Differences

This shows you the differences between two versions of the page.

--- devel:documentation:application_configuration:dev:backend [2019/07/04 08:54]
tomiskar [Backup]
+++ devel:documentation:application_configuration:dev:backend [2020/04/08 12:27]
tomiskar
@@ Line 1: / Line 1: @@
 ===== Configuration - backend =====
-{{tag> configuration}}
+{{tag> configuration final property properties config setup}}
 The application uses a Spring boot configuration in the ''application.properties'' files. All the configuration items which are used solely for idm begin with ''idm.'' prefix. The configuration items from the file can be overloaded through a setting agenda in the gui => a server restart isn't needed for changing the configuration with ''idm.'' prefix, which was one of the main goals. The configuration is saved in the database. Use ''ConfigurationService'' for reading and saving configuration items.
@@ Line 12: / Line 12: @@
   * if the name of a configuration item contains the''password'' or ''token'' chain, the value of the configuration item is hidden in the rest interface listing (or rather replaced with substitute characters).
   * It is better to use constants for keys, e.g. ''ConfigurationService.IDM\_PUBLIC\_PROPERTY\_PREFIX + "core.identity.delete"'' - using seperator constant in key name suffix is not preferred - constant can be simply found by key suffix ("ctrl-f" + "core.identity.delete").
-Cache is used for reading configuration values - default spring boot cache (ConcurrentHashMap) is configured for now. Value in cache is cleared by an active (save, delete) operation.
-<note tip>
-If you are debugging some of code and are you figuring, something is wrong with the cache, then you can turn the cache off with property (in application.properties)
-<code properties>
-spring.cache.type=none
-</code>
-</note>
 ==== Configure environment properties ====
@@ Line 93: / Line 84: @@
 # Show role environmnent in frontend application for roles (table, role detail, niceLabel, info components, role select)
 idm.pub.app.show.environment=true
+# Available size options for tables in frontend application
+idm.pub.app.show.sizeOptions=10, 25, 50, 100
+# show default form for newly created user
+# default form can be disabled => at least one configured form projection is needed
+idm.pub.app.show.identity.formProjection.default=true
 #
 # Private properties - used on backend only.
@@ Line 109: / Line 105: @@
 <code properties>
-# audit table suffix
+# ZonedDateTime is stored in UTC
+spring.jpa.properties.hibernate.jdbc.time_zone=UTC
+# Driver (e.g. postgres) does not support contextual LOB creation
+spring.jpa.properties.hibernate.jdbc.lob.non_contextual_creation=true
+# audit table suffixes
 spring.jpa.properties.org.hibernate.envers.audit_table_suffix=_a
+spring.jpa.properties.org.hibernate.envers.modified_flag_suffix=_m
 # modified flag for all audited columns
 spring.jpa.properties.org.hibernate.envers.global_with_modified_flag=true
 # prevent to modify attributes created, creator etc.
-spring.jpa.properties.hibernate.ejb.interceptor=eu.bcvsolutions.idm.core.model.repository.listener.AuditableInterceptor
+spring.jpa.properties.org.hibernate.envers.audit_strategy=eu.bcvsolutions.idm.core.model.repository.listener.IdmAuditStrategy
+spring.jpa.properties.hibernate.session_factory.interceptor=eu.bcvsolutions.idm.core.model.repository.listener.AuditableInterceptor
 # enable / disable audit (envers)
 spring.jpa.properties.hibernate.listeners.envers.autoRegister=true
+# Spring boot 2 changed default to true, but we are using IDENTITY identifier generators for mssql database.
+spring.jpa.hibernate.use-new-id-generator-mappings=false
 #
 # DB ddl auto generation by hibernate is disabled - flyway database migration is used
@@ Line 131: / Line 134: @@
 spring.datasource.testOnBorrow=true
 spring.datasource.validationQuery=SELECT 1
+# Enlarge pool size by default. This property should be revised for each project. Size should be configured by task and event thread pool size - should be higher than sum of pool sizes.
