uaa job from cf/231
The UAA is the identity management service for Cloud Foundry. It's primary role is as an OAuth2 provider, issuing tokens for client applications to use when they act on behalf of Cloud Foundry users. It can also authenticate users with their Cloud Foundry credentials, and can act as an SSO service using those credentials (or others). It has endpoints for managing user accounts and for registering OAuth2 clients, as well as various other management functions.
Github source:
f67ebb73 or
master branch
Properties¶
domain¶
Deprecated. Use uaa.url for setting the location of UAA
env¶
http_proxy¶The http_proxy across the VMs
https_proxy¶The https_proxy across the VMs
no_proxy¶Set No_Proxy across the VMs
- Example
login¶
analytics¶
code¶Google analytics code. If Google Analytics is desired set both login.analytics.code and login.analytics.domain
domain¶Google analytics domain. If Google Analytics is desired set both login.analytics.code and login.analytics.domain
asset_base_url¶Base url for static assets, allows custom styling of the login server. Use ‘/resources/pivotal’ for Pivotal style.
- Default
branding¶
company_name¶This name is used on the UAA Pages and in account management related communication in UAA
footer_legal_text¶This text appears on the footer of all UAA pages
footer_links¶These links appear on the footer of all UAA pages. You may choose to add multiple urls for things like Support, Terms of Service etc.
- Example
product_logo¶This is a base64 encoded PNG image which will be used as the logo on all UAA pages like Login, Sign Up etc.
square_logo¶This is a base64 encoded PNG image which will be used as the favicon for the UAA pages
entity_id¶Deprecated. Use login.saml.entityid
home_redirect¶URL for configuring a custom home page
invitations_enabled¶Allows users to send invitations to email addresses outside the system and invite them to create an account. Disabled by default.
ldap¶
localPasswordCompare¶Deprecated. Use uaa.ldap.localPasswordCompare - login.ldap prefix is used for backwards compatibility to enable ldap from login config
- Default
passwordAttributeName¶Deprecated. Use uaa.ldap.passwordAttributeName - login.ldap prefix is used for backwards compatibility to enable ldap from login config
- Default
passwordEncoder¶Deprecated. Use uaa.ldap.passwordEncoder - login.ldap prefix is used for backwards compatibility to enable ldap from login config
- Default
profile_type¶Deprecated. Use uaa.ldap.profile_type - login.ldap prefix is used for backwards compatibility to enable ldap from login config
searchBase¶Deprecated. Use uaa.ldap.searchBase - login.ldap prefix is used for backwards compatibility to enable ldap from login config
- Default
searchFilter¶Deprecated. Use uaa.ldap.searchFilter - login.ldap prefix is used for backwards compatibility to enable ldap from login config
- Default
cn={0}
sslCertificate¶Deprecated. Use uaa.ldap.sslCertificate - login.ldap prefix is used for backwards compatibility to enable ldap from login config
sslCertificateAlias¶Deprecated. Use uaa.ldap.sslCertificateAlias - login.ldap prefix is used for backwards compatibility to enable ldap from login config
url¶Deprecated. Use uaa.ldap.url - login.ldap prefix is used for backwards compatibility to enable ldap from login config
userDN¶Deprecated. Use uaa.ldap.userDN - login.ldap prefix is used for backwards compatibility to enable ldap from login config
userDNPattern¶Deprecated. Use uaa.ldap.userDNPattern - login.ldap prefix is used for backwards compatibility to enable ldap from login config
userPassword¶Deprecated. Use uaa.ldap.userPassword - login.ldap prefix is used for backwards compatibility to enable ldap from login config
links¶A hash of home/passwd/signup URLS (see commented examples below)
passwd¶URL for requesting password reset
- Default
signup¶URL for requesting to signup/register for an account
- Default
logout¶
redirect¶
parameter¶disable¶When set to false, this allows an operator to leverage an open redirect on the UAA (/logout.do?redirect=google.com). No open redirect enabled
- Default
whitelist¶A list of URLs. When this list is non null, including empty, and disable=false, logout redirects are allowed, but limited to the whitelist URLs. If a redirect parameter value is not white listed, redirect will be to the default URL.
url¶The Location of the redirect header following a logout of the the UAA (/logout.do).
