OpenMetadata/conf/openmetadata-security.yaml

#  Copyright 2021 Collate
#  Licensed under the Apache License, Version 2.0 (the "License");
#  you may not use this file except in compliance with the License.
#  You may obtain a copy of the License at
#  http://www.apache.org/licenses/LICENSE-2.0
#  Unless required by applicable law or agreed to in writing, software
#  distributed under the License is distributed on an "AS IS" BASIS,
#  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
#  See the License for the specific language governing permissions and
#  limitations under the License.

swagger:
  resourcePackage: org.openmetadata.catalog.resources

server:
  rootPath: "/api/*"
  applicationConnectors:
    - type: http
      port: ${SERVER_PORT:-8585}
  adminConnectors:
    - type: http
      port: ${SERVER_ADMIN_PORT:-8586}

# Above configuration for running http is fine for dev and testing.
# For production setup, where UI app will hit apis through DPS it
# is strongly recommended to run https instead. Note that only
# keyStorePath and keyStorePassword are mandatory properties. Values
# for other properties are defaults
#server:
#applicationConnectors:
#  - type: https
#    port: 8585
#    keyStorePath: ./conf/keystore.jks
#    keyStorePassword: changeit
#    keyStoreType: JKS
#    keyStoreProvider:
#    trustStorePath: /path/to/file
#    trustStorePassword: changeit
#    trustStoreType: JKS
#    trustStoreProvider:
#    keyManagerPassword: changeit
#    needClientAuth: false
#    wantClientAuth:
#    certAlias: <alias>
#    crlPath: /path/to/file
#    enableCRLDP: false
#    enableOCSP: false
#    maxCertPathLength: (unlimited)
#    ocspResponderUrl: (none)
#    jceProvider: (none)
#    validateCerts: true
#    validatePeers: true
#    supportedProtocols: SSLv3
#    supportedCipherSuites: TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256
#    allowRenegotiation: true
#    endpointIdentificationAlgorithm: (none)

#adminConnectors:
#  - type: https
#    port: 8586
#    keyStorePath: ./conf/keystore.jks
#    keyStorePassword: changeit
#    keyStoreType: JKS
#    keyStoreProvider:
#    trustStorePath: /path/to/file
#    trustStorePassword: changeit
#    trustStoreType: JKS
#    trustStoreProvider:
#    keyManagerPassword: changeit
#    needClientAuth: false
#    wantClientAuth:
#    certAlias: <alias>
#    crlPath: /path/to/file
#    enableCRLDP: false
#    enableOCSP: false
#    maxCertPathLength: (unlimited)
#    ocspResponderUrl: (none)
#    jceProvider: (none)
#    validateCerts: true
#    validatePeers: true
#    supportedProtocols: SSLv3
#    supportedCipherSuites: TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256
#    allowRenegotiation: true
#    endpointIdentificationAlgorithm: (none)

# Logging settings.
# https://logback.qos.ch/manual/layouts.html#conversionWord
logging:
  level: DEBUG
  loggers:
    org.openmetadata.catalog.common: DEBUG
    org.openmetadata.catalog.security: DEBUG
    io.swagger: ERROR
  appenders:
    - type: file
      threshold: TRACE
      logFormat: "%level [%d{HH:mm:ss.SSS}] [%t] %logger{5} - %msg %n"
      currentLogFilename: ./logs/catalog.log
      archivedLogFilenamePattern: ./logs/catalog-%d{yyyy-MM-dd}-%i.log.gz
      archivedFileCount: 7
      timeZone: UTC
      maxFileSize: 50MB

database:
  # the name of the JDBC driver, mysql in our case
  driverClass: com.mysql.cj.jdbc.Driver
  # the username and password
  user: ${MYSQL_USER:-openmetadata_user}
  password: ${MYSQL_USER_PASSWORD:-openmetadata_password}
  # the JDBC URL; the database is called openmetadata_db
  url: jdbc:mysql://${MYSQL_HOST:-localhost}/${MYSQL_DATABASE:-openmetadata_db}?allowPublicKeyRetrieval=true&useSSL=false&serverTimezone=UTC

migrationConfiguration:
  path: "./bootstrap/sql/mysql"

# Authorizer Configuration
authorizerConfiguration:
  className: "org.openmetadata.catalog.security.DefaultAuthorizer"
  # JWT Filter
  containerRequestFilter: "org.openmetadata.catalog.security.JwtFilter"
  adminPrincipals:
    - "suresh"
  botPrincipals:
    - "ingestion-bot"
  principalDomain: "open-metadata.org"

authenticationConfiguration:
  provider: "google"
  publicKey: "https://www.googleapis.com/oauth2/v3/certs"
  authority: "https://accounts.google.com"
  clientId: "261867039324-neb92r2147i6upchb78tv29idk079bps.apps.googleusercontent.com"
  callbackUrl: "http://localhost:8585/callback"

elasticsearch:
  host: ${ELASTICSEARCH_HOST:-localhost}
  port: ${ELASTICSEARCH_PORT:-9200}
  scheme: ${ELASTICSEARCH_SCHEME:-http}

airflowConfiguration:
  apiEndpoint: http://${AIRFLOW_HOST:-localhost}:${AIRFLOW_PORT:-8080}
  username: ${AIRFLOW_USERNAME:-admin}
  password: ${AIRFLOW_PASSWORD:-admin}
  metadataApiEndpoint: http://${SERVER_HOST:-localhost}:${SERVER_PORT:-8585}/api
  authProvider: "no-auth"

eventHandlerConfiguration:
  eventHandlerClassNames:
    - "org.openmetadata.catalog.events.AuditEventHandler"
    - "org.openmetadata.catalog.events.ChangeEventHandler"

health:
  delayedShutdownHandlerEnabled: true
  shutdownWaitPeriod: 1s
  healthCheckUrlPaths: ["/api/v1/health-check"]
  healthChecks:
    - name: UserDatabaseCheck
      critical: true
      schedule:
        checkInterval: 2500ms
        downtimeInterval: 10s
        failureAttempts: 2
        successAttempts: 1