# Trigger authentication configuration

Set configuration in the environment inherited by the server's trigger processes. Export it from the service startup environment; an export only in an administrator's interactive terminal will not change an already running server. Existing defaults are retained so an existing configured installation can migrate one setting at a time. The sample hosts/domains and RADIUS secret are examples and must be replaced for an actual deployment.

| Variable | Used by | Default |
| --- | --- | --- |
| `SDP_AUTH_P4` | RADIUS check, Incident check | RADIUS check: `/p4/common/bin/p4`; Incident check: instance binary |
| `SDP_AUTH_AD_HOSTS` | RADIUS check | `ldap://ad.company.com`; whitespace-separated hosts |
| `SDP_AUTH_AD_DOMAIN` | RADIUS check | `YOURDOMAIN\` |
| `SDP_AUTH_SERVICE_USERS` | RADIUS check | `/p4/common/bin/triggers/serviceusers.txt` |
| `SDP_AUTH_LOCAL_PASSWORDS` | RADIUS check | `/p4/common/bin/triggers/local.passwd` |
| `SDP_AUTH_RADIUS_SERVERS` | RADIUS check/test | `server1 server2 server3`; whitespace-separated hosts |
| `SDP_AUTH_RADIUS_SECRET` | RADIUS check/test | `your_shared_secret` |
| `SDP_AUTH_RADIUS_SECRET_FILE` | RADIUS check/test | Unset; when set, takes precedence over the secret environment variable |
| `SDP_AUTH_RADIUS_DICTIONARY` | RADIUS check/test | Auth check: `/p4/common/bin/triggers/dictionary`; test: adjacent `dictionary` |
| `SDP_AUTH_ERROR_LOG` | RADIUS check | `/p4/common/bin/triggers/rad_errors.log` |

A RADIUS secret file contains the shared secret as bytes, optionally ending with a newline. Restrict it to the service account (for example, mode 0600). The file avoids putting the secret in an environment variable. Local-password and service-user files retain their existing bypass semantics; this update does not change authentication policy.

## Incident trigger instance

The existing changelist/user arguments remain valid. Set `SDP_INSTANCE` in the server environment or add `--instance` explicitly; the default remains `1`.

```text
submitform1_in change-submit //depot/somepath/... "/p4/common/bin/triggers/submit_form_1_in.py %changelist% %user% --instance blue"
```

The selected instance controls both `p4master_run` and the default instance P4 binary. `SDP_AUTH_P4` can override that binary path. Offline tests mock every P4/LDAP/RADIUS operation; no credentials or live authentication services are exercised by the regression suite.