Configuration Metadata

Default user name.

Password for the default user name.

Granted roles for the default user name.

JAAS login resource file.

The login context name should coincide with a given index in the login config specified. This name is used as the index to the configuration specified in the login config property.

 JAASTest { org.springframework.security.authentication.jaas.TestLoginModule required; }; 

If set, a call to Configuration#refresh() will be made by #configureJaas(Resource) method.

Base DN to use. There may be scenarios where different parts of a single LDAP tree could be considered as base-dns. Rather than duplicating the LDAP configuration block for each individual base-dn, each entry can be specified and joined together using a special delimiter character. The user DN is retrieved using the combination of all base-dn and DN resolvers in the order defined. DN resolution should fail if multiple DNs are found. Otherwise the first DN found is returned. Usual syntax is: subtreeA,dc=example,dc=net|subtreeC,dc=example,dc=net.

The bind credential to use when connecting to LDAP.

The LDAP url to the server. More than one may be specified, separated by space and/or comma.

User filter to use for searching. Syntax is cn={user} or cn={0}.

You may also provide an external groovy script in the syntax of file:/path/to/GroovyScript.groovy to fully build the final filter template dynamically.

Whether search/query results are allowed to match on multiple DNs, or whether a single unique DN is expected for the result.

Set if multiple Entries are allowed.

Indicate the collection of attributes that are to be tagged and processed as binary attributes by the underlying search resolver.

The length of time the pool will block. By default the pool will block indefinitely and there is no guarantee that waiting threads will be serviced in the order in which they made their request. This option should be used with a blocking connection pool when you need to control the exact number of connections that can be created

Sets the maximum amount of time that connects will block.

Whether to use a pooled connection factory in components.

Specify the dn format accepted by the AD authenticator, etc. Example format might be uid=%s,ou=people,dc=example,dc=org.

Whether specific search entry resolvers need to be set on the authenticator, or the default should be used.

Attempt to populate the connection pool early on startup and fail quickly if something goes wrong.

Set if search referrals should be followed.

Removes connections from the pool based on how long they have been idle in the available queue. Prunes connections that have been idle for more than the indicated amount.

Path to the keystore used for SSL connections. Typically contains SSL certificates for the LDAP server.

Keystore password.

The type of keystore. PKCS12 or JKS. If left blank, defaults to the default keystore type indicated by the underlying Java platform.

Indicate whether the LDAP search query is allowed to return multiple entries.

Base DN to start the search.

Attribute expected to be found on the entry resulting from the group search whose value is going to be used to construct roles. The final value is always prefixed with #groupPrefix. This is useful in scenarios where you wish to grant access to a resource to all users who a member of a given group.

Base DN to start the search looking for groups.

Search filter to begin looking for groups.

A prefix that is prepended to the group attribute value to construct an authorized role.

Attribute expected to be found on the entry whose value is going to be used to construct roles. The final value is always prefixed with #rolePrefix. This is useful in scenarios where you wish to grant access to a resource to all users who carry a special attribute.

Prefix for the role.

LDAP search filter to locate accounts.

Maximum LDAP connection pool size which the pool can use to grow.

Minimum LDAP connection pool size. Size the pool should be initialized to and pruned to

Name of the LDAP handler.

Request that the server return results in batches of a specific size. See RFC 2696. This control is often used to work around server result size limits. A negative/zero value disables paged requests.

If principalAttributePassword is empty then a user simple bind is done to validate credentials otherwise the given attribute is compared with the given principalAttributePassword using the SHA encrypted value of it.

For the anonymous authentication type, if principalAttributePassword is empty then a user simple bind is done to validate credentials otherwise the given attribute is compared with the given principalAttributePassword using the SHA encrypted value of it.

Removes connections from the pool based on how long they have been idle in the available queue. Run the pruning process at the indicated interval.

If this attribute is set, the value found in the first attribute value will be used in place of the DN.

Duration of time to wait for responses.

SASL authorization id.

The SASL mechanism.

Whether SASL mutual authentication is enabled.

SASL quality of protected.

The SASL realm.

SASL security strength.

Search handlers.

The Attribute name case change.

The Attribute names.

The Attribute value case change.

The Dn case change.

The Add if exists.

The Dn attribute name.

The Attribute names.

The Merge attribute name.

The Base dn.

The Group filter.

The Merge attributes.

The Search attribute.

The default referral limit.

The default referral limit.

Whether subtree searching is allowed.

Path of the trust certificates to use for the SSL connection. Ignores keystore-related settings when activated and used.

Path to the keystore used to determine which certificates or certificate authorities should be trusted. Used when connecting to an LDAP server via LDAPS or startTLS connection. If left blank, the default truststore for the Java runtime is used.

Password needed to open the truststore.

The type of trust keystore that determines which certificates or certificate authorities are trusted. Types depend on underlying java platform, typically PKCS12 or JKS. If left blank, defaults to the default keystore type indicated by the underlying Java platform.

Whether TLS should be used and enabled when establishing the connection.

Whether connections should be validated when loaned out from the pool.

Period at which pool should be validated.

Whether connections should be validated periodically when the pool is idle.

Period at which validation operations may time out.

Attribute name to use for the compare validator.

Attribute values to use for the compare validator.

Base DN to use for the search request of the search validator.

DN to compare to use for the compare validator.

Search scope to use for the search request of the search validator.

Search filter to use for the search request of the search validator.

Determine the LDAP validator type.

The JDBC driver used to connect to the database.

The database connection password.

The encoding algorithm to use such as MD5. Relevant when the type used is DEFAULT or GLIBC_CRYPT. When used with PasswordEncoderTypes#PBKDF2, it should be one of PBKDF2WithHmacSHA1, PBKDF2WithHmacSHA256 or PBKDF2WithHmacSHA512.

Define the password encoder type to use. Type may be specified as blank or NONE to disable password encoding. It may also refer to a fully-qualified class name that implements the Spring Security's PasswordEncoder interface if you wish you define your own encoder.

The database connection URL.

The database user.

The database user must have sufficient permissions to be able to handle schema changes and updates, when needed.

The default auto-commit behavior of connections in the pool. Determined whether queries such as update/insert should be immediately executed without waiting for an underlying transaction.

A non-zero value enables use of JDBC2 batch updates by Hibernate. e.g. recommended values between 5 and 30.

Indicates the maximum number of milliseconds that the service can wait to obtain a connection.

Attempts to do a JNDI data source look up for the data source name specified. Will attempt to locate the data source object as is.

Note that during a version migration where any schema has changed create-drop will result in the loss of all data as soon as CAS is started. For transient data like tickets this is probably not an issue, but in cases like the audit table important data could be lost. Using `update`, while safe for data, is confirmed to result in invalid database state. validate or none settings are likely the only safe options for production use.

For more info, see this.

Qualifies unqualified table names with the given catalog in generated SQL.

Qualify unqualified table names with the given schema/tablespace in generated SQL.

The database dialect is a configuration setting for platform independent software (JPA, Hibernate, etc) which allows such software to translate its generic SQL statements into vendor specific DDL, DML.

Used to specify number of rows to be fetched in a select query.

Allow hibernate to generate query statistics.

The SQL query to be executed to test the validity of connections. This is for "legacy" databases that do not support the JDBC4 Connection.isValid() API.

Controls the maximum amount of time that a connection is allowed to sit idle in the pool.

This property determines whether data source isolates internal pool queries, such as the connection alive test, in their own transaction.

Since these are typically read-only queries, it is rarely necessary to encapsulate them in their own transaction. This property only applies if #autocommit is disabled.

Defines the isolation level for transactions. @see org.springframework.transaction.TransactionDefinition

Controls the amount of time that a connection can be out of the pool before a message is logged indicating a possible connection leak.

The encoding algorithm to use such as 'UTF-8'. Relevant when the type used is DEFAULT.

When used by PasswordEncoderTypes#ARGON2, it indicates the hash strength/length.

When used by PasswordEncoderTypes#PBKDF2, it indicates the required number of iterations.

Secret to use with PasswordEncoderTypes#STANDARD, PasswordEncoderTypes#PBKDF2, PasswordEncoderTypes#BCRYPT, PasswordEncoderTypes#GLIBC_CRYPT password encoders. Secret usually is an optional setting.

Strength or number of iterations to use for password hashing. Usually relevant when dealing with PasswordEncoderTypes#BCRYPT, PasswordEncoderTypes#PBKDF2 or PasswordEncoderTypes#GLIBC_CRYPT. When used by PasswordEncoderTypes#ARGON2 or PasswordEncoderTypes#PBKDF2, it indicates the salt strength.

Fully-qualified name of the class that can control the physical naming strategy of hibernate.

This property controls the keepalive interval for a connection in the pool. An in-use connection will never be tested by the keepalive thread, only when it is idle will it be tested. Default is zero, which disables this feature.

Controls the maximum number of connections to keep in the pool, including both idle and in-use connections.

Sets the maximum time in seconds that this data source will wait while attempting to connect to a database.

A value of zero specifies that the timeout is the default system timeout if there is one; otherwise, it specifies that there is no timeout.

This property controls the maximum lifetime of a connection in the pool. When a connection reaches this timeout, even if recently used, it will be retired from the pool. An in-use connection will never be retired, only when it is idle will it be removed.

Controls the minimum size that the pool is allowed to reach, including both idle and in-use connections.

Set the name of the connection pool. This is primarily used for the MBean to uniquely identify the pool configuration.

Whether or not pool suspension is allowed.

There is a performance impact when pool suspension is enabled. Unless you need it (for a redundancy system for example) do not enable it.

The maximum number of milliseconds that the pool will wait for a connection to be validated as alive.

Defines the propagation behavior for transactions. @see org.springframework.transaction.TransactionDefinition

Additional settings provided by Hibernate (or the connection provider) in form of key-value pairs.

Query to execute in order to authenticate users via JDBC. Example: SELECT username,password,enabled FROM users WHERE username=?

Configures the Connections to be added to the pool as read-only Connections.

Prefix to add to the role.

The location of the resource. Resources can be URLs, or files found either on the classpath or outside somewhere in the file system.

In the event the configured resource is a Groovy script, especially if the script is set to reload on changes, you may need to adjust the total number of inotify instances. On Linux, you may need to add the following line to /etc/sysctl.conf: fs.inotify.max_user_instances = 256.

You can check the current value via cat /proc/sys/fs/inotify/max_user_instances.

In situations and scenarios where CAS is able to automatically watch the underlying resource for changes and detect updates and modifications dynamically, you may be able to specify the following setting as either an environment variable or system property with a value of false to disable the resource watcher: org.apereo.cas.util.io.PathWatcherService.