- Default
messages¶A nested or flat hash of messages that the login server uses to display UI message This will be flattened into a java.util.Properties file. The example below will lead to four properties, where the key is the concatenated value delimited by dot, for example scope.tokens.read=message
- Example
messages: scope: tokens: read: View details of your approvals you have granted to this and other applications write: Cancel the approvals like this one that you have granted to this and other applications scope.tokens.read: View details of your approvals you have granted to this and other applications scope.tokens.write: Cancel the approvals like this one that you have granted to this and other applications
notifications¶
url¶The url for the notifications service (configure to use Notifications Service instead of SMTP server)
prompt¶
password¶
text¶The text used to prompt for a password during login
- Default
username¶
text¶The text used to prompt for a username during login
- Default
protocol¶Scheme to use for HTTP communication (http/https)
- Default
saml¶
assertionConsumerIndex¶Deprecated. Use login.saml.providers list objects
- Default
entity_base_url¶The URL for which SAML identity providers will post assertions to. If set it overrides the default. This URL should NOT have the schema (http:// or https:// prefix in it) instead just the hostname. The schema is derived by #{login.protocol} property. The default value is #{uaa.url}.replaceFirst(‘uaa’,‘login’), typically login.example.com The UAA will display this link in the cf –sso call if there is a SAML provider enabled.
entityid¶This is used as the SAML Service Provider Entity ID. Each
idpEntityAlias¶Deprecated. Use login.saml.providers list objects
idpMetadataURL¶Deprecated. Use login.saml.providers list objects
idp_metadata_file¶Deprecated. Use login.saml.providers list objects
metadataTrustCheck¶Deprecated. Use login.saml.providers list objects
- Default
nameidFormat¶Deprecated. Use login.saml.providers list objects
- Default
providers¶Contains a hash of SAML Identity Providers, the key is the IDP Alias, followed by key/value pairs. To learn more about how to setup a saml identity provider go to https://simplesamlphp.org
- Example
serviceProviderCertificate¶Service provider certificate.
- Example
serviceProviderKey¶Private key for the service provider certificate.
- Example
serviceProviderKeyPassword¶Password to protect the service provider private key.
- Example
signMetaData¶Global property to sign Local/SP metadata
- Default
signRequest¶Global property to sign Local/SP requests
- Default
socket¶
connectionManagerTimeout¶Timeout in milliseconds for connection pooling for SAML metadata HTTP requests
- Default
soTimeout¶Read timeout in milliseconds for SAML metadata HTTP requests
- Default
wantAssertionSigned¶Global property to request that external IDPs sign their SAML assertion before sending them to the UAA
- Default
self_service_links_enabled¶Enable self-service account creation and password resets links.
signups_enabled¶Deprecated. Use login.self_service_links_enabled. Instructs UAA to use ‘enable account creation flow’. Enabled by default.
- Default
smtp¶SMTP server configuration, for password reset emails etc.
host¶SMTP server host address
- Default
password¶SMTP server password
port¶SMTP server port
- Default
user¶SMTP server username
spring_profiles¶Deprecated. Use uaa.ldap.enabled - login.spring_profiles is used for backwards compatibility to enable ldap from login config
tiles¶A list of links to other services to show on the landing page after log in.
uaa_base¶Deprecated. Use uaa.url for setting the location of UAA.
url¶Set if you have an external login server. The UAA uses this link on by its email service to create links The UAA uses this as a base domain for internal hostnames so that subdomain can be detected This defaults to the uaa.url property, and if not set, to login.
