-
Notifications
You must be signed in to change notification settings - Fork 77
/
spec
1408 lines (1372 loc) · 72.9 KB
/
spec
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
---
name: uaa
description: "The UAA is the identity management service for Cloud Foundry. It's primary role is as an OAuth2 provider, issuing tokens for client applications to use when they act on behalf of Cloud Foundry users. It can also authenticate users with their Cloud Foundry credentials, and can act as an SSO service using those credentials (or others). It has endpoints for managing user accounts and for registering OAuth2 clients, as well as various other management functions."
templates:
bin/uaa: bin/uaa
bin/configure_proxy.erb: bin/configure_proxy
bin/health_check.erb: bin/health_check
bin/pre-start.erb: bin/pre-start
bin/post-start: bin/post-start
bin/dns/healthy.erb: bin/dns/healthy
config/uaa.yml.erb: config/uaa.yml
config/bpm.yml.erb: config/bpm.yml
config/log4j2.properties.erb: config/log4j2.properties
config/ldap.crt.erb: config/ldap.crt
config/messages.properties.erb: config/messages.properties
config/uaa.crt.erb: config/uaa.crt
config/tomcat/tomcat.logging.properties: config/tomcat/logging.properties
config/tomcat/tomcat.server.xml.erb: config/tomcat/server.xml
config/tomcat/tomcat.context.xml.erb: config/tomcat/context.xml
bbr/pre-backup-lock.sh.erb: bin/bbr/pre-backup-lock
bbr/pre-restore-lock.sh.erb: bin/bbr/pre-restore-lock
bbr/post-backup-unlock.sh.erb: bin/bbr/post-backup-unlock
bbr/post-restore-unlock.sh: bin/bbr/post-restore-unlock
provides:
- name: uaa_db
type: uaa_db
properties:
- uaadb
- name: uaa_keys
type: uaa_keys
properties:
- encryption.active_key_label
- encryption.encryption_keys
consumes:
- name: router
type: http-router
optional: true
- name: database
type: database
optional: true
packages:
- uaa
properties:
uaa.rate_limiter:
config:
loggingOption:
description: "(optional) String (see Details)"
example: AllCallsWithDetails
credentialID:
description: "(optional) String (see Details)"
example: 'JWT:Claims+"email"\s*:\s*"(.*?)"'
limiterMappings.name:
description: "(required) String"
example: Info
limiterMappings.withCallerRemoteAddressID:
description: "(optional but) String - (see Window Type)"
example: 1r/s
limiterMappings.withCallerCredentialsID:
description: "(optional but) String - (see Window Type)"
example: 1r/s
limiterMappings.withoutCallerID:
description: "(optional but) String - (see Window Type)"
example: 1r/s
limiterMappings.global:
description: "(optional but) String - (see Window Type)"
example: 1r/s
limiterMappings.pathSelectors:
description: "(required non-empty) List of String(s) - (see Path Selector)"
example: "equals:/info"
encryption.encryption_keys:
description: "Map of key labels and encryption passphrases that will be used to create keys using a Key Derivation Function. All passphrase values must be at least 8 characters long."
example: |
- label: 'key-1'
passphrase: 'MY-PASSPHRASE'
- label: 'key-2'
passphrase: 'MY-PASSPHRASE-TWO'
encryption.active_key_label:
description: "The key label of the encryption passphrase that will be used to create the key using a Key Derivation Function for encrypting new data within the UAA database."
example: 'key-1'
#backup properties
release_level_backup:
description: "DEPRECATED: Do not use this property. Use the corresponding property in bbr-uaadb."
#uaa database host configuration
uaadb.address:
description: |
The UAA database IP address. If this property is not set, the UAA will look for a `database` link
and use the first instance address it can find in the list
uaadb.databases:
description: |
The list of databases used in UAA database including tag/name. The UAA will always look for the `uaa` tag
and use the database name from that tag
example:
- name: uaa
tag: uaa
uaadb.db_scheme:
description: "Database scheme for UAA DB. Supported schemes: postgres, mysql"
uaadb.port:
description: "The UAA database Port"
uaadb.tls:
description: |
Use TLS connection for UAA database.
Valid options are:
enabled (use TLS with full certificate validation),
enabled_skip_hostname_validation (use TLS but skip validation of common and alt names in the host certificate),
enabled_skip_all_validation (use TLS but do not validate anything about the host certificate),
disabled (do not use TLS)
The database's CA certificate required when TLS is enabled
should be added to the uaa.ca_certs configuration field.
default: enabled
uaadb.tls_protocols:
description: |
If using TLS, this property can be used to narrow down the protocols used
by the UAA database driver.
This option only takes effect when using `mysql` as `uaadb.db_scheme`.
The default is null, the database driver will pick the protocol to use.
The values can be comma separated.
PostgreSQL defaults to TLSv1.2 through the JDBC driver.
example: TLSv1.2,TLSv1.1
uaadb.roles:
description: |
The list of database Roles used in UAA database including tag/name/password
The UAA will always look for the tag `admin` and use the
`name` and `password` properties as the database credentials
example:
- name: uaa
password: database-password-for-user-uaa
tag: admin
# General server properties
uaa.catalina_opts:
description: "The options used to configure Tomcat"
default: -Xmx768m -XX:MaxMetaspaceSize=256m
uaa.localhost_http_port:
description: |
The port on which UAA will accept HTTP traffic from the localhost machine only.
Only used by monit to call the /healthz endpoint.
Either use default or set to another value in range [1024-65535].
This port must not conflict with other ports configured on this VM, such as uaa.ssl.port.
default: 8080
uaa.shutdown.sleep:
description: |
Used for draining connection during a graceful shutdown. When the UAA process receives a kill signal
it will delay the shutdown for the configured number of milliseconds. During this period,
the /healthz endpoint will return 503/stopping while all other endpoints continue to function.
default: 5000
uaa.url:
description: "The base url of the UAA"
uaa.zones.internal.hostnames:
description: |
A list of hostnames that are routed to the UAA, specifically the default zone in the UAA. The UAA will reject any Host headers that it doesn't recognize.