+spring.datasource.hikari.maximumPoolSize=50
 </code>
@@ Line 195: / Line 200: @@
 </code>
+==== Cache ====
-==== Attachment storage ===
+Cache is used for reading configuration values. Value in cache is cleared by an active (save, delete) operation.
+In the application profile (application.properties):
+<code properties>
+# Disable cache
+# If you are debugging some of code and are you figuring, something is wrong with the cache, then you can turn the cache off with property.
+#spring.cache.type=none
+#
+# Clusterred cache settings
+#idm.sec.cache.terracota.url=localhost:9410,localhost:9420
+idm.sec.cache.terracota.resource.name=main
+idm.sec.cache.terracota.resource.pool.name=resource-pool
+# Size in MB
+idm.sec.cache.terracota.resource.pool.size=32
+</code>
+==== Attachment storage ====
 ''DefaultAttachmentManager'' stores binary files on file system. Binary files can be attached to any entity, which implements ''AttachableEntity'' interface, [[..:..:modules_rpt:dev:attachment_manager| read more]].
-In the application profile (application.properties) and overloadable via ''ConfigurationService''.
+In the application profile (application.properties):
+<code properties>
+# Max file size of uploaded file. Values can use the suffixed "MB" or "KB" to indicate a Megabyte or Kilobyte size.
+# Application server (e.g. Tomcat "maxSwallowSize" connector parameter) has to be set properly too (e.g. <Connector port="8080" maxSwallowSize="-1" ...)
+spring.servlet.multipart.max-file-size=100MB
+spring.servlet.multipart.max-request-size=100MB
+</code>
+In the application profile (application.properties) and overloadable via ''ConfigurationService'':
 <code properties>
@@ Line 217: / Line 253: @@
 # temporary file time to live in milliseconds
 # older temporary files will be purged, default 14 days
+# Temporary file is used mainly for upload files internaly. When upload is complete, then temporary file is moved into normal IdM attachment (~ temporary file is not reachable, after user session ends).
 idm.sec.core.attachment.tempTtl=1209600000
-#
-# Max file size of uploaded file. Values can use the suffixed "MB" or "KB" to indicate a Megabyte or Kilobyte size.
-multipart.max-file-size=1Mb
-</code>
-In the application profile (application.properties).
-<code properties>
-#
-# Max file size of uploaded file. Values can use the suffixed "MB" or "KB" to indicate a Megabyte or Kilobyte size.
-multipart.max-file-size=1Mb
 </code>
-==== Activiti workflow ===
+==== Activiti workflow ====
 <code properties>
 # String boot properties for Activiti workflow engine
@@ Line 270: / Line 294: @@
 # - recaptchaservice endpoint
 idm.sec.security.recaptcha.url=https://www.google.com/recaptcha/api/siteverify
-# - secret key, can be generated here https://www.google.com/recaptcha/admin
+# - secret key, can be generated here https://www.google.com/recaptcha/admin (generate V2 checkbox)
 # - test secret key: https://developers.google.com/recaptcha/docs/faq#id-like-to-run-automated-tests-with-recaptcha-v2-what-should-i-do
 idm.sec.security.recaptcha.secretKey=xxx
@@ Line 410: / Line 434: @@
 # When queueCapacity is full, then new threads are created from corePoolSize to maxPoolSize.
 scheduler.task.executor.maxPoolSize=
-# Waiting tasks to be processed. Uses {@code Integer.MAX_VALUE} as default. {@link LinkedBlockingQueue} is used for queue => capacity is initialized dynamically.
+# Waiting tasks to be processed. Uses 20 as default. {@link LinkedBlockingQueue} is used for queue => capacity is initialized dynamically.
-# {@link AbotrPolicy} is set for rejected tasks.
+# {@link AbotrPolicy} is set for rejected tasks - reject exception has to be processed by a caller ({@link LongRunningTaskManager}).