uaa¶
admin¶
client_secret¶Secret of the admin client - a client named admin with uaa.admin as an authority
authentication¶
policy¶
countFailuresWithinSeconds¶Number of seconds in which lockoutAfterFailures failures must occur in order for account to be locked
- Default
global¶countFailuresWithinSeconds¶Number of seconds in which lockoutAfterFailures failures must occur in order for account to be locked
- Default
lockoutAfterFailures¶Number of allowed failures before account is locked
- Default
lockoutPeriodSeconds¶Number of seconds to lock out an account when lockoutAfterFailures failures is exceeded
- Default
lockoutAfterFailures¶Number of allowed failures before account is locked
- Default
lockoutPeriodSeconds¶Number of seconds to lock out an account when lockoutAfterFailures failures is exceeded
- Default
catalina_opts¶The options used to configure Tomcat
- Default
client¶
autoapprove¶Deprecated
- Default
clients¶List of OAuth2 clients that the UAA will be bootstrapped with
- Example
database¶
abandoned_timeout¶Timeout in seconds for the longest running queries. Take into DB migrations for this timeout as they may run during a long period of time.
- Default
case_insensitive¶Set to true if you don’t want to be using LOWER() SQL functions in search queries/filters, because you know that your DB is case insensitive. If this property is null, then it will be set to true if the UAA DB is MySQL and false otherwise, but even on MySQL you can override it by setting it explicitly to false
log_abandoned¶Should connections that are forcibly closed be logged.
- Default
max_connections¶The max number of open connections to the DB from a running UAA instance
- Default
max_idle_connections¶The max number of open idle connections to the DB from a running UAA instance
- Default
remove_abandoned¶True if connections that are left open longer then abandoned_timeout seconds during a session(time between borrow and return from pool) should be forcibly closed
- Default
disableInternalAuth¶Disables internal user authentication
- Default
disableInternalUserManagement¶Disables UI and API for internal user management
- Default
dump_requests¶When set to true dumps UAA requests to uaa.log
- Default
issuer¶The url to use as the issuer URI
jwt¶
claims¶
exclude¶List of claims to exclude from the JWT-based OAuth2 tokens
- Example
policy¶
accessTokenValiditySeconds¶The access token validity for the default zone if nothing is configured on the client. Will override global validity policies for the default zone only.
- Default
global¶accessTokenValiditySeconds¶The global access token validity for all zones if nothing is configured on the client
- Default
refreshTokenValiditySeconds¶The global refresh token validity for all zones if nothing is configured on the client
- Default
keys¶Map of key ids to key pairs (signing and verification keys)
- Example
key-1: signingKey: |+ -----BEGIN RSA PRIVATE KEY----- MIICXgIBAAKBgQDfTLadf6QgJeS2XXImEHMsa+1O7MmIt44xaL77N2K+J/JGpfV3 AnkyB06wFZ02sBLB7hko42LIsVEOyTuUBird/3vlyHFKytG7UEt60Fl88SbAEfsU JN1i1aSUlunPS/NCz+BKwwKFP9Ss3rNImE9Uc2LMvGy153LHFVW2zrjhTwIDAQAB AoGBAJDh21LRcJITRBQ3CUs9PR1DYZPl+tUkE7RnPBMPWpf6ny3LnDp9dllJeHqz a3ACSgleDSEEeCGzOt6XHnrqjYCKa42Z+Opnjx/OOpjyX1NAaswRtnb039jwv4gb RlwT49Y17UAQpISOo7JFadCBoMG0ix8xr4ScY+zCSoG5v0BhAkEA8llNsiWBJF5r LWQ6uimfdU2y1IPlkcGAvjekYDkdkHiRie725Dn4qRiXyABeaqNm2bpnD620Okwr sf7LY+BMdwJBAOvgt/ZGwJrMOe/cHhbujtjBK/1CumJ4n2r5V1zPBFfLNXiKnpJ6 J/sRwmjgg4u3Anu1ENF3YsxYabflBnvOP+kCQCQ8VBCp6OhOMcpErT8+j/gTGQUL f5zOiPhoC2zTvWbnkCNGlqXDQTnPUop1+6gILI2rgFNozoTU9MeVaEXTuLsCQQDC AGuNpReYucwVGYet+LuITyjs/krp3qfPhhByhtndk4cBA5H0i4ACodKyC6Zl7Tmf oYaZoYWi6DzbQQUaIsKxAkEA2rXQjQFsfnSm+w/9067ChWg46p4lq5Na2NpcpFgH waZKhM1W0oB8MX78M+0fG3xGUtywTx0D4N7pr1Tk2GTgNw== -----END RSA PRIVATE KEY----- verificationKey: |+ -----BEGIN PUBLIC KEY----- MIICXgIBAAKBgQDfTLadf6QgJeS2XXImEHMsa+1O7MmIt44xaL77N2K+J/JGpfV3 AnkyB06wFZ02sBLB7hko42LIsVEOyTuUBird/3vlyHFKytG7UEt60Fl88SbAEfsU JN1i1aSU -----END PUBLIC KEY-----
refreshTokenValiditySeconds¶The refresh token validity for the default zone if nothing is configured on the client. Will override global validity policies for the default zone only.
