Documentation Index

Fetch the complete documentation index at: https://docs.getcollate.io/llms.txt

Use this file to discover all available pages before exploring further.

​

Configuration Reference Parameters

​

Public Key Url (publicKeyUrls):

This needs to be updated as per different SSO providers. The default value is http://localhost:8585/api/v1/system/config/jwks. This is the URL where the public keys are stored. The public keys are used to verify the signature of the JWT token.

​

Client ID (id):

The client ID provided by your OIDC provider. This is typically obtained when you register your application with the OIDC provider.

​

Type (type):

Specify the type of OIDC provider you are using (e.g., google, azure). This value is same as provider in authenticationConfiguration.

​

Client Secret (secret):

Replace with the client secret provided by your OIDC provider.

​

Scope (scope):

Define the scopes that your application requests during authentication. Update ${OIDC_SCOPE:-"openid email profile"} with the desired scopes.

​

Discovery URI (discoveryUri):

Provide the URL of the OIDC provider’s discovery document. This document contains metadata about the provider’s configuration.

​

Use Nonce (useNonce):

Set to true by Default, if you want to use nonce for replay attack protection during authentication. This does not need to be changed.

​

Preferred JWS Algorithm (preferredJwsAlgorithm):

Specify the preferred JSON Web Signature (JWS) algorithm. Default is RS256 and need not be changed .

​

Response Type (responseType):

Define the response type for the authentication request. Default is code and need not be changed.

​

Disable PKCE (disablePkce):

Set ${OIDC_DISABLE_PKCE:-true} to true if you want to disable Proof Key for Code Exchange (PKCE). If you want to send CodeVerifier and CodeChallenge in the request, set it to false.

​

Callback URL (callbackUrl):

Provide the callback URL where the OIDC provider redirects after authentication. Update ${OIDC_CALLBACK:-"http://localhost:8585/callback"} with your actual callback URL.

​

Server URL (serverUrl):

Specify the URL of your OM Server. Default is http://localhost:8585.

​

Client Authentication Method (clientAuthenticationMethod):

Define the method used for client authentication. Default is client_secret_post.

​

Tenant (tenant):

If applicable, specify the tenant ID for multi-tenant applications. Example in case of Azure.

​

Max Clock Skew (maxClockSkew):

Define the maximum acceptable clock skew between your application server and the OIDC server.

​

Custom Parameters (customParams):

If you have any additional custom parameters required for OIDC configuration, specify them here.

​

Config (config):

The central configuration block for OpenMetadata.

​

Provider (provider):

Specifies the authentication method to be used. The default is ldap, but you can change it to another supported provider. Example: google, azure.

​

Entity Id (entityId):

The unique identifier for the SAML Identity Provider. Example: "https://mocksaml.com/api/saml/sso"

​

SSO Login URL (ssoLoginUrl):

The URL to which users are redirected for Single Sign-On (SSO) authentication. Example: "https://saml.example.com/entityid"

​

IPDX509 Certificate (idpX509Certificate):

The public certificate used by the IdP to sign SAML assertions. Example: "" (empty string means no certificate provided, needs to be set with actual certificate)

​

Authority URL (authorityUrl):

The URL used for SAML login, typically a custom endpoint for your SAML provider. Example: "http://localhost:8585/api/v1/saml/login"

​

Name ID (nameId):

The format for the NameID element in the SAML response, usually representing the unique identifier of the user. Example: "urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress"

​

ACS (acs):

The Assertion Consumer Service (ACS) URL, where the IdP sends the SAML response after authentication. Example: "http://localhost:8585/api/v1/saml/acs"

​

SPX509 Certificate (spX509Certificate):

The public certificate used by the Service Provider to verify the IdP’s SAML response. Example: "" (empty string means no certificate provided, needs to be set with actual certificate)

​

Strict Mode (strictMode):

Whether to enforce strict compliance with the SAML standard, ensuring the response is fully validated. Default: false

​

Token Validity (tokenValidity):

The validity period of the SAML token in seconds. Default: "3600" (1 hour)

​

Send Encrypted Name ID (sendEncryptedNameId):

Whether to send the NameID in an encrypted format in the SAML response. Default: false

​

Send Signed Auth Request (sendSignedAuthRequest):

Whether to sign the authentication request sent to the IdP. Default: false

​

Sign SP Metadata (signSpMetadata):

Whether to sign the Service Provider’s metadata when exchanging SAML metadata with the IdP. Default: false

​

Want Messages Signed (wantMessagesSigned):

Whether the Service Provider expects SAML messages to be signed. Default: false

​

Want Assertions Signed (wantAssertionsSigned):

Whether the Service Provider expects SAML assertions to be signed. Default: false