By default the UAA recognizes:
The hostname from the property uaa.url
The hostname from the property login.url
localhost (in order to accept health checks)
Any hostnames added as a list are additive to the default hostnames allowed.
example:
- hostname1
- hostname2.localhost
- hostname3.example.com
uaa.proxy_ips_regex:
description: |
A pipe delimited set of regular expressions of IP addresses that are considered reverse proxies.
When a request from these IP addresses come in, the x-forwarded-for and x-forwarded-proto headers will be respected.
default: 10\.\d{1,3}\.\d{1,3}\.\d{1,3}|192\.168\.\d{1,3}\.\d{1,3}|169\.254\.\d{1,3}\.\d{1,3}|127\.\d{1,3}\.\d{1,3}\.\d{1,3}|172\.1[6-9]{1}\.\d{1,3}\.\d{1,3}|172\.2[0-9]{1}\.\d{1,3}\.\d{1,3}|172\.3[0-1]{1}\.\d{1,3}\.\d{1,3}
uaa.proxy.servers:
description: "Array of the router IPs acting as the first group of HTTP/TCP backends. These will be added to the proxy_ips_regex as exact matches."
default: []
env.http_proxy:
description: "The value of the HTTP_PROXY environment variable across the VMs. It is the proxy URL used for all requests over http."
example: http://test.proxy:8080
env.https_proxy:
description: "The value of the HTTPS_PROXY environment variable across the VMs. It is the proxy URL used for all requests over https."
example: http://test.proxy:8080
env.no_proxy:
description: "The value of the NO_PROXY environment variable across the VMs. It is a comma-separated list of hostnames that should be excluded from proxying."
example: "localhost,127.0.0.0/8,127.0.1.1"
uaa.issuer:
description: "The url to use as the issuer URI"
uaa.logging_level:
description: Set UAA logging level. (e.g. TRACE, DEBUG, INFO)
default: DEBUG
uaa.logging.format.timestamp:
description: "Format for timestamp in component logs. Valid values are 'rfc3339', 'rfc3339-legacy', and 'deprecated'. 'rfc3339' sets the format to be {yyyy-MM-dd'T'HH:mm:ss.nnnnnn}{GMT+0}Z which is rfc3339 compliant but additionally has microsecond precision and is set to UTC timezone. 'rfc3339-legacy' sets the time format to be yyyy-MM-dd'T'HH:mm:ss.SSSXXX. 'deprecated' sets the time format to be yyyy-MM-dd HH:mm:ss.SSS."
default: rfc3339
uaa.limitedFunctionality.statusFile:
description: |
The UAA checks for the presence of this file. If this file exists, the UAA will continue to function
but in limited mode. This means any authentication or token action will continue to work, but more
API endpoints that change configuration will return 503 UNAVAILABLE.
Normally, there is no need to change this value, unless you have other scripts that may rely on it
default: /var/vcap/data/uaa/bbr_limited_mode.lock
uaa.limitedFunctionality.whitelist.endpoints:
description: "Set the whitelisted API for UAA in degraded mode. Methods and Endpoints are unioned with each other: i.e. all methods are permitted for a whitelisted endpoint, and all endpoints are permitted for a whitelisted method"
default:
- /oauth/authorize/**
- /oauth/token/**
- /check_token/**
- /login/**
- /login.do
- /logout/**
- /logout.do
- /saml/**
- /autologin/**
- /authenticate/**
- /idp_discovery/**
uaa.limitedFunctionality.whitelist.methods:
description: "Set the whitelisted API for UAA in degraded mode. Methods and Endpoints are unioned with each other: i.e. all methods are permitted for a whitelisted endpoint, and all endpoints are permitted for a whitelisted method"
default:
- GET
- HEAD
- OPTIONS
uaa.rest.template.timeout:
description: "Timeout for the RestTemplates used by the UAA in ms"
example: 10000
default: 10000
uaa.rest.template.maxTotal:
description: "Size of the connection pool used by the RestTemplates in the UAA"
example: 20
default: 20
uaa.rest.template.maxPerRoute:
description: "Maximum number of connections to the same route that is used by the RestTemplates in the UAA"
example: 5
default: 5
uaa.rest.template.maxKeepAlive:
description: "Maximum time in ms that the connections of the RestTemplates are kept alive in the UAA"
example: 0
default: 0
# SSL
login.protocol:
description: "Scheme to use for HTTP communication (http/https)"
default: https
uaa.ssl.port:
description: |
The port on which UAA will accept HTTPS traffic.
Either use default or set to another value in range [1024-65535].
This port must not conflict with other ports configured on this VM, such as uaa.localhost_http_port.
default: 8443
uaa.ssl.enabled_protocols:
description: |
The enabled protocols for ssl connection, accept comma seperated list of TLS versions,
for example TLSv1.2 or TLS1.3 or TLSv1.2,TLS1.3, default value TLSv1.2,TLSv1.3.
default: 'TLSv1.2,TLSv1.3'
uaa.ssl.ciphers:
description: |
The ciphers used for SSL connection, this parameter should match selected version from uaa.ssl.enabled_protocols.
Default ciphers contains ciphers can be used by TLSv1.2 and TLSv1.3: TLS_DHE_RSA_WITH_AES_128_GCM_SHA256,TLS_DHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_AES_128_GCM_SHA256,TLS_AES_256_GCM_SHA384
default: 'TLS_DHE_RSA_WITH_AES_128_GCM_SHA256,TLS_DHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_AES_128_GCM_SHA256,TLS_AES_256_GCM_SHA384'
uaa.ssl.protocol_header:
description: The header to look for to determine if ssl termination was performed by a front end load balancer.
default: x-forwarded-proto
uaa.ssl.port_header:
description: The header to look for to determine the port where ssl termination was performed by a front end load balancer.
default: X-Forwarded-Port
uaa.sslCertificate:
description: "The server's ssl certificate. The default is a self-signed certificate and should always be replaced for production deployments"
default: ''
example: |
-----BEGIN CERTIFICATE-----
MIIDAjCCAmugAwIBAgIJAJtrcBsKNfWDMA0GCSqGSIb3DQEBCwUAMIGZMQswCQYD
VQQGEwJVUzETMBEGA1UECAwKQ2FsaWZvcm5pYTEWMBQGA1UEBwwNU2FuIEZyYW5j
aXNjbzEQMA4GA1UECgwHUGl2b3RhbDERMA8GA1UECwwISWRlbnRpdHkxFjAUBgNV
BAMMDU1hcmlzc2EgS29hbGExIDAeBgkqhkiG9w0BCQEWEW1rb2FsYUBwaXZvdGFs
LmlvMB4XDTE1MDczMDE5Mzk0NVoXDTI1MDcyOTE5Mzk0NVowgZkxCzAJBgNVBAYT
AlVTMRMwEQYDVQQIDApDYWxpZm9ybmlhMRYwFAYDVQQHDA1TYW4gRnJhbmNpc2Nv
MRAwDgYDVQQKDAdQaXZvdGFsMREwDwYDVQQLDAhJZGVudGl0eTEWMBQGA1UEAwwN
TWFyaXNzYSBLb2FsYTEgMB4GCSqGSIb3DQEJARYRbWtvYWxhQHBpdm90YWwuaW8w
gZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAPVOIGvG8MFbkqi+ytdBHVbEGde4
jaCphmvGm89/4Ks0r+041VsS55XNYnHsxXTlh1FiB2KcbrDb33pgvuAIYpcAO2I0
gqGeRoS2hNsxzcFdkgSZn1umDAeoE4bCATrquN93KMcw/coY5jacUfb9P2CQztkS
e2o+QWtIaWYAvI3bAgMBAAGjUDBOMB0GA1UdDgQWBBTkEjA4CEjevAGfnPBciyXC
3v4zMzAfBgNVHSMEGDAWgBTkEjA4CEjevAGfnPBciyXC3v4zMzAMBgNVHRMEBTAD
AQH/MA0GCSqGSIb3DQEBCwUAA4GBAIEd8U32tkcvwG9qCOfe5raBENHM4ltTuhju
zZWIM5Ik1bFf6+rA71HVDD1Z5fRozidhMOl6mrrGShfu6VUjtqzctJeSjaOPIJL+
wvrXXcAkCYZ9QKf0sqlUWcIRy90nqrD5sL/rHAjNjxQ3lqIOj7yWOgty4LUzFQNr
FHiyd3T6
-----END CERTIFICATE-----
uaa.sslPrivateKey:
description: "The server's ssl private key. Only passphrase-less keys are supported"
default: ''
example: |
-----BEGIN RSA PRIVATE KEY-----
MIICXwIBAAKBgQD1TiBrxvDBW5KovsrXQR1WxBnXuI2gqYZrxpvPf+CrNK/tONVb
EueVzWJx7MV05YdRYgdinG6w2996YL7gCGKXADtiNIKhnkaEtoTbMc3BXZIEmZ9b
pgwHqBOGwgE66rjfdyjHMP3KGOY2nFH2/T9gkM7ZEntqPkFrSGlmALyN2wIDAQAB
AoGBAPBvfz+kYt5iz0EuoMqTPBqLY3kZn1fWUbbZmGatxJyKq9UsW5NE2FDwWomn
tXJ6d0PBfdOd2LDpEgZ1RSF5lobXn2m2+YeEso7A7yMiBRW8CIrkUn8wVA0s42t+
osElfvj73G2ZjCqQm6BLCjtFYnalmZIzfOCB26xRWaf0MJ7hAkEA/XaqnosJfmRp
kmvto81LEvjVVlSvpo+6rt66ykywEv9daHWZZBrrwVz3Iu4oXlwPuF8bcO8JMLRf
OH98T1+1PQJBAPfCj0r3fRhmBZMWqf2/tbeQPvIQzqSXfYroFgnKIKxVCV8Bkm3q
1rP4c0XDHEWYIwvMWBTOmVSZqfSxtwIicPcCQQDCcRqK7damo5lpvmpb0s3ZDBN9
WxI1EOYB6NQbBaG9sTGTRUQbS5u4hv0ASvulB7L3md6PUJEYUAcMbKCMs7txAkEA
7C8pwHJba0XebJB/bqkxxpKYntPM2fScNi32zFBGg2HxNANgnq3vDNN8t/U+X02f
oyCimvs0CgUOknhTmJJSkwJBAPaI298JxTnWncC3Zu7d5QYCJXjU403Aj4LdcVeI
6A15MzQdj5Hm82vlmpC4LzXofLjiN4E5ZLluzEw+1TjRE7c=
-----END RSA PRIVATE KEY-----
uaa.ca_certs:
description: "Array of CA certificates to load into the UAA's truststore"
example:
- |
-----BEGIN CERTIFICATE-----
MIIDAjCCAmugAwIBAgIJAJtrcBsKNfWDMA0GCSqGSIb3DQEBCwUAMIGZMQswCQYD
VQQGEwJVUzETMBEGA1UECAwKQ2FsaWZvcm5pYTEWMBQGA1UEBwwNU2FuIEZyYW5j
aXNjbzEQMA4GA1UECgwHUGl2b3RhbDERMA8GA1UECwwISWRlbnRpdHkxFjAUBgNV
BAMMDU1hcmlzc2EgS29hbGExIDAeBgkqhkiG9w0BCQEWEW1rb2FsYUBwaXZvdGFs
LmlvMB4XDTE1MDczMDE5Mzk0NVoXDTI1MDcyOTE5Mzk0NVowgZkxCzAJBgNVBAYT
AlVTMRMwEQYDVQQIDApDYWxpZm9ybmlhMRYwFAYDVQQHDA1TYW4gRnJhbmNpc2Nv
MRAwDgYDVQQKDAdQaXZvdGFsMREwDwYDVQQLDAhJZGVudGl0eTEWMBQGA1UEAwwN
TWFyaXNzYSBLb2FsYTEgMB4GCSqGSIb3DQEJARYRbWtvYWxhQHBpdm90YWwuaW8w
gZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAPVOIGvG8MFbkqi+ytdBHVbEGde4
jaCphmvGm89/4Ks0r+041VsS55XNYnHsxXTlh1FiB2KcbrDb33pgvuAIYpcAO2I0
gqGeRoS2hNsxzcFdkgSZn1umDAeoE4bCATrquN93KMcw/coY5jacUfb9P2CQztkS
e2o+QWtIaWYAvI3bAgMBAAGjUDBOMB0GA1UdDgQWBBTkEjA4CEjevAGfnPBciyXC
3v4zMzAfBgNVHSMEGDAWgBTkEjA4CEjevAGfnPBciyXC3v4zMzAMBgNVHRMEBTAD
AQH/MA0GCSqGSIb3DQEBCwUAA4GBAIEd8U32tkcvwG9qCOfe5raBENHM4ltTuhju
zZWIM5Ik1bFf6+rA71HVDD1Z5fRozidhMOl6mrrGShfu6VUjtqzctJeSjaOPIJL+
wvrXXcAkCYZ9QKf0sqlUWcIRy90nqrD5sL/rHAjNjxQ3lqIOj7yWOgty4LUzFQNr
FHiyd3T6
-----END CERTIFICATE-----
#Branding/Customization
login.branding.company_name:
description: This name is used on the UAA Pages and in account management related communication in UAA
login.branding.product_logo:
description: This is a base64 encoded PNG image which will be used as the logo on all UAA pages like Login, Sign Up etc.
login.branding.square_logo:
description: This is a base64 encoded PNG image which will be used as the favicon for the UAA pages
login.branding.footer_legal_text:
description: This text appears on the footer of all UAA pages
login.branding.footer_links:
description: These links appear on the footer of all UAA pages. You may choose to add multiple urls for things like Support, Terms of Service etc.
example:
linkDisplayName: linkDisplayUrl
login.branding.banner.logo:
description: This is a base64 encoded PNG image which will be used as the banner on the UAA discovery login page
login.branding.banner.text:
description: This is text that will be used in the banner area on the UAA discovery login page if no banner logo is configured
login.branding.banner.textColor:
description: This is the color to be used for banner text if banner text is defined to be used on the UAA discovery login page
login.branding.banner.backgroundColor:
description: This is the color to be used for the background of the banner area on the UAA discovery login page
login.branding.banner.link:
description: This is the link to be used for the banner logo or banner text on the UAA discovery login page
login.branding.consent.text:
description: This text appears on registration and invitation after the words `I agree to` alongside a checkbox that must be selected before the user can continue.
login.branding.consent.link:
description: If `login.branding.consent.text` is set, the text after `I agree to` will be hyperlinked to this location.
login.asset_base_url:
description: "Deprecated in favor of branding properties. Base url for static assets, allows custom styling of the login server. Use '/resources/pivotal' for Pivotal style."
default: /resources/oss
login.links:
description: "A hash of home/passwd/signup URLS (see commented examples below)"
login.links.global.passwd:
description: |
URL for requesting password reset. Displayed on the home page of the UAA.
This is set globally for all identity zones but can be overridden via Identity Zone API.
The links also support two variables: {zone.id} and {zone.subdomain}
default: '/forgot_password'
example: https://{zone.subdomain}.myaccountmanager.domain.com/z/{zone.id}/forgot_password
login.links.global.signup:
description: |
URL for requesting to signup/register for an account
This is set globally for all identity zones but can be overridden via Identity Zone API.
The links also support two variables: {zone.id} and {zone.subdomain}
default: '/create_account'
example: https://{zone.subdomain}.myaccountmanager.domain.com/z/{zone.id}/create_account
login.links.global.homeRedirect:
description: |
Landing URL after successful authentication via UI
This is set globally for all identity zones but can be overridden via Identity Zone API.
The links also support two variables: {zone.id} and {zone.subdomain}
default: '/'
example: https://{zone.subdomain}.myaccountmanager.domain.com/z/{zone.id}/success
login.links.passwd:
description: URL for requesting password reset for the default zone
default: '/forgot_password'
login.links.signup:
description: URL for requesting to signup/register for an account
default: '/create_account'
login.links.homeRedirect:
description: Landing URL after successful authentication via UI
default: '/'
login.home_redirect:
description: Deprecated. May 09, 2017. Please use login.links.homeRedirect
login.self_service_links_enabled:
description: "Enable self-service account creation and password resets links."
default: true
login.messages:
description: |
A nested or flat hash of messages that the login server uses to display UI message
This will be flattened into a java.util.Properties file. The example below will lead
to four properties, where the key is the concatenated value delimited by dot, for example scope.tokens.read=message
example:
messages:
scope:
tokens:
read: View details of your approvals you have granted to this and other applications
write: Cancel the approvals like this one that you have granted to this and other applications
scope.tokens.read: View details of your approvals you have granted to this and other applications
scope.tokens.write: Cancel the approvals like this one that you have granted to this and other applications
login.logout.redirect.url:
description: "The Location of the redirect header following a logout of the the UAA (/login)."
default: /login
login.logout.redirect.parameter.disable:
description: "Deprecated as of v52/uaa-4.7.0. Value ignored. Value is always false. Will be removed in the future."
default: false
login.logout.redirect.parameter.whitelist:
description: "A list of URLs that are accepted and honored as values to the `/logout.do?redirect` parameter . If a redirect parameter value is not white listed, redirect will be to the default URL, /login or to the value of uaa.login.logout.redirect.url if set."
login.prompt.username.text:
description: "The text used to prompt for a username during login"
default: Email
login.prompt.password.text:
description: "The text used to prompt for a password during login"
default: Password
login.idpDiscoveryEnabled:
description: "IDP Discovery should be set to true if you have configured more than one identity provider for UAA. The discovery relies on email domain being set for each additional provider. This property will also enable a list of selectable accounts that have signed in via the browser."
default: false
login.accountChooserEnabled:
description: "This flag enables the account choosing functionality. If idpDiscoveryEnabled is set to true in the config the IDP is chosen by discovery. Otherwise, the user can enter the IDP by providing the origin."
default: false
login.defaultIdentityProvider:
description: "This value can be set to the origin key of an identity provider. If set, the user will be directed to this identity provider automatically if no other identity provider is discovered or selected via login_hint. When not set, legacy chained authentication (where uaa is attempted first followed by ldap) is used."
example: uaa
default: null
login.aliasEntitiesEnabled:
description: |
Enable the creation, update and deletion of identity providers and users with an alias. The alias feature enables
the synchronization of an identity provider or user entity between a custom identity zone and the "uaa" zone (its
"alias"). By this, the entity can be managed in an isolated custom identity zone while still being effective for
other components that only operate on the "uaa" zone, e.g. the CF Cloud Controller. An entity and its alias
reference each other through the properties "aliasId" (ID of the alias) and "aliasZid" (ID of the zone containing
the alias). Note that existing entities with an alias will not be removed when deactivating the flag. Instead, the
creation, update and deletion of identity providers and users with an alias is prohibited.
default: false
# Email
login.notifications.url:
description: "The url for the notifications service (configure to use Notifications Service instead of SMTP server)"
login.smtp:
description: "SMTP server configuration, for password reset emails etc."
login.smtp.host:
description: "SMTP server host address"
default: localhost
login.smtp.port:
description: "SMTP server port"
default: 2525
login.smtp.user:
description: "SMTP server username"
login.smtp.password:
description: "SMTP server password"
login.smtp.from_address:
description: "SMTP from address"
login.smtp.auth:
description: "If true, authenticate using AUTH command. https://javamail.java.net/nonav/docs/api/com/sun/mail/smtp/package-summary.html"
default: false
login.smtp.starttls:
description: "If true, send STARTTLS command before login to server. https://javamail.java.net/nonav/docs/api/com/sun/mail/smtp/package-summary.html"
default: false
login.smtp.sslprotocols:
description: "If set, specifies the SSL protocols that will be enabled for SSL connections. The property value is a whitespace separated list of tokens. https://javamail.java.net/nonav/docs/api/com/sun/mail/smtp/package-summary.html"
default: TLSv1.2
# Delete actions
uaa.delete:
description: |
Contains a map of actions, each with a list of IDs.
Possible delete actions are 'identityProviders', 'users' and 'clients'.
Identity providers are identified by their alias
These will be deleted in the default (`uaa`) zone.
Unrecognized map keys will be ignored.
If the ID exists both in the delete and create sections
the delete section takes preceden
example: |
clients:
- client-to-be-deleted-1
- client-to-be-deleted-2
users:
- user-to-be-deleted-1
- user-to-be-deleted-2
identityProviders:
- octa
- google
# client secret policy
uaa.client.secret.policy:
description: "The client secret policy for clients in the default zone."
example:
uaa:
client:
secret:
policy:
minLength: 0
maxLength: 255
requireUpperCaseCharacter: 0
requireLowerCaseCharacter: 0
requireDigit: 0
requireSpecialCharacter: 0
uaa.client.secret.policy.minLength:
description: "Minimum number of characters required for secret to be considered valid (defaults to 0)."
uaa.client.secret.policy.maxLength:
description: "Maximum number of characters required for secret to be considered valid (defaults to 255)."
uaa.client.secret.policy.requireUpperCaseCharacter:
description: "Minimum number of uppercase characters required for secret to be considered valid (defaults to 0)."
uaa.client.secret.policy.requireLowerCaseCharacter:
description: "Minimum number of lowercase characters required for secret to be considered valid (defaults to 0)."
uaa.client.secret.policy.requireDigit:
description: "Minimum number of digits required for secret to be considered valid (defaults to 0)."
uaa.client.secret.policy.requireSpecialCharacter:
description: "Minimum number of special characters required for secret to be considered valid (defaults to 0)."
uaa.client.secret.policy.global:
description: "The global client secret policy for clients in a zone. If the zone doesn't have a client secret policy, this one will be used."
example:
uaa:
client:
secret:
policy:
global:
minLength: 0
maxLength: 255
requireUpperCaseCharacter: 0
requireLowerCaseCharacter: 0
requireDigit: 0
requireSpecialCharacter: 0
uaa.client.secret.policy.global.minLength:
description: "Minimum number of characters required for secret to be considered valid (defaults to 0)."
uaa.client.secret.policy.global.maxLength:
description: "Maximum number of characters required for secret to be considered valid (defaults to 255)."
uaa.client.secret.policy.global.requireUpperCaseCharacter:
description: "Minimum number of uppercase characters required for secret to be considered valid (defaults to 0)."
uaa.client.secret.policy.global.requireLowerCaseCharacter:
description: "Minimum number of lowercase characters required for secret to be considered valid (defaults to 0)."
uaa.client.secret.policy.global.requireDigit:
description: "Minimum number of digits required for secret to be considered valid (defaults to 0)."
uaa.client.secret.policy.global.requireSpecialCharacter:
description: "Minimum number of special characters required for secret to be considered valid (defaults to 0)."
# Global client redirect URI configuration
uaa.client.redirect_uri.matching_mode:
description: |
When set to `legacy`, allow unsafe matching of redirect URIs.
For example, https://example.com would also match all subdomains and all paths of https://example.com.
When set to `exact`, will provide OAuth2 spec-compliant (RFC6749) exact redirect URI matching.
default: legacy
# Clients
uaa.clients:
description: |
List of OAuth2 clients that the UAA will be bootstrapped with.
These will be created in the default (`uaa`) zone.