- Default
signing_key¶The key used to sign the JWT-based OAuth2 tokens
verification_key¶The key used to verify JWT-based OAuth2 tokens
ldap¶
attributeMappings¶Specifies how UAA user attributes map to LDAP attributes. given_name, family_name, and phone_number are UAA user attributes, while other attributes should be included using the prefix
user.attribute
- Example
emailDomain¶Sets the whitelist of emails domains that the LDAP identity provider handles
enabled¶Set to true to enable LDAP
- Default
externalGroupsWhitelist¶Whitelist of external groups from LDAP that get added as roles in the ID Token
- Example
groups¶
autoAdd¶Set to true when profile_type=groups_as_scopes to auto create scopes for a user. Ignored for other profiles.
- Default
groupRoleAttribute¶Used with groups-as-scopes, defines the attribute that holds the scope name(s).
groupSearchFilter¶Search query filter to find the groups a user belongs to, or for a nested search, groups that a group belongs to
- Default
member={0}
maxSearchDepth¶Set to number of levels a nested group search should go. Set to 1 to disable nested groups (default)
- Default
profile_type¶What type of group integration should be used. Values are: ‘no-groups’, ‘groups-as-scopes’, ‘groups-map-to-scopes’
- Default
searchBase¶Search start point for a user group membership search
- Default
searchSubtree¶Boolean value, set to true to search below the search base
- Default
localPasswordCompare¶Used with search-and-compare only. Set to true if passwords are retrieved by the search, and should be compared in the login server.
- Default
mailAttributeName¶The name of the LDAP attribute that contains the users email address
- Default
mailSubstitute¶Defines an email pattern containing a {0} to generate an email address for an LDAP user during authentication
- Default
mailSubstituteOverridesLdap¶Set to true if you wish to override an LDAP user email address with a generated one
- Default
passwordAttributeName¶Used with search-and-compare only. The name of the password attribute in the LDAP directory
- Default
passwordEncoder¶Used with search-and-compare only. The encoder used to properly encode user password to match the one in the LDAP directory.
- Default
profile_type¶The file to be used for configuring the LDAP authentication. Options are: ‘simple-bind’, ‘search-and-bind’, ‘search-and-compare’
- Default
referral¶Configures the UAA LDAP referral behavior. The following values are possible: - follow -> Referrals are followed - ignore -> Referrals are ignored and the partial result is returned - throw -> An error is thrown and the authentication is aborted Reference: http://docs.oracle.com/javase/jndi/tutorial/ldap/referral/jndi.html
- Default
searchBase¶Used with search-and-bind and search-and-compare. Define a base where the search starts at.
- Default
searchFilter¶Used with search-and-bind and search-and-compare. Search filter used. Takes one parameter, user ID defined as {0}
- Default
cn={0}
sslCertificate¶Used with ldaps:// URLs. The certificate, if self signed, to be trusted by this connection.
sslCertificateAlias¶Used with ldaps:// URLs. The certificate alias, to be trusted by this connection and stored in the keystore.
url¶The URL to the ldap server, must start with ldap:// or ldaps://
userDN¶Used with search-and-bind and search-and-compare. A valid LDAP ID that has read permissions to perform a search of the LDAP tree for user information.
userDNPattern¶Used with simple-bind only. A semi-colon separated lists of DN patterns to construct a DN direct from the user ID without performing a search.
