpoint. When enabled, you can use the Maverics API endpoint to automate application registration and user flow deployment. For more information, see Use the Maverics API to automate deployments.

Container configuration details

• Additional configuration details will depend on the cloud storage environment you have selected. This usually includes bucket names, access keys, tokens, and configuration file paths. For more information on configuraiton details, see Best practices.

SAML Provider

Configure the following fields if you will be using this environment for a SAML provider (for use with a SAML application).

• Issuer Override: Enter a SAML issuer here to override the default Orchestrator URL.
• Signing Options: Select whether to sign only the response, only the assertion, or both.
• Key Pairs: Select whether you want to upload a certificate, use a secret store, or generate a certificate and key pair.
• Certificate: The x509 certificate used by clients to validate the signature of SAML assertions.
• Private Key: The RSA256 private key used to sign SAML assertions.

For more information on configuring a SAML provider, see Set up a SAML app.

OIDC Provider

Configure the following fields if you will be using this environment for a OIDC provider (for use with an OIDC application).

• Key Pairs: Select whether you want to upload a certificate, use a secret store, or generate a certificate and key pair.
• Certificate: The x509 certificate used by clients to validate the signature of OIDC assertions.
• Private Key: The RSA256 private key used to sign OIDC assertions.

For more information on configuring an OIDC provider, see Set up an OIDC app.

OIDC Cache

External caches may be defined and used with the orchestrator to enable high availability for OIDC providers/applications. Currently OIDC Cache only supports Redis 6.0 or greater. You will need to configure the following:

• Addresses: Your Redis server addresses.
• Username and password: The username and password must be generated via access control list (ACL) in Redis.
• CA Path: (Optional) The path to your certificate authority when using self signed certs.
• Encryption Keys: List of 32 byte encryption keys from oldest to newest. Keys can be created with OpenSSL (for example: openssl rand -hex 32).

Click Create. The details of your environment will appear on the next page.

Environment details page

The environment details page appears after you’ve created the environment. You can also navigate to this page by selecting an environment on the Environments page.

The details page is divided into several categories.

Orchestrator or Orchestrator Evaluation Bundle

Download the installer based on your OS and follow the documentation to install and setup.

For evaluation environments, this section provides an evaluation bundle. This bundle contains everything you need to connect to this environment, including public keys and certificate files, an environment file, and an orchestrator. After downloading the file appropriate for your OS, you can then run the orchestrator included in the bundle.

Resources

From this section, you can download the public key for your environment. You can also download the Windows Client Authenticator installer.

Deployed User Flows

This table shows the user flows that have been deployed to this environment, including the revision number and the user. Click Download configuration to download a maverics.tar.gz bundle of the full configuration, including service extensions. Click Redeploy to refresh all user flows in the environment.

OIDC options

OIDC options appear on environments set up for use with an OIDC app.

For more information on configuring an OIDC provider, see Set up an OIDC app.

SAML details

SAML options appear on environments set up for use with a SAML app.You can download the SAML signing certificate and SAML metadata in these sections to set up a SAML service provider.

For more information on configuring a SAML provider, see Set up a SAML app.

Evaluation environment configuration

When you create an evaluation environment for testing, no additional configuration of the environment is necessary. The following steps occur behind the scenes:

1. An AWS storage bucket will be created.
2. The defaults for Orchestrator URL (https://localhost), logout URL (/logout), and other settings will be configured automatically. You can change these settings by clicking the Edit button in the top right hand side.
3. An empty maverics.tar.gz file is then pushed to the cloud storage bucket so the orchestrator will start up successfully in case there is no user flow published yet.
4. A downloadable bundle is created with a maverics.env file preconfigured to connect to this environment.

You can only have one eval environment at a time. After you create one it removes the option to create another from the Environments right side bar. This environment is provided for tesing purposes only and may be deleted after 90 days of inactivity.

For a step-by-step walkthrough, use the Learning Center topic, “Getting Started: Evaluation Environment.”

Orchestrator resources

For more information on setting up environments, we recommend the following Orchestrator reference topics: