← Overview

OmniAUSF Configuration

Configuration is read from the application environment key :omniausf, populated from config/runtime.exs. Most runtime keys are backed by an OS environment variable read at startup, shown below; the two context-reaper keys are read from the :omniausf application environment directly and are not env-var backed.

config :omniausf,
  udm_uri:                 "http://127.0.0.12:7777",
  sbi_scheme:              "http",
  sbi_addr:                "127.0.0.19",
  sbi_port:                7777,
  nrf_uri:                 "http://127.0.0.1:7777",
  mcc:                     "999",
  mnc:                     "70",
  prometheus_metrics_port: 9568,
  heartbeat_interval:      10_000

config :logger, :default_formatter,
  format: {OmniLogger.JsonFormatter, :format},
  metadata: :all

Parameter Reference

Parameter	Type	Required	Default	Env Var	Description
udm_uri	string	No	"http://127.0.0.12:7777"	UDM_URI	Fallback base URI of the UDM, used only when NRF discovery (Nnrf_NFDiscovery) returns no UDM instance or the NRF is unreachable. When discovery succeeds, Nudm_UEAuthentication calls (generate-auth-data, auth-events) target the discovered UDM instead
sbi_scheme	string	No	"http"	SBI_SCHEME	URI scheme advertised for the SBI server and used to build the NRF profile and _links hrefs. The SBI listener itself is served over HTTP
sbi_addr	string	No	"127.0.0.19"	SBI_ADDR	IP address the SBI HTTP server binds to and advertises to the NRF
sbi_port	integer	No	7777	SBI_PORT	TCP port the SBI HTTP server listens on
nrf_uri	string	No	"http://127.0.0.1:7777"	NRF_URI	Base URI of the NRF, used for NF registration, heartbeat, and peer-NF (UDM) discovery via Nnrf_NFDiscovery
mcc	string	No	"999"	MCC	Mobile Country Code of the serving PLMN. Used in the NRF profile and to build the serving network name
mnc	string	No	"70"	MNC	Mobile Network Code of the serving PLMN. Two-digit MNCs are zero-padded to three digits in the serving network name
prometheus_metrics_port	integer	No	9568	PROMETHEUS_PORT	TCP port on which Prometheus metrics are exposed (GET /metrics)
heartbeat_interval	integer (ms)	No	10000	HEARTBEAT_INTERVAL	Interval in milliseconds between NRF heartbeat requests
context_ttl_seconds	integer (s)	No	3600	-	Maximum age, in seconds, before an idle or abandoned UE authentication context is reaped. A context the AMF initiates but never confirms is deleted once it exceeds this age. Set directly under the :omniausf application environment (not env-var backed)
context_reap_interval_ms	integer (ms)	No	60000	-	How often, in milliseconds, the context reaper sweeps for contexts older than context_ttl_seconds. Set directly under the :omniausf application environment (not env-var backed)

Note on nrf_uri default: config/runtime.exs defaults NRF_URI to http://127.0.0.1:7777. In a standard loopback deployment the NRF is reached at http://127.0.0.10:7777; set NRF_URI explicitly to match your NRF address.

Logging

Logs are emitted as JSON (OmniLogger.JsonFormatter) with all metadata included. Log lines on the authentication path carry session context (supi, auth_ctx_id, procedure) so a single authentication exchange can be traced end-to-end by auth_ctx_id or SUPI/SUCI. The log level can be changed at runtime through the Management API (see below).

Management API (Port 8443)

In addition to the SBI listener and metrics port, OmniAUSF exposes an HTTPS management/OAM API on port 8443 (TLS, product name OmniAUSF). It is used for operational inspection and runtime control, and is not part of the 3GPP SBI. Key endpoints:

Method	Path	Purpose
GET	/api/status/api	API service status
GET	/api/status/nrf	NRF registration status
GET	/api/status/nf	NF summary (type AUSF, nausf-auth service, active UE context count)
GET	/api/ausf_sessions	List active authentication sessions (context id, SUCI/SUPI, serving network name, auth type/result)
DELETE	/api/ausf_sessions/{id}	Clear a specific authentication session by context id
POST	/api/ausf_sessions	Clear all active authentication sessions
GET	/api/statistics	Authentication session counters (total / success / failure / pending)
GET	/api/oam/config	View effective runtime configuration (sbi_addr, sbi_port, nrf_uri, udm_uri, NF capacity/priority, log level)
PATCH	/api/oam/config/{id}	Update runtime config: udm_uri, nrf_uri, nf_capacity, nf_priority, log_level
POST	/api/oam/log_level	Change the log level at runtime (emergency…debug)
GET	/api/oam/resources	BEAM VM resource usage (memory, process/port counts, OTP/BEAM version)
GET	/api/oam/diagnostics	BEAM VM diagnostics (run queue, I/O, GC, connected nodes)
POST	/api/oam/nrf/reregister	Force re-registration with the NRF

Runtime changes made through PATCH /api/oam/config and POST /api/oam/log_level apply to the running node only and are not persisted; they revert to the configured values on restart.

OAM-only settings

Two values are exposed through GET/PATCH /api/oam/config but are not startup parameters in the table above - they live in the NRF profile rather than the core :omniausf config:

Field	Type	Meaning
nf_capacity	integer (0-65535)	Relative capacity advertised in the AUSF's NRF profile, used by consumers as a load-balancing weight when several AUSF instances are registered. A PATCH re-advertises the new value to the NRF
nf_priority	integer (0-65535)	Relative selection priority advertised in the NRF profile; lower is preferred. A PATCH re-advertises the new value to the NRF

PATCH /api/oam/config validates these before applying: nf_capacity/nf_priority must be integers (a decimal string is accepted and parsed), and log_level must be a known level. An invalid value rejects the whole request with 400 without applying anything.

Inspecting authentication sessions

GET /api/ausf_sessions returns one entry per in-memory UE authentication context, with these fields:

Field	Meaning
ctx_id	The authCtxId (UUID); pass to DELETE /api/ausf_sessions/{ctx_id} to clear one session
suci	The supiOrSuci the AMF presented at initiation
supi	The plain SUPI resolved by the UDM (null until the vector response arrives)
serving_network_name	The SN name the session's keys are bound to
auth_type	5G_AKA once the vector is stored
auth_result	Settled outcome, or null while the session is still in flight (pending)
has_kausf	Whether K_AUSF is held for this session - indicates the vector was fetched and keys derived. The key material itself is never exposed

Because contexts are deleted the moment a confirmation settles, entries in this list are normally short-lived; a session that persists is one the AMF initiated but never confirmed or deregistered.