example:
login:
id: login
override: true
secret: some-secret
authorized-grant-types: authorization_code,client_credentials,refresh_token
authorities: test_resource.test_action
scope: test_resource.test_action
redirect-uri: http://login.example.com
autoapprove: true
app-launch-url: http://myloginpage.com
show-on-homepage: true
app-icon: iVBORw0KGgoAAAANSUhEUgAAABAAAAAQCAMAAAAoLQ9TAAAAD1BMVEWZttQvMDEoKisqKywAAAApvvoVAAAAGElEQVQYlWNgYUQBLAxMDCiAeXgLoHsfAD03AHOyfqy1AAAAAElFTkSuQmCC
app:
id: app
override: true
secret: app-secret
authorized-grant-types: authorization_code,client_credentials,refresh_token
authorities: test_resource.test_action
scopes: # overrides anything present in 'scope' property
- test_resource.test_action
- test_resource.other_action
redirect-uri: http://login.example.com
autoapprove:
- test_resource.test_action
- test_resource.other_action
app-launch-url: http://myapppage.com
show-on-homepage: true
app-icon: iVBORw0KGgoAAAANSUhEUgAAABAAAAAQCAMAAAAoLQ9TAAAAD1BMVEWZttQvMDEoKisqKywAAAApvvoVAAAAGElEQVQYlWNgYUQBLAxMDCiAeXgLoHsfAD03AHOyfqy1AAAAAElFTkSuQmCC
uaa.admin.client_secret:
description: "Secret of the admin client - a client named admin with uaa.admin as an authority"
uaa.authentication.enable_uri_encoding_compatibility_mode:
description: "When enabled basic auth credentials will only be URI decoded when the `X-CF-ENCODED-CREDENTIALS` header is set to `true`"
default: false
# Security policies (for the UAA zone)
uaa.authentication.policy.lockoutAfterFailures:
description: "Number of allowed failures before account is locked"
default: 5
uaa.authentication.policy.countFailuresWithinSeconds:
description: "Number of seconds in which lockoutAfterFailures failures must occur in order for account to be locked"
default: 1200
uaa.authentication.policy.lockoutPeriodSeconds:
description: "Number of seconds to lock out an account when lockoutAfterFailures failures is exceeded"
default: 300
uaa.password.policy.minLength:
description: "Minimum number of characters required for password to be considered valid"
default: 0
uaa.password.policy.maxLength:
description: "Maximum number of characters required for password to be considered valid"
default: 255
uaa.password.policy.requireUpperCaseCharacter:
description: "Minimum number of uppercase characters required for password to be considered valid"
default: 0
uaa.password.policy.requireLowerCaseCharacter:
description: "Minimum number of lowercase characters required for password to be considered valid"
default: 0
uaa.password.policy.requireDigit:
description: "Minimum number of digits required for password to be considered valid"
default: 0
uaa.password.policy.requireSpecialCharacter:
description: "Minimum number of special characters required for password to be considered valid"
default: 0
uaa.password.policy.expirePasswordInMonths:
description: "Number of months after which current password expires"
default: 0
uaa.disableInternalAuth:
description: "Disables internal user authentication"
default: false
uaa.disableInternalUserManagement:
description: "Disables UI and API for internal user management"
default: false
uaa.user.authorities:
description: "Contains a list of the default authorities/scopes assigned to a user"
default:
- openid
- scim.me
- cloud_controller.read
- cloud_controller.write
- cloud_controller_service_permissions.read
- password.write
- uaa.user
- approvals.me
- oauth.approvals
- notification_preferences.read
- notification_preferences.write
- profile
- roles
- user_attributes
- uaa.offline_token
uaa.jwt.queryString.enabled:
default: true
description: "If set to true, the /oauth/token and /check_token endpoints accept GET and query string parameters"
uaa.jwt.revocable:
default: false
description: "Set to true if you wish that even JWT tokens become individually revocable and stored in the UAA token storage. This setting applies to the default zone only."
uaa.jwt.policy.accessTokenValiditySeconds:
default: 43200
description: "The access token validity for the default zone if nothing is configured on the client. Will override global validity policies for the default zone only."
uaa.jwt.policy.refreshTokenValiditySeconds:
default: 2592000
description: "The refresh token validity for the default zone if nothing is configured on the client. Will override global validity policies for the default zone only."
uaa.jwt.policy.active_key_id:
description: "The ID of the JWT signing key to be used when signing tokens."
example: "key-1"
uaa.jwt.policy.keys:
description: "Map of key IDs and signing keys, each defined with a property `signingKey`."
example:
key-1:
signingKey: |
-----BEGIN RSA PRIVATE KEY-----
MIICXgIBAAKBgQDfTLadf6QgJeS2XXImEHMsa+1O7MmIt44xaL77N2K+J/JGpfV3
AnkyB06wFZ02sBLB7hko42LIsVEOyTuUBird/3vlyHFKytG7UEt60Fl88SbAEfsU
JN1i1aSUlunPS/NCz+BKwwKFP9Ss3rNImE9Uc2LMvGy153LHFVW2zrjhTwIDAQAB
AoGBAJDh21LRcJITRBQ3CUs9PR1DYZPl+tUkE7RnPBMPWpf6ny3LnDp9dllJeHqz
a3ACSgleDSEEeCGzOt6XHnrqjYCKa42Z+Opnjx/OOpjyX1NAaswRtnb039jwv4gb
RlwT49Y17UAQpISOo7JFadCBoMG0ix8xr4ScY+zCSoG5v0BhAkEA8llNsiWBJF5r
LWQ6uimfdU2y1IPlkcGAvjekYDkdkHiRie725Dn4qRiXyABeaqNm2bpnD620Okwr
sf7LY+BMdwJBAOvgt/ZGwJrMOe/cHhbujtjBK/1CumJ4n2r5V1zPBFfLNXiKnpJ6
J/sRwmjgg4u3Anu1ENF3YsxYabflBnvOP+kCQCQ8VBCp6OhOMcpErT8+j/gTGQUL
f5zOiPhoC2zTvWbnkCNGlqXDQTnPUop1+6gILI2rgFNozoTU9MeVaEXTuLsCQQDC
AGuNpReYucwVGYet+LuITyjs/krp3qfPhhByhtndk4cBA5H0i4ACodKyC6Zl7Tmf
oYaZoYWi6DzbQQUaIsKxAkEA2rXQjQFsfnSm+w/9067ChWg46p4lq5Na2NpcpFgH
waZKhM1W0oB8MX78M+0fG3xGUtywTx0D4N7pr1Tk2GTgNw==
-----END RSA PRIVATE KEY-----
uaa.jwt.signing_key:
description: "Deprecated. Use uaa.jwt.policy.keys. The key used to sign the JWT-based OAuth2 tokens."
uaa.jwt.verification_key:
description: "Deprecated. The key used to verify JWT-based OAuth2 tokens. If you are specifying your signing key(s) under uaa.jwt.policy.keys, the verification key does not need to be specified."
uaa.jwt.claims.exclude:
description: "List of claims to exclude from the JWT-based OAuth2 tokens."
example:
- authorities
uaa.jwt.refresh.restrict_grant:
description: "Disallows refresh-token grant for any client for which the user has not approved the `uaa.offline_token` scope"
default: false
uaa.jwt.refresh.unique:
description: "Revokes existing refresh tokens for client-user combination when creating a new refresh token. Note: only applies if `uaa.jwt.revocable` is true."
