admin

Both group names are optional; empty disables the corresponding role.

Key	Type	Default
admin.require_group	string	empty
admin.soc_group	string	empty
admin.auditor_group	string	empty
admin.nss_key_group	string	empty
admin.contact_email	string	empty
admin.disabled_message	string	empty

require_group

string, default empty

The OIDC group a caller must belong to in order to access admin-scoped operations (the effective configuration, diagnostics, claims echo, the directory status, sync and probe), plus everything the SOC and auditor roles below can do. Empty disables admin operations entirely. Fails closed: no identity, no group, or no configured group all deny.

admin:
  require_group: ""

soc_group

string, default empty

The OIDC group a caller must belong to in order to access SOC-scoped account operations: disabling and re-enabling users and expiring enrollments. Whoever can contain an account can also release it, so a SOC disable of an admin never needs an admin to undo it. SOC is a child role of admin, so require_group members hold SOC access regardless of this setting; empty therefore narrows SOC operations to admins rather than disabling them. SOC members also hold auditor access (they need the directory and enrollment lists to find what to contain). Fails closed: no identity, or membership in neither group, denies.

admin:
  soc_group: ""

auditor_group

string, default empty

The OIDC group a caller must belong to in order to access auditor-scoped operations (cross-user certificate history, the user and service code directories, the audit feed). Auditor is a child role of both admin and SOC, so require_group and SOCGroup members hold auditor access regardless of this setting; empty therefore narrows auditor operations to those roles rather than disabling them. Fails closed: no identity, or membership in no granting group, denies.

admin:
  auditor_group: ""

nss_key_group

string, default empty

The OIDC group a caller must belong to in order to administer every NSS fleet API key: create keys, rotate, revoke and edit any of them, and assign the group that manages a key. Admins hold this access regardless of this setting, so empty narrows key administration to admins rather than disabling it. Members of a key’s own group manage that key without this role, and SOC and auditors keep their own revoke and read access. Fails closed: no identity, or membership in neither group, denies.

admin:
  nss_key_group: ""

contact_email

string, default empty

Superseded by branding.support_email, which is the one setting for who to ask about this deployment and is shown on the account-disabled page along with the login page and the footer. It is still read, but only when branding.support_email is unset, so an existing configuration keeps its contact; the server logs a warning at startup while it is the one in use.

admin:
  contact_email: ""

disabled_message

string, default empty

Free-text shown on the account-disabled page below the contact email. Useful for explaining why the account was disabled or what the user should do next.

admin:
  disabled_message: ""