Skip to main content

Configuration

CET2's configuration has two real sections: AzureAd (JWT validation for user sign-in) and Cet2 (application behaviour and Graph authentication). Deliver these via App Service application settings (double-underscore keys), an appsettings.Production.json file, or container environment variables.

appsettings.Production.json template​

appsettings.Production.json
{
  "AzureAd": {
    "Authority": "https://login.microsoftonline.com/organizations/v2.0",
    "Audience": "<PORTAL_CLIENT_ID>",
    "TenantId": "<HOME_TENANT_ID>"
  },
  "Cet2": {
    "BrandName": "ClefSoft Endpoint Toolkit",
    "DeploymentMode": "Msp",
    "DbPath": "/home/data/cet2.db",
    "BootstrapAdminObjectIds": [ "<YOUR_ADMIN_OBJECT_ID>" ],
    "GraphAuth": {
      "ClientId": "<DATA_CLIENT_ID>",
      "CredentialKind": "Certificate",
      "CertificateName": "cet2-graph-cert",
      "KeyVaultUri": "https://<vault>.vault.azure.net/",
      "HomeTenantId": "<HOME_TENANT_ID>"
    },
    "Actions": {
      "Enabled": false,
      "ElevatedMaxAgeMinutes": 15,
      "DestructiveMaxAgeMinutes": 5,
      "RateLimitPerMinute": 30,
      "RateLimitBurst": 10
    },
    "DevAuthBypass": false
  }
}

As App Service application settings, the same values are set with double underscores in place of the JSON nesting, e.g. AzureAd__Authority, Cet2__GraphAuth__ClientId, Cet2__Actions__Enabled.

For self-hosted deployments, omit KeyVaultUri and set CertificateName to the mounted PFX file's path instead.

SettingPurpose
AzureAd:AuthorityFixed at https://login.microsoftonline.com/organizations/v2.0 for multi-tenant sign-in
AzureAd:AudienceThe Portal application's client ID
Cet2:BrandNameThe product name shown in the SPA — sign-in screen, sidebar, browser tab. White-labels the deployment; see White-Labelling
Cet2:DeploymentModeMsp (one instance serves many customers) or CustomerOwned
Cet2:DbPathPath to the SQLite metadata file — must be on persistent storage
Cet2:BootstrapAdminObjectIdsObject IDs to seed as Platform Super Administrator on first run
Cet2:GraphAuth.*The Data application's credentials — see App Registrations
Cet2:Actions.EnabledMaster switch for write actions. Leave false until the deployment is otherwise validated
Cet2:Actions.DestructiveMaxAgeMinutesThe step-up freshness window for destructive actions (default 5 minutes)
Cet2:DevAuthBypassNever true in production — bypasses authentication (RBAC still applies)

appsettings.Development.json​

Local development only. May set Cet2:DevAuthBypass=true to skip Entra sign-in while testing — RBAC enforcement is still fully exercised against a fixed dev-admin principal, so this is a genuine test of the authorization logic, not a bypass of it.

authConfig.ts (frontend, build-time)​

web/src/authConfig.ts
const CLIENT_ID = "<PORTAL_CLIENT_ID>";

export const msalConfig = {
  auth: {
    clientId: CLIENT_ID,
    authority: "https://login.microsoftonline.com/organizations",
  },
};

export const apiRequest = { scopes: [`api://${CLIENT_ID}/access_as_user`] };

Tenant and RBAC configuration​

Neither of these is a file:

  • Tenants live in the SQLite tenant registry, populated through the Tenant Onboarding flow in the UI. The home/MSP tenant is seeded automatically on first run.
  • RBAC role definitions are code-defined and not customer-editable. RBAC assignments are created at runtime through the Access Control page (or its API), and persist in the same SQLite file. Use Cet2:BootstrapAdminObjectIds to seed the first Platform Super Administrator — everything else is assigned through the UI from that point on.

Continue to SSL and DNS.