default: false
uaa.jwt.refresh.rotate:
description: "Rotate refresh tokens. Invalidate the existing one and issue a new refresh token when processing refresh token flow."
default: false
uaa.jwt.refresh.format:
description: "The format for the refresh token. Allowed values are `jwt`, `opaque`"
default: jwt
# cors settings
uaa.cors.default.allowed.headers:
description: "whitelist for allowed headers for non-xhr cors requests"
default: ~
uaa.cors.default.allowed.origin:
description: "whitelist for allowed origins for non-xhr cors requests"
default: ~
uaa.cors.default.allowed.uris:
description: "whitelist for allowed uris for non-xhr cors requests"
default: ~
uaa.cors.default.allowed.methods:
description: "whitelist for allowed methods for non-xhr cors requests"
default: ~
uaa.cors.default.allowed.credentials:
description: "whether to allow credentials to be sent over non-xhr cors requests"
default: ~
uaa.cors.default.max_age:
description: "how long the results of a preflight request is cached"
default: ~
uaa.cors.xhr.allowed.headers:
description: "whitelist for allowed headers for xhr cors requests"
default: ~
uaa.cors.xhr.allowed.origin:
description: "whitelist for allowed origins for xhr cors requests"
default: ~
uaa.cors.xhr.allowed.uris:
description: "whitelist for allowed uris for xhr cors requests"
default: ~
uaa.cors.xhr.allowed.methods:
description: "whitelist for allowed methods for xhr cors requests"
default: ~
uaa.cors.xhr.allowed.credentials:
description: "whether to allow credentials to be sent over xhr cors requests"
default: ~
uaa.cors.xhr.max_age:
description: "how long the results of a preflight request is cached"
default: ~
# Content Security Policy (csp) settings
uaa.csp.script-src:
description: "Overrides the default script-src CSP header value of 'self'. Set this to allow scripts to be loaded from sources besides UAA. Because this overrides (not appends to) the value, be sure to include an entry for 'self' so scripts from UAA are allowed."
default:
- "'self'"
example:
- "'self'"
- "'unsafe-inline'"
- "js.example.com"
# Global security policies (for all zones)
uaa.authentication.policy.global.lockoutAfterFailures:
description: "Number of allowed failures before account is locked"
default: 5
uaa.authentication.policy.global.countFailuresWithinSeconds:
description: "Number of seconds in which lockoutAfterFailures failures must occur in order for account to be locked"
default: 3600
uaa.authentication.policy.global.lockoutPeriodSeconds:
description: "Number of seconds to lock out an account when lockoutAfterFailures failures is exceeded"
default: 300
uaa.password.policy.global.minLength:
description: "Minimum number of characters required for password to be considered valid"
default: 0
uaa.password.policy.global.maxLength:
description: "Maximum number of characters required for password to be considered valid"
default: 255
uaa.password.policy.global.requireUpperCaseCharacter:
description: "Minimum number of uppercase characters required for password to be considered valid"
default: 0
uaa.password.policy.global.requireLowerCaseCharacter:
description: "Minimum number of lowercase characters required for password to be considered valid"
default: 0
uaa.password.policy.global.requireDigit:
description: "Minimum number of digits required for password to be considered valid"
default: 0
uaa.password.policy.global.requireSpecialCharacter:
description: "Minimum number of special characters required for password to be considered valid"
default: 0
uaa.password.policy.global.expirePasswordInMonths:
description: "Number of months after which current password expires"
default: 0
uaa.jwt.policy.global.accessTokenValiditySeconds:
default: 43200
description: "The global access token validity for all zones if nothing is configured on the client"
uaa.jwt.policy.global.refreshTokenValiditySeconds:
default: 2592000
description: "The global refresh token validity for all zones if nothing is configured on the client"
# Scim properties
uaa.scim.user.override:
description: "If true, override users defined in uaa.scim.users found in the database."
default: true
uaa.scim.userids_enabled:
description: "Enables the endpoint `/ids/Users` that allows consumers to translate user ids to name"
default: true
uaa.scim.users:
description: |
A list of users to be bootstrapped with authorities.
These will be created in the default (`uaa`) zone.
Each entry supports the following format:
Short OpenStruct:
- name: username
password: password
groups:
- group1
- group2
Long OpenStruct:
- name: username
password: password
groups:
- group1
- group2
firstName: first name
lastName: lastName
email: email
origin: origin-value - most commonly uaa
example:
- name: marissa
password: koala
email: marissa@test.org
firstName: Marissa
lastName: Bloggs
groups:
- group_name
origin: uaa
uaa.scim.external_groups:
description: |
External group mappings. Either formatted as an OpenStruct.
As an OpenStruct, the mapping additionally specifies an origin to which the mapping is applied:
origin1:
external_group1:
- internal_group1
- internal_group2
- internal_group3
external_group2:
- internal_group2
- internal_group4
origin2:
external_group3:
- internal_group3
- internal_group4
- internal_group5
uaa.scim.groups:
description: |
Contains a hash of group names and their descriptions. These groups will be added to the UAA database for the default zone but not associated with any user.
Example:
uaa:
scim:
groups:
my-test-group: 'My test group description'
another-group: 'Another group description'
# probably belongs in uaadb instead
uaa.database.additionalParameters:
description: "Additional parameters that should be added to the url that is used to connect to the database. Boolean values need to be passed as String."
example:
tcpKeepAlive: "true"
usePipelineAuth: "false"
# connection pool properties
uaa.database.max_connections:
description: "The max number of open connections to the DB from a running UAA instance"
default: 100
uaa.database.max_idle_connections:
description: "The max number of open idle connections to the DB from a running UAA instance"
default: 10
uaa.database.min_idle_connections:
description: "The min number of open idle connections to the DB from a running UAA instance"
default: 0
uaa.database.remove_abandoned:
description: "True if connections that are left open longer then abandoned_timeout seconds during a session(time between borrow and return from pool) should be forcibly closed"
default: false
uaa.database.abandoned_timeout:
description: "Timeout in seconds for the longest running queries. Take into DB migrations for this timeout as they may run during a long period of time."
default: 300
uaa.database.log_abandoned:
description: "Should connections that are forcibly closed be logged."
default: true
uaa.database.case_insensitive:
description: "Set to true if you don't want to be using LOWER() SQL functions in search queries/filters, because you know that your DB is case insensitive. If this property is null, then it will be set to true if the UAA DB is MySQL and false otherwise, but even on MySQL you can override it by setting it explicitly to false"
uaa.database.test_while_idle:
description: "If true, connections will be validated by the idle connection evictor (if any). If the validation fails, the connection is destroyed and removed from the pool."
default: false
# LDAP
uaa.ldap.enabled:
description: "Set to true to enable LDAP"
default: false
uaa.ldap.override:
description: |
If the LDAP configuration has `override: false` set, the LDAP values will only be stored
in the database if the LDAP has not been configured yet.
