_uaa.html.md.erb

1. Select **UAA**. 

1. (Optional) Under **JWT Issuer URI**, enter the URI that UAA uses as the issuer when generating tokens. 

    <%= image_tag('ert_uaa_jwt_uri.png') %>
1. Under **SAML Service Provider Credentials**, enter a certificate and private key to be used by UAA as a SAML Service Provider for signing outgoing SAML authentication requests. You can provide an existing certificate and private key from your trusted Certificate Authority or generate a self-signed certificate. The following domains must be associated with the certificate: `login.YOUR-SYSTEM-DOMAIN` and `*.login.YOUR-SYSTEM-DOMAIN`.
	<p class="note"><strong>Note</strong>: The Pivotal Single Sign-On Service and Pivotal Spring Cloud Services tiles require the <code>*.login.YOUR-SYSTEM-DOMAIN</code>.</p>

1. If the private key specified under **Service Provider Credentials** is password-protected, enter the password under **SAML Service Provider Key Password**.
    <%= image_tag("service-provider.png") %>

1. (Optional) In the **Apps Manager Access Token Lifetime**, **Apps Manager Refresh Token Lifetime**, **Cloud Foundry CLI Access Token Lifetime**, and **Cloud Foundry CLI Refresh Token Lifetime** fields, change the lifetimes of tokens granted for Apps Manager and Cloud Foundry Command Line Interface (cf CLI) login access and refresh. Most deployments use the defaults. 
    <%= image_tag("authsso-uaa-bottom.png") %>

1. (Optional) Customize the text prompts used for username and password from the cf CLI and Apps Manager login popup by entering values for **Customize Username Label (on login page)** and **Customize Password Label (on login page)**.

1. (Optional) The **Proxy IPs Regular Expression** field contains a pipe-delimited set of regular expressions that UAA considers to be reverse proxy IP addresses. UAA respects the `x-forwarded-for` and `x-forwarded-proto` headers coming from IP addresses that match these regular expressions. To configure UAA to respond properly to Router or HAProxy requests coming from a public IP address, append a regular expression or regular expressions to match the public IP address.

1. You can configure UAA to use the internal MySQL database provided with PCF, or you can configure an external database provider. Follow the procedures in either the [Internal Database Configuration](#uaa-internal) or the [External Database Configuration](#uaa-external) section below.
  <p class="note"><strong>Note</strong>: For GCP installations, Pivotal recommends selecting <strong>External</strong> and using Google Cloud SQL.</p>
  <p class="note"><strong>Note</strong>: If you are performing an upgrade, do not modify your existing internal database configuration or you may lose data. You must migrate your existing data before changing the configuration. See <a href="upgrading-pcf.html">Upgrading Pivotal Cloud Foundry</a> for additional upgrade information, and contact <a href="https://support.pivotal.io">Pivotal Support</a> for help. </p>

###<a id='uaa-internal'></a> Internal Database Configuration

1. Select **Internal MySQL**.

    ![UAA DB Selection](ert_uaa_internal.png)

1. Click **Save**.

1. Ensure that you complete the "Configure Internal MySQL" step later in this topic to configure high availability and automatic backups for your internal MySQL databases.

###<a id='uaa-external'></a> External Database Configuration

1. From the **UAA** section in Elastic Runtime, select **External**.
    <%= image_tag('ert_uaa_external.png') %>
1. Enter the **Hostname** and **TCP Port** of the database from [Step 6: Create Database Instance and Databases](./gcp-prepare-env.html#dbs) of the _Preparing to Deploy PCF on GCP_ topic.
1. For **User Account and Authentication database username**, specify a unique username that can access this specific database on the database server.
1. For **User Account and Authentication database password**, specify a password for the provided username.
1. Click **Save**.