From 9a9c3b8fc1a7436e00c306fbc890fe9fbb422b94 Mon Sep 17 00:00:00 2001 From: dev9-bb Date: Sun, 25 Oct 2026 09:35:31 +0800 Subject: [PATCH] docs(deploy): prefer CF_DIRECTORY_PROVIDER in the enterprise SSO example CF_DIRECTORY_PROVIDER is the preferred tenant namespace name; the example keeps the legacy CF_ACL_PROVIDER fallback documented so existing deployments can keep their configuration unchanged. --- deploy/compose/.env.enterprise-sso.example | 7 ++++--- tests/test_admin_startup_hook.py | 2 +- 2 files changed, 5 insertions(+), 4 deletions(-) diff --git a/deploy/compose/.env.enterprise-sso.example b/deploy/compose/.env.enterprise-sso.example index ad42c2f7..c864c6aa 100644 --- a/deploy/compose/.env.enterprise-sso.example +++ b/deploy/compose/.env.enterprise-sso.example @@ -1,9 +1,10 @@ # Enterprise Directory overrides; merge into the deployment environment before release. # Generic OAuth defaults stay provider-neutral. No credentials belong in this file. CF_SSO_OAUTH_LOGIN_ID_CLAIM=userId -# Namespace used by directory ACL rules, cf_sso_group_map rows and identity keys. -# Keep the value stable for an existing deployment; consumers may choose their own. -CF_ACL_PROVIDER=external +# Tenant namespace used by directory ACL rules, cf_sso_group_map rows and +# identity keys. Keep the value stable for an existing deployment. +# CF_DIRECTORY_PROVIDER is preferred; CF_ACL_PROVIDER remains a legacy alias. +CF_DIRECTORY_PROVIDER=external # Audience of the machine-authenticated Directory JWT (must match the Directory side). CF_DIRECTORY_AUDIENCE=eap-directory # Optional: enable ONLY after the trusted Directory /administrators machine endpoint diff --git a/tests/test_admin_startup_hook.py b/tests/test_admin_startup_hook.py index 4253878f..ac3ce759 100644 --- a/tests/test_admin_startup_hook.py +++ b/tests/test_admin_startup_hook.py @@ -59,7 +59,7 @@ def test_enterprise_default_admin_compatibility_remains_opt_in(self): # expected-account assertion is an operator opt-in in their own config. self.assertIn('CF_PROVIDER_ADMIN_EXPECTED_ACCOUNT=', env) self.assertNotIn('CF_PROVIDER_ADMIN_EXPECTED_ACCOUNT=admin', env) - self.assertIn('CF_ACL_PROVIDER=external', env) + self.assertIn('CF_DIRECTORY_PROVIDER=external', env) self.assertIn('CF_DIRECTORY_AUDIENCE=eap-directory', env) def test_nonroot_command_is_one_safely_quoted_shell_command(self):