If property is omitted, the default is override: true
uaa.ldap.profile_type:
description: "The file to be used for configuring the LDAP authentication. Options are: 'simple-bind', 'search-and-bind', 'search-and-compare'"
default: search-and-bind
uaa.ldap.url:
description: "The URL to the ldap server, must start with ldap:// or ldaps://. Allows multiple server URLs to be specified for failover purpose, space separated."
example: ldap://localhost:389 ldaps://secure.host:636
uaa.ldap.userDNPattern:
description: "Used with simple-bind only. A semi-colon separated lists of DN patterns to construct a DN direct from the user ID without performing a search."
uaa.ldap.userDNPatternDelimiter:
description: "The delimiter character in between user DN patterns for simple-bind authentication"
default: ";"
uaa.ldap.userDN:
description: "Used with search-and-bind and search-and-compare. A valid LDAP ID that has read permissions to perform a search of the LDAP tree for user information. "
uaa.ldap.userPassword:
description: "Used with search-and-bind and search-and-compare. Password for the LDAP ID that performs a search of the LDAP tree for user information."
uaa.ldap.searchBase:
description: "Used with search-and-bind and search-and-compare. Define a base where the search starts at."
default: ""
uaa.ldap.searchFilter:
description: "Used with search-and-bind and search-and-compare. Search filter used. Takes one parameter, user ID defined as {0}"
default: "cn={0}"
uaa.ldap.passwordAttributeName:
description: "Used with search-and-compare only. The name of the password attribute in the LDAP directory"
default: "userPassword"
uaa.ldap.localPasswordCompare:
description: "Used with search-and-compare only. Set to true if passwords are retrieved by the search, and should be compared in the login server."
default: "true"
uaa.ldap.passwordEncoder:
description: "Used with search-and-compare only. The encoder used to properly encode user password to match the one in the LDAP directory."
default: "org.cloudfoundry.identity.uaa.ldap.DynamicPasswordComparator"
uaa.ldap.sslCertificate:
description: "Used with ldaps:// URLs. The certificate, if self signed, to be trusted by this connection."
uaa.ldap.ssl.skipverification:
description: "Set to true, and LDAPS connection will not validate the server certificate."
default: false
uaa.ldap.ssl.tls:
description: "If using StartTLS, what mode to enable. Default is none, not enabled. Possible values are none, simple"
default: none
uaa.ldap.mailAttributeName:
description: "The name of the LDAP attribute that contains the users email address"
default: mail
uaa.ldap.mailSubstitute:
description: "Defines an email pattern containing a {0} to generate an email address for an LDAP user during authentication"
default: ''
uaa.ldap.mailSubstituteOverridesLdap:
description: "Set to true if you wish to override an LDAP user email address with a generated one"
default: false
uaa.ldap.referral:
description: |
Configures the UAA LDAP referral behavior. The following values are possible:
- follow -> Referrals are followed
- ignore -> Referrals are ignored and the partial result is returned
- throw -> An error is thrown and the authentication is aborted
Reference: http://docs.oracle.com/javase/jndi/tutorial/ldap/referral/jndi.html
default: follow
uaa.ldap.groups.profile_type:
description: "What type of group integration should be used. Values are: 'no-groups', 'groups-as-scopes', 'groups-map-to-scopes'"
default: "no-groups"
uaa.ldap.groups.searchBase:
description: "Search start point for a user group membership search, and sequential nested searches.. You can set this value to 'memberOf' when using Active Directory and skip group search but use the calculated memberOf field on the user records. No nested search will be performed."
default: ""
uaa.ldap.groups.groupRoleAttribute:
description: "Used with groups-as-scopes, defines the attribute that holds the scope name(s)."
default: spring.security.ldap.dn
uaa.ldap.groups.groupSearchFilter:
description: "Search query filter to find the groups a user belongs to, or for a nested search, groups that a group belongs to"
default: "member={0}"
uaa.ldap.groups.searchSubtree:
description: "Boolean value, set to true to search below the search base"
default: "true"
uaa.ldap.groups.maxSearchDepth:
description: "Set to number of levels a nested group search should go. Set to 1 to disable nested groups (default)"
default: "1"
uaa.ldap.emailDomain:
description: "Sets the whitelist of emails domains that the LDAP identity provider handles"
example:
- whitelist-domain1.org
- whitelist-domain2.org
uaa.ldap.attributeMappings:
description: "Specifies how UAA user attributes map to LDAP attributes. given_name, family_name, and phone_number are UAA user attributes, while other attributes should be included using the prefix `user.attribute`"
example:
given_name: givenName
family_name: sn
phone_number: telephoneNumber
user.attribute.name-of-attribute-in-uaa-id-token: name-of-attribute-in-ldap-record
user.attribute.name-of-other-attribute-in-uaa-id-token: name-of-other-attribute-in-ldap-record
uaa.ldap.storeCustomAttributes:
description: "Stores custom attribute mappings from the attributeMappings configuration in the database so that they can be retrieved using the /userinfo endpoint"
default: true
uaa.ldap.externalGroupsWhitelist:
description: "Whitelist of external groups from LDAP that get added as roles in the ID Token"
example:
- admin
- user
uaa.ldap.add_shadow_user_on_login:
description: "If set to false, only users pre-populated in the UAA user database will be allowed to authenticate via LDAP. If set to true, any user from LDAP will be allowed to authenticate and an internal user will be created if one does not yet exist."
default: true
# OpenID Connect/OAuth