> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.itential.com/itential-platform/6/developer-guide/broker-principal-config-setting/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.itential.com/_mcp/server.

# Broker principal config setting

> How to configure the brokerPrincipal setting to allow an AAA adapter to build principal objects instead of the Session Manager module.

The Itential Platform supports building principal objects via broker calls to a local AAA adapter. The `brokerPrincipal` configuration setting can be found within the `authenticationProps` of an active profile. It allows an AAA adapter to define a `buildPrincipal` function — that is, to create principal objects — instead of the Session Manager module.

**Sample profile schema for `brokerPrincipal`**

```json
"brokerPrincipal": {
    "$id": "#/properties/authenticationProps/properties/brokerPrincipal",
    "type": "boolean",
    "description": "When brokerPrincipal is set to true, the AAA adapter will be responsible for creating a principal.",
    "title": "Broker Principal",
    "default": false,
    "examples": [false]
}
```

## Use the broker principal setting

To use this feature when developing a custom auth adapter:

#### Add the buildPrincipal function to your Local AAA adapter

Add the following code at the end of the file before the export statement, and change the console log level to debug.

```bash
const buildAnonymousPrincipal = function () {
  return {
    id: 9999,
    provenance: 'Pronghorn',
    username: 'anonymous',
    firstname: 'anonymous',
    groups: [],
    roles: [],
    allowedMethods: [],
    allowedViews: [],
    routes: [],
  };
}

/**
 * Make sure a principal is stashed in redis
 * @param {string} accountId
 */
local_aaa.prototype.buildPrincipal = async function (accountId, callback) {
  const promised = new Promise((resolve, reject) => {
    console.log('START!')
    setTimeout(() => {
      console.log('I did a thing to build principal');
      resolve();
    }, 3000);
  });

  await promised;
  callback(buildAnonymousPrincipal());
}
```

#### Restart Itential Platform

Restart Itential Platform with the code changes.

#### Log in as admin

Log in to Itential Platform as admin.

#### Navigate to the broker principal setting

Go to **Admin Essentials** → **Profiles** → select the active profile → **Configure** → **authenticationProps Schema**.

Verify there is a checkbox for **Broker Principal** (unchecked).

![](/_fern-img/37c24e0afaf3e24eed46bbb5ad3309e0fdc085e4795b81cf061576cb58433154.webp)

#### Enable broker principal

Check the **Broker Principal** box and save the profile.

#### Restart and verify

Restart Itential Platform, then log in as admin. Upon login, you should have no permissions, as you are using the equivalent of an anonymous principal. This confirms the local AAA adapter `buildPrincipal` function is being called.

> How to configure the brokerPrincipal setting to allow an AAA adapter to build principal objects instead of the Session Manager module.