userDNPatternDelimiter¶The delimiter character in between user DN patterns for simple-bind authentication
- Default
userPassword¶Used with search-and-bind and search-and-compare. Password for the LDAP ID that performs a search of the LDAP tree for user information.
logging_level¶Set UAA logging level. (e.g. TRACE, DEBUG, INFO)
- Default
logging_use_rfc3339¶Sets the time format for log messages to be yyyy-MM-dd’T’HH:mm:ss.SSSXXX instead of yyyy-MM-dd HH:mm:ss.SSS
- Default
login¶
client_secret¶Default login client secret, if no login client is defined
newrelic¶To enable newrelic monitoring, the sub element of this property will be placed in a configuration file called newrelic.yml in the jobs config directory. The syntax that must adhere to documentation in https://docs.newrelic.com/docs/agents/java-agent/configuration/java-agent-configuration-config-file The JVM option -javaagent:/path/to/newrelic.jar will be added to Apache Tomcat’s startup script The enablement of the NewRelic agent in the UAA is triggered by the property uaa.newrelic.common.license_key The property uaa.newrelic.common.license_key must be set!
password¶
policy¶
expirePasswordInMonths¶Number of months after which current password expires
- Default
global¶expirePasswordInMonths¶Number of months after which current password expires
- Default
maxLength¶Maximum number of characters required for password to be considered valid
- Default
minLength¶Minimum number of characters required for password to be considered valid
- Default
requireDigit¶Minimum number of digits required for password to be considered valid
- Default
requireLowerCaseCharacter¶Minimum number of lowercase characters required for password to be considered valid
- Default
requireSpecialCharacter¶Minimum number of special characters required for password to be considered valid
- Default
requireUpperCaseCharacter¶Minimum number of uppercase characters required for password to be considered valid
- Default
maxLength¶Maximum number of characters required for password to be considered valid
- Default
minLength¶Minimum number of characters required for password to be considered valid
- Default
requireDigit¶Minimum number of digits required for password to be considered valid
- Default
requireLowerCaseCharacter¶Minimum number of lowercase characters required for password to be considered valid
- Default
requireSpecialCharacter¶Minimum number of special characters required for password to be considered valid
- Default
requireUpperCaseCharacter¶Minimum number of uppercase characters required for password to be considered valid
- Default
port¶Port that uaa will accept connections on
- Default
proxy¶
servers¶Array of the router IPs acting as the first group of HTTP/TCP backends. These will be added to the proxy_ips_regex as exact matches. When using spiff, these will be router_z1 and router_z2 static IPs from cf-jobs.yml
- Default
proxy_ips_regex¶A pipe delimited set of regular expressions of IP addresses that are considered reverse proxies. When a request from these IP addresses come in, the x-forwarded-for and x-forwarded-proto headers will be respected. If the uaa.restricted_ips_regex is set, it will be appended to this list for backwards compatibility purposes If spiff has been used and includes templates/cf-jobs.yml to generate the manifest. This list will automatically contain the Router IP addresses
- Default
10\.\d{1,3}\.\d{1,3}\.\d{1,3}|192\.168\.\d{1,3}\.\d{1,3}|169\.254\.\d{1,3}\.\d{1,3}|127\.\d{1,3}\.\d{1,3}\.\d{1,3}|172\.1[6-9]{1}\.\d{1,3}\.\d{1,3}|172\.2[0-9]{1}\.\d{1,3}\.\d{1,3}|172\.3[0-1]{1}\.\d{1,3}\.\d{1,3}
require_https¶Request came in on a secure connection. Expect the load balancer/proxy to set the proper headers (x-forwarded-for, x-forwarded-proto)
- Default
restricted_ips_regex¶A pipe delimited set of regular expressions of IP addresses that can reach the listening HTTP port of the server.
