Continue structural port from Spring Boot to Undertow

- Configuration options
- Configuration documentation
This commit is contained in:
Max Dor
2018-12-31 15:07:49 +01:00
parent ace5918342
commit 4185b644b7
48 changed files with 454 additions and 351 deletions

View File

@@ -68,7 +68,8 @@ We will use the term `Executable` for each lookup/action and `Processor` for eac
### Global
```yaml
exec.enabled: <boolean>
exec:
enabled: <boolean>
```
Enable/disable the Identity store at a global/default level. Each feature can still be individually enabled/disabled.
@@ -79,7 +80,9 @@ Not all features use all tokens, and each feature might also have its own specif
They can be set within the following scope:
```yaml
exec.token.<token>: '<value>'
exec:
token:
<token>: '<value>'
```
---
@@ -184,13 +187,16 @@ The following types are available:
### Examples
#### Basic
```yaml
exec.auth.enabled: true
exec.auth.command: '/opt/mxisd-exec/auth.sh'
exec.auth.args: ['{localpart}']
exec.auth.input.type: 'plain'
exec.auth.input.template: '{password}'
exec.auth.env:
DOMAIN: '{domain}'
exec:
auth:
enabled: true
command: '/opt/mxisd-exec/auth.sh'
args: ['{localpart}']
input:
type: 'plain'
template: '{password}'
env:
DOMAIN: '{domain}'
```
With Authentication enabled, run `/opt/mxisd-exec/auth.sh` when validating credentials, providing:
- A single command-line argument to provide the `localoart` as username
@@ -243,14 +249,17 @@ See each dedicated [Feature](#features) section.
## Authentication
The Authentication feature can be enabled/disabled using:
```yaml
exec.auth.enabled: <true/false>
exec:
auth:
enabled: <true/false>
```
---
This feature provides a single *Executable* under the namespace:
```yaml
exec.auth:
exec:
auth:
...
```
@@ -294,7 +303,9 @@ Default template:
## Directory
The Directory feature can be enabled/disabled using:
```yaml
exec.directory.enabled: <true/false>
exec:
directory:
enabled: <true/false>
```
---
@@ -303,13 +314,19 @@ Two search types configuration namespace are available, using the same input/out
By name:
```yaml
exec.directory.search.byName:
...
exec:
directory:
search:
byName:
...
```
By 3PID:
```yaml
exec.directory.search.byThreepid:
...
exec:
directory:
search:
byThreepid:
...
```
#### Tokens
@@ -386,8 +403,11 @@ The User ID type will default to `localpart` if:
### Bulk lookup
Configuration namespace:
```yaml
exec.identity.lookup.bulk:
...
exec:
identity:
lookup:
bulk:
...
```
#### Tokens
@@ -418,7 +438,9 @@ Same as the [REST Identity Store](rest.md).
## Profile
The Profile feature can be enabled/disabled using:
```yaml
exec.profile.enabled: <true/false>
exec:
profile:
enabled: <true/false>
```
---
@@ -427,20 +449,26 @@ The following *Executable*s namespace are available, share the same input/output
Get Display name:
```yaml
exec.profile.displayName:
...
exec:
profile:
displayName:
...
```
Get 3PIDs:
```yaml
exec.profile.threePid:
...
exec:
profile:
threePid:
...
```
Get Roles:
```yaml
exec.profile.role:
...
exec:
profile:
role:
...
```

View File

@@ -19,35 +19,41 @@ If your client is Riot, you will need a custom version.
## Configuration
```yaml
firebase.enabled: <boolean>
firebase:
enabled: <boolean>
```
Enable/disable this identity store.
Example:
```yaml
firebase.enabled: <boolean>
firebase:
enabled: <boolean>
```
---
```yaml
firebase.credentials: <string>
firebase:
credentials: <string>
```
Path to the credentials file provided by Google Firebase to use with an external app.
Example:
```yaml
firebase.credentials: '/path/to/firebase/credentials.json'
firebase:
credentials: '/path/to/firebase/credentials.json'
```
---
```yaml
firebase.database: <string>
firebase:
database: <string>
```
URL to your Firebase database.
Example:
```yaml
firebase.database: 'https://my-project.firebaseio.com/'
firebase:
database: 'https://my-project.firebaseio.com/'
```

View File

@@ -19,13 +19,15 @@ For NetIQ, replace all the `ldap` prefix in the configuration by `netiq`.
### Base
To use your LDAP backend, add the bare minimum configuration in mxisd config file:
```yaml
ldap.enabled: true
ldap.connection.host: 'ldapHostnameOrIp'
ldap.connection.port: 389
ldap.connection.bindDn: 'CN=My Mxisd User,OU=Users,DC=example,DC=org'
ldap.connection.bindPassword: 'TheUserPassword'
ldap.connection.baseDNs:
- 'OU=Users,DC=example,DC=org'
ldap:
enabled: true
connection:
host: 'ldapHostnameOrIp'
port: 389
bindDn: 'CN=My Mxisd User,OU=Users,DC=example,DC=org'
bindPassword: 'TheUserPassword'
baseDNs:
- 'OU=Users,DC=example,DC=org'
```
These are standard LDAP connection configuration. mxisd will try to connect on port default port 389 without encryption.
@@ -34,14 +36,17 @@ If you would like to use several Base DNs, simply add more entries under `baseDN
### TLS/SSL connection
If you would like to use a TLS/SSL connection, use the following configuration options (STARTLS not supported):
```yaml
ldap.connection.tls: true
ldap.connection.port: 12345
ldap:
connection:
tls: true
port: 12345
```
### Filter results
You can also set a default global filter on any LDAP queries:
```yaml
ldap.filter: '(memberOf=CN=My Matrix Users,OU=Groups,DC=example,DC=org)'
ldap:
filter: '(memberOf=CN=My Matrix Users,OU=Groups,DC=example,DC=org)'
```
This example would only return users part of the group called `My Matrix Users`.
This can be overwritten or append in each specific flow describe below.
@@ -64,8 +69,11 @@ most certainly configure those mappings.
The following example would set the `sAMAccountName` attribute as a Matrix User ID localpart:
```yaml
ldap.attribute.uid.type: 'uid'
ldap.attribute.uid.value: 'sAMAccountName'
ldap:
attribute:
uid:
type: 'uid'
value: 'sAMAccountName'
```
#### Display name
@@ -73,7 +81,9 @@ Use `ldap.attribute.name`.
The following example would set the display name to the value of the `cn` attribute:
```yaml
ldap.attribute.name: 'cn'
ldap:
attribute:
name: 'cn'
```
#### 3PIDs
@@ -82,13 +92,15 @@ You can also change the attribute lists for 3PID, like email or phone numbers.
The following example would overwrite the [default list of attributes](../../src/main/resources/application.yaml#