Set configuration in the environment inherited by the server's trigger processes. Export it from the service startup environment; an export only in an administrator's interactive terminal will not change an already running server. Existing defaults are retained so an existing configured installation can migrate one setting at a time. The sample hosts/domains and RADIUS secret are examples and must be replaced for an actual deployment.
| Variable | Used by | Default |
|---|---|---|
SDP_AUTH_P4 |
RADIUS check, Incident check | RADIUS check: /p4/common/bin/p4; Incident check: instance binary |
SDP_AUTH_AD_HOSTS |
RADIUS check | ldap://ad.company.com; whitespace-separated hosts |
SDP_AUTH_AD_DOMAIN |
RADIUS check | YOURDOMAIN\ |
SDP_AUTH_SERVICE_USERS |
RADIUS check | /p4/common/bin/triggers/serviceusers.txt |
SDP_AUTH_LOCAL_PASSWORDS |
RADIUS check | /p4/common/bin/triggers/local.passwd |
SDP_AUTH_RADIUS_SERVERS |
RADIUS check/test | server1 server2 server3; whitespace-separated hosts |
SDP_AUTH_RADIUS_SECRET |
RADIUS check/test | your_shared_secret |
SDP_AUTH_RADIUS_SECRET_FILE |
RADIUS check/test | Unset; when set, takes precedence over the secret environment variable |
SDP_AUTH_RADIUS_DICTIONARY |
RADIUS check/test | Auth check: /p4/common/bin/triggers/dictionary; test: adjacent dictionary |
SDP_AUTH_ERROR_LOG |
RADIUS check | /p4/common/bin/triggers/rad_errors.log |
A RADIUS secret file contains the shared secret as bytes, optionally ending with a newline. Restrict it to the service account (for example, mode 0600). The file avoids putting the secret in an environment variable. Local-password and service-user files retain their existing bypass semantics; this update does not change authentication policy.
The existing changelist/user arguments remain valid. Set SDP_INSTANCE in the server environment or add --instance explicitly; the default remains 1.
submitform1_in change-submit //depot/somepath/... "/p4/common/bin/triggers/submit_form_1_in.py %changelist% %user% --instance blue"The selected instance controls both p4master_run and the default instance P4 binary. SDP_AUTH_P4 can override that binary path. Offline tests mock every P4/LDAP/RADIUS operation; no credentials or live authentication services are exercised by the regression suite.
# Trigger authentication configuration Set configuration in the environment inherited by the server's trigger processes. Export it from the service startup environment; an export only in an administrator's interactive terminal will not change an already running server. Existing defaults are retained so an existing configured installation can migrate one setting at a time. The sample hosts/domains and RADIUS secret are examples and must be replaced for an actual deployment. | Variable | Used by | Default | | --- | --- | --- | | `SDP_AUTH_P4` | RADIUS check, Incident check | RADIUS check: `/p4/common/bin/p4`; Incident check: instance binary | | `SDP_AUTH_AD_HOSTS` | RADIUS check | `ldap://ad.company.com`; whitespace-separated hosts | | `SDP_AUTH_AD_DOMAIN` | RADIUS check | `YOURDOMAIN\` | | `SDP_AUTH_SERVICE_USERS` | RADIUS check | `/p4/common/bin/triggers/serviceusers.txt` | | `SDP_AUTH_LOCAL_PASSWORDS` | RADIUS check | `/p4/common/bin/triggers/local.passwd` | | `SDP_AUTH_RADIUS_SERVERS` | RADIUS check/test | `server1 server2 server3`; whitespace-separated hosts | | `SDP_AUTH_RADIUS_SECRET` | RADIUS check/test | `your_shared_secret` | | `SDP_AUTH_RADIUS_SECRET_FILE` | RADIUS check/test | Unset; when set, takes precedence over the secret environment variable | | `SDP_AUTH_RADIUS_DICTIONARY` | RADIUS check/test | Auth check: `/p4/common/bin/triggers/dictionary`; test: adjacent `dictionary` | | `SDP_AUTH_ERROR_LOG` | RADIUS check | `/p4/common/bin/triggers/rad_errors.log` | A RADIUS secret file contains the shared secret as bytes, optionally ending with a newline. Restrict it to the service account (for example, mode 0600). The file avoids putting the secret in an environment variable. Local-password and service-user files retain their existing bypass semantics; this update does not change authentication policy. ## Incident trigger instance The existing changelist/user arguments remain valid. Set `SDP_INSTANCE` in the server environment or add `--instance` explicitly; the default remains `1`. ```text submitform1_in change-submit //depot/somepath/... "/p4/common/bin/triggers/submit_form_1_in.py %changelist% %user% --instance blue" ``` The selected instance controls both `p4master_run` and the default instance P4 binary. `SDP_AUTH_P4` can override that binary path. Offline tests mock every P4/LDAP/RADIUS operation; no credentials or live authentication services are exercised by the regression suite.
| # | Change | User | Description | Committed | |
|---|---|---|---|---|---|
| #1 | 34004 | Russell C. Jackson (Rusty) |
Improve SDP backup/recovery, Maintenance, logging and cloud operation. Add owned checkpoint locks, recovery-aware retention, preserved database switches, bounded cleanup and coordinated AWS/Azure snapshots. Fix service-user password initialization, edge staging, standby promotion state parsing, proxy cache setup, typed depot verification and historical-server configuration/error handling. Remove unused OTP programs; keep Windows removed, server.locks cleanup and the journal-count condition unchanged. Add no global shell strict modes. Update operational documentation and add reproducible mkdirs.sh/mkdirs.cfg container assurance. Validate Ubuntu 26.04 and UBI 8.10/9.8/10.2 across both Python runtimes: 44 stages; 428 offline tests per runtime/OS, zero offline skips; 19 deployed-archive comparisons per combination. Three six-node topology runs pass all 30 recovery/failure scenarios. P4D 2023.1 through 2026.1 on UBI 8/9 pass all 14 cells and 98 scenarios. Static, documentation and provenance checks pass. Containers do not certify every fleet kernel, patch build or integration. Tested source manifest SHA-256: e1a23e17b8ced8c1148d9a250589977c6f6e98606bf2a81dc3ff5d7c909e3695 Deployed comparison archive SHA-256: 1bd23217356ee3808e040d39aea5be9519bda7c8f2b4924656a70aff8ad7293a |