- Default
10\.\d{1,3}\.\d{1,3}\.\d{1,3}|192\.168\.\d{1,3}\.\d{1,3}|169\.254\.\d{1,3}\.\d{1,3}|127\.\d{1,3}\.\d{1,3}\.\d{1,3}|172\.1[6-9]{1}\.\d{1,3}\.\d{1,3}|172\.2[0-9]{1}\.\d{1,3}\.\d{1,3}|172\.3[0-1]{1}\.\d{1,3}\.\d{1,3}
scim¶
external_groups¶A list of external group mappings. Pipe delimited. A value may look as ‘- internal.read|cn=developers,ou=scopes,dc=test,dc=com’
groups¶Contains a hash of group names and their descriptions. These groups will be added to the UAA database for the default zone but not associated with any user. Example: uaa: scim: groups: my-test-group: ‘My test group description’ another-group: ‘Another group description’ Deprecated format(still supported, but may be removed in the future): Comma separated list of groups that should be added to the UAA db, but not assigned to a user by default.
user¶
override¶If true override users defined in uaa.scim.users found in the database.
- Default
userids_enabled¶Enables the endpoint
/ids/Usersthat allows consumers to translate user ids to name
- Default
users¶A list of users to be bootstrapped with authorities. Each entry supports the following format: Short Pipe: username|password|comma,separated,groups Long Pipe: username|password|email|firstName|lastName|comma,separated,groups|origin Short OpenStruct: - name: username password: password groups: - group1 - group2 Long OpenStruct: - name: username password: password groups: - group1 - group2 firstName: first name lastName: lastName email: email origin: origin-value - most commonly uaa
- Example
spring_profiles¶Deprecated. Use ‘uaa.ldap.enabled’ instead. Sets the Spring profiles on the UAA web application. This gets combined with the ‘uaadb.db_scheme’ property if and only if the value is exactly ‘ldap’ in order to setup the database, for example ‘ldap,mysql’. If spring_profiles contains more than just ‘ldap’ it will be used to overwrite spring_profiles and db_scheme ignored. See uaa.yml.erb.
ssl¶
port¶If this property Tomcat will listen to this port and expect https traffic. If null, tomcat will not listen to this port
- Default
sslCertificate¶The server’s ssl certificate. The default is a self-signed certificate and should always be replaced for production deployments
- Example
sslPrivateKey¶The server’s ssl private key. Only passphrase-less keys are supported
- Example
url¶The base url of the UAA
user¶
authorities¶Contains a list of the default authorities/scopes assigned to a user
- Default
zones¶
internal¶
hostnames¶A list of hostnames that are routed to the UAA, specifically the default zone in the UAA. The UAA will reject any Host headers that it doesn’t recognize. By default the UAA recognizes: The hostname from the property uaa.url The hostname from the property login.url localhost (in order to accept health checks) Any hostnames added as a list are additive to the default hostnames allowed.
- Example
uaadb¶
address¶The UAA database IP address
databases¶The list of databases used in UAA database including tag/name
db_scheme¶Database scheme for UAA DB
port¶The UAA database Port
roles¶The list of database Roles used in UAA database including tag/name/password
Templates¶
Templates are rendered and placed onto corresponding
instances during the deployment process. This job's templates
will be placed into /var/vcap/jobs/uaa/ directory
(learn more).
bin/dns_health_check(fromdns_health_check.erb)bin/install_crt(frominstall_crt)bin/install_uaa_crt(frominstall_uaa_crt)bin/uaa_ctl(fromuaa_ctl.erb)config/ldap.crt(fromldap.crt.erb)config/log4j.properties(fromlog4j.properties.erb)config/login.yml(fromlogin.yml.erb)config/messages.properties(frommessages.properties.erb)config/newrelic.yml(fromnewrelic.yml.erb)config/tomcat/logging.properties(fromtomcat.logging.properties)config/tomcat/server.xml(fromtomcat.server.xml.erb)config/uaa.crt(fromuaa.crt.erb)config/uaa.yml(fromuaa.yml.erb)config/varz.log4j.properties(fromvarz.log4j.properties)config/varz.yml(fromvarz.yml)
Packages¶
Packages are compiled and placed onto corresponding
instances during the deployment process. Packages will be
placed into /var/vcap/packages/ directory.