​

Want Assertion Encrypted (wantAssertionEncrypted):

Whether to encrypt the SAML assertion before sending it to the Service Provider. Default: false

​

Want Name ID Encrypted (wantNameIdEncrypted):

Whether to encrypt the NameID element in the SAML response. Default: false

​

Key Store File Path (keyStoreFilePath):

The file path to the keystore file containing certificates and private keys used for signing and encryption. Example: "" (empty string means no keystore file provided)

​

KeyStore Alias (keyStoreAlias):

The alias used to refer to the key inside the keystore file. Example: "" (empty string means no alias provided)

​

KeyStore Password (keyStorePassword):

The password used to access the keystore file. Example: "" (empty string means no password provided)

​

Class Name (className):

Specifies the class that handles the authorization logic. Default: "org.openmetadata.service.security.DefaultAuthorizer"

​

Container Request Filter (containerRequestFilter):

Specifies the request filter used to process authentication, especially for handling JWT tokens. Default: "org.openmetadata.service.security.JwtFilter"

​

Initial Admins (initialAdmins):

A list of users who will be granted administrative privileges during the initial setup. Example: ["suresh"]

​

Principal Domain (principalDomain):

The domain that is associated with user accounts. Default: "open-metadata.org"

​

Authority (authority):

The base URL of the OIDC authority. Example: Replace {IssuerUrl} with the URL of your custom OIDC provider.

​

Client ID (clientId):

The client ID for the application registered with the custom OIDC provider. Replace {client id} with the actual client ID.

​

Host (host):

The hostname of the LDAP server. Defaults to localhost.

​

Port (port):

The port number to connect to the LDAP server. Defaults to 10636.

​

DN Admin Principal (dnAdminPrincipal):

The distinguished name (DN) of the admin user used for lookup operations in LDAP. Defaults to "cn=admin,dc=example,dc=com".

​

DN Admin Password (dnAdminPassword):

The password for the admin user. Defaults to "secret".

​

Userbase DN (userBaseDN):

The base DN for user lookup in LDAP. Defaults to "ou=people,dc=example,dc=com".

​

Mail Attribute Name (mailAttributeName):

The attribute name in LDAP that stores user email addresses. Defaults to email.

​

Maximum Pool Size (maxPoolSize) (Optional):

Defines the maximum number of connections in the LDAP connection pool. Defaults to 3.

​

SSL Enabled (sslEnabled):

Indicates if SSL is enabled for connecting to the LDAP server. Defaults to true.

​

Custom Trust Manager Configuration (customTrustManagerConfig):

• ​

  TrustStore FilePath (trustStoreFilePath):

  Path to the custom trust store file. Default is empty.

• ​

  TrustStore File Password (trustStoreFilePassword):

  Password for the trust store file. Default is empty.

• ​

  TrustStore File Format (trustStoreFileFormat):

  Format of the trust store file. Default is empty.

• ​

  Verify Host Name (verifyHostname):

  If hostname verification is enabled. Default is empty.

• ​

  Examine Validity Dates (examineValidityDates):

  Whether to check validity dates for certificates. Default is empty.

​

Host Name Configuration (hostNameConfig):

• ​

  Allow Wild Cards (allowWildCards):

  Allows wildcard certificates in hostnames. Default is empty.

• ​

  Acceptable Host Names (acceptableHostNames):

  A list of acceptable hostnames. Default is an empty list.

​

JVM Default Configurations (jvmDefaultConfig):

• ​

  Verify Host Name (verifyHostname):

  Enables hostname verification using JVM defaults. Default is empty.

​

Trust All Configurations (trustAllConfig):

• ​

  Examine Validity Dates (examineValidityDates):

  Checks the validity dates of certificates when using TrustAll mode. Defaults to true.

​

Enforce Principal Domain (enforcePrincipalDomain):

Whether to enforce user principal matching with the defined principal domain

​

Enable Secure Socket Connection (enableSecureSocketConnection):

If true, enables secure connections (SSL/TLS)

​

Use Roles From Provider (useRolesFromProvider):

Whether to derive roles from the authentication provider

​

Initial Admins (initialAdmins):

List of initial admin users for the system

​

JWT Principal Claims (jwtPrincipalClaims):

JWT claims used to identify the principal (user)

​

JWT Principal Claims Mapping (jwtPrincipalClaimsMapping):

Mapping of JWT claims to application-specific claims

​

Enable Self Signup (enableSelfSignup):

Allows users to sign up themselves if not already registered

​

Preferred JWT Algorithms (preferredJwsAlgorithm):

Preferred algorithm for JWT signature validation

​

Allowed Email Registration Domains (allowedEmailRegistrationDomains):

Specifies allowed domains for email registration