Skip to content

Add Symphony RSA authentication preset #105

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
timkpaine merged 1 commit into from
Oct 6, 2026
Merged

Add Symphony RSA authentication preset #105

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
15 changes: 15 additions & 0 deletions csp_bot/config/backend/symphony_rsa.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,15 @@
# @package modules.bot.config
# Symphony authenticated with an RSA private key rather than a certificate.
#
# This is what `symphony-bdk` configurations use, and what Symphony's developer
# sandbox issues, so it is offered alongside the certificate preset rather than
# left to a hand-written override.
symphony:
_target_: csp_bot.SymphonyConfig
bot_name: ${bot_name}
config:
_target_: chatom.symphony.SymphonyConfig
host: ${oc.env:SYMPHONY_HOST}
bot_username: ${oc.env:SYMPHONY_BOT_USERNAME}
# A path keeps long-lived key material out of the process environment.
bot_private_key_path: ${oc.env:SYMPHONY_BOT_PRIVATE_KEY_PATH}
20 changes: 11 additions & 9 deletions docs/wiki/Backends.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,26 +20,28 @@ pip install csp-adapter-slack csp-adapter-telegram

Each backend reads its credentials from environment variables, matching the names used by the built-in `backend` configs.

| Backend | Environment variables | `chatom` config field |
| :------- | :------------------------------------------------------------- | :--------------------------------------------- |
| Slack | `SLACK_BOT_TOKEN`, `SLACK_APP_TOKEN` | `bot_token`, `app_token` |
| Discord | `DISCORD_TOKEN` | `token` |
| Symphony | `SYMPHONY_HOST`, `SYMPHONY_BOT_USERNAME`, `SYMPHONY_CERT_PATH` | `host`, `bot_username`, `bot_certificate_path` |
| Telegram | `TELEGRAM_BOT_TOKEN` | `bot_token` |
| Backend | Environment variables | `chatom` config field |
| :------------- | :------------------------------------------------------------------------ | :--------------------------------------------- |
| Slack | `SLACK_BOT_TOKEN`, `SLACK_APP_TOKEN` | `bot_token`, `app_token` |
| Discord | `DISCORD_TOKEN` | `token` |
| Symphony | `SYMPHONY_HOST`, `SYMPHONY_BOT_USERNAME`, `SYMPHONY_CERT_PATH` | `host`, `bot_username`, `bot_certificate_path` |
| Symphony (RSA) | `SYMPHONY_HOST`, `SYMPHONY_BOT_USERNAME`, `SYMPHONY_BOT_PRIVATE_KEY_PATH` | `host`, `bot_username`, `bot_private_key_path` |
| Telegram | `TELEGRAM_BOT_TOKEN` | `bot_token` |

Symphony needs a host, a bot username, and either a certificate or an RSA private key.
The built-in preset uses certificate authentication with a combined certificate/key `.pem` file on disk (`bot_certificate_path`); a path keeps long-lived key material out of the process environment.
Two presets cover both: `backend=symphony` uses certificate authentication with a combined certificate/key `.pem` file on disk (`bot_certificate_path`), and `backend=symphony_rsa` uses an RSA private key (`bot_private_key_path`), which is what `symphony-bdk` configurations and Symphony's developer sandbox use.
Either way a path keeps long-lived key material out of the process environment.

Discord's `message_content` is a [privileged intent](https://discord.com/developers/docs/topics/gateway#privileged-intents).
The built-in preset requests it, but it must also be enabled for the bot in the Discord Developer Portal, or the bot will not receive command text in guild channels.

To set a field other than the defaults — for example, to authenticate Symphony with an RSA key instead of a certificate — override it in your own config:
To set a field neither preset covers, override it in your own config:

```yaml
# @package modules.bot.config
symphony:
config:
bot_private_key_path: /path/to/bot-key.pem
key_manager_host: km.example.com
```

For platform-specific setup of tokens and bot accounts, follow the adapter guides:
Expand Down