Configuration precedence

Configuration precedence A architecture diagram generated by Archify. Config sources Runtime trust root Environment · Exists → locked · Config sources Environment Exists → locked Cordis / Bundle · Only if env is unset · Config sources Cordis / Bundle Only if env is unset Defaults · ordinary = off · Config sources Defaults ordinary = off PluginConfig · Env > Cordis > Default · Runtime trust root PluginConfig Env > Cordis > Default issuer + JWKS · From teamDomain · Runtime trust root issuer + JWKS From teamDomain override and lock used if unlocked fallback do not set issuer / jwksUrl Legend Backend Cloud Security External

Lock

  • • DSH_CF_ACCESS_TEAM_DOMAIN
  • • DSH_CF_ACCESS_AUDIENCES
  • • DSH_CF_ACCESS_ORDINARY_MODE
  • • An empty string still locks the field

Derived

  • • issuer is the normalized teamDomain origin
  • • JWKS is <origin>/cdn-cgi/access/certs
  • • Remote Settings cannot change the trust root