-scheduler.task.executor.queueCapacity=
+scheduler.task.executor.queueCapacity=20
 # Thread priority for threads in event executor pool - 5 by default (normal).
 scheduler.task.executor.threadPriority=
@@ Line 426: / Line 450: @@
 scheduler.event.executor.maxPoolSize=
 # Waiting events to be processed. Uses 50 as default - prevent to prepare events repetitively and use additional threads till maxPoolSize. {@link LinkedBlockingQueue} is used for queue => capacity is initialized dynamically.
-# {@link AbotrPolicy} is set for rejected tasks.
+# {@link AbotrPolicy} is set for rejected tasks - reject exception has to be processed by a caller ({@link EntityEventManager}).
 scheduler.event.executor.queueCapacity=50
 # Thread priority for threads in event executor pool - 6 by default (a little higher priority than normal 5).
@@ Line 445: / Line 469: @@
 # CUSTOM - users can choose for which accounts change password
 # Needed on FE (=> public)
-idm.pub.core.identity.passwordChange=ALL_ONLY
+idm.pub.core.identity.passwordChange=CUSTOM
 #
 # required old password for change password.
@@ Line 681: / Line 705: @@
 idm.sec.core.authentication-filter.core-sso-authentication-filter.forbidden-uids=
 </code>
+=== Remote user authentication filter ===
+Login into IdM by preset request remote user by servlet container can be configured with following properties:
+<code properties>
+# Allow remote user authentication
+idm.sec.core.authentication-filter.core-remote-user-authentication-filter.enabled=false
+# The suffixes to remove from the login - usually domains
+idm.sec.core.authentication-filter.core-remote-user-authentication-filter.uid-suffixes=
+# The uids that can't be authenticated by SSO
+idm.sec.core.authentication-filter.core-remote-user-authentication-filter.forbidden-uids=
+</code>
+This authentication filter reuses SSO authentication filter behavior above (''uid-suffixes'', ''forbidden-uids''), but application administrator can be logged by this filter (identity with ''APP_ADMIN'' authority).
 ==== Backup ====
@@ Line 718: / Line 755: @@
 idm.sec.vs.role.default=<some-code-of-role>
 </code>
+==== Long polling ====
+<code properties>
+# Long polling
+idm.pub.app.long-polling.enabled=true
+</code>
+You can disable long polling for all types of entites with use value `false`.
 ==== Provisioning ====
@@ Line 734: / Line 780: @@
 # - Default value is 'true'
 idm.sec.acc.provisioning.allowedAutoMappingOnExistingAccount=true
+# Default provisioning timeout in milis - every longer provisioning operations will ends with timeout exception (prevent to stuck running operations).
+# 3 minutes by default.
+# Timeout has to be configured >= 1000, otherwise default will be returned.
+idm.sec.acc.provisioning.timeout=180000
 </code>
@@ Line 822: / Line 873: @@
 Common configuration properties for all renderers:
   * ''enabled'' - on / off
+==== Logger ====
+In the application profile (''application.properties''):
+<code properties>
+# Show thread name configured by thread pools (task, event) in logs (generated name is shown otherwise)
+# Two appenders 'console' and 'file' are provided by product. Same configuration is needed for your custom appenders (added in logback.xml).
+logging.pattern.console=%d{yyyy-MM-dd HH:mm:ss.SSS} %5level %relative --- [%thread] %logger{36}.%M : %msg%n
+logging.pattern.file=%d{yyyy-MM-dd HH:mm:ss.SSS} %5level %relative --- [%thread] %logger{36}.%M : %msg%n
+</code>
+Logger levels can be configured programmatically (override ''logback.xml'' file with default logger levels configuration).
+In the application profile (''application.properties'') - overloadable via ''ConfigurationService'':
+<code properties>
+idm.sec.core.logger.<packageName>=<level>
+</code>
+Where ''<packageName>'' is package name to set logger ''<level>''.
+Example:
+<code properties>
+idm.sec.core.logger.eu.bcvsolutions=DEBUG
+</code>