OpenMetadata/conf/openmetadata-security.yaml

#  Licensed to the Apache Software Foundation (ASF) under one or more
#  contributor license agreements. See the NOTICE file distributed with
#  this work for additional information regarding copyright ownership.
#  The ASF licenses this file to You under the Apache License, Version 2.0
#  (the "License"); you may not use this file except in compliance with
#  the License. You may obtain a copy of the License at
#
#  http://www.apache.org/licenses/LICENSE-2.0
#
#  Unless required by applicable law or agreed to in writing, software
#  distributed under the License is distributed on an "AS IS" BASIS,
#  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
#  See the License for the specific language governing permissions and
#  limitations under the License.

swagger:
  resourcePackage: org.openmetadata.catalog.resources


server:
  rootPath: '/api/*'
  applicationConnectors:
    - type: http
      port: 8585
  adminConnectors:
    - type: http
      port: 8586

# Above configuration for running http is fine for dev and testing.
# For production setup, where UI app will hit apis through DPS it 
# is strongly recommended to run https instead. Note that only
# keyStorePath and keyStorePassword are mandatory properties. Values
# for other properties are defaults
#server:
  #applicationConnectors:
  #  - type: https
  #    port: 8585
  #    keyStorePath: ./conf/keystore.jks 
  #    keyStorePassword: changeit
  #    keyStoreType: JKS
  #    keyStoreProvider:
  #    trustStorePath: /path/to/file
  #    trustStorePassword: changeit
  #    trustStoreType: JKS
  #    trustStoreProvider:
  #    keyManagerPassword: changeit
  #    needClientAuth: false
  #    wantClientAuth:
  #    certAlias: <alias>
  #    crlPath: /path/to/file
  #    enableCRLDP: false
  #    enableOCSP: false
  #    maxCertPathLength: (unlimited)
  #    ocspResponderUrl: (none)
  #    jceProvider: (none)
  #    validateCerts: true
  #    validatePeers: true
  #    supportedProtocols: SSLv3
  #    supportedCipherSuites: TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256
  #    allowRenegotiation: true
  #    endpointIdentificationAlgorithm: (none)
 
  #adminConnectors:
  #  - type: https
  #    port: 8586
  #    keyStorePath: ./conf/keystore.jks 
  #    keyStorePassword: changeit 
  #    keyStoreType: JKS
  #    keyStoreProvider:
  #    trustStorePath: /path/to/file
  #    trustStorePassword: changeit
  #    trustStoreType: JKS
  #    trustStoreProvider:
  #    keyManagerPassword: changeit
  #    needClientAuth: false
  #    wantClientAuth:
  #    certAlias: <alias>
  #    crlPath: /path/to/file
  #    enableCRLDP: false
  #    enableOCSP: false
  #    maxCertPathLength: (unlimited)
  #    ocspResponderUrl: (none)
  #    jceProvider: (none)
  #    validateCerts: true
  #    validatePeers: true
  #    supportedProtocols: SSLv3
  #    supportedCipherSuites: TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256
  #    allowRenegotiation: true
  #    endpointIdentificationAlgorithm: (none)

# Logging settings.
# https://logback.qos.ch/manual/layouts.html#conversionWord
logging:
  level: DEBUG
  loggers:
    org.openmetadata.catalog.common: DEBUG
    org.openmetadata.catalog.security: DEBUG
    io.swagger: ERROR
  appenders:
    - type: file
      threshold: TRACE
      logFormat: "%level [%d{HH:mm:ss.SSS}] [%t] %logger{5} - %msg %n"
      currentLogFilename: ./logs/catalog.log
      archivedLogFilenamePattern: ./logs/catalog-%d{yyyy-MM-dd}-%i.log.gz
      archivedFileCount: 7
      timeZone: UTC
      maxFileSize: 50MB

database:
  # the name of the JDBC driver, mysql in our case
  driverClass: com.mysql.cj.jdbc.Driver
  # the username and password
  user: openmetadata_user
  password: openmetadata_password
  # the JDBC URL; the database is called openmetadata_db
  url: jdbc:mysql://localhost/openmetadata_db?useSSL=false&serverTimezone=UTC


# Authorizer Configuration
authorizerConfiguration:
  className: "org.openmetadata.catalog.security.DefaultCatalogAuthorizer"
  # JWT Filter
  containerRequestFilter: "org.openmetadata.catalog.security.JwtFilter"
  adminPrincipals:
    - "suresh"
  botPrincipals:
    - "ingestion-bot"
  prinicipalDomain: "open-metadata.org"

authenticationConfiguration:
  provider: "google"
  publicKey: "https://www.googleapis.com/oauth2/v3/certs"
  authority: "https://accounts.google.com"
  clientId: "261867039324-neb92r2147i6upchb78tv29idk079bps.apps.googleusercontent.com"
  callbackUrl: "http://localhost:8585/callback"
  
elasticsearch:
  host: localhost
  port: 9200


eventHandlerConfiguration:
  eventHandlerClassNames:
    - "org.openmetadata.catalog.events.AuditEventHandler"
    - "org.openmetadata.catalog.events.ElasticSearchEventHandler"

health:
  delayedShutdownHandlerEnabled: true
  shutdownWaitPeriod: 1s
  healthCheckUrlPaths: ["/api/v1/health-check"]
  healthChecks:
    - name: UserDatabaseCheck
      critical: true
      schedule:
        checkInterval: 2500ms
        downtimeInterval: 10s
        failureAttempts: 2
        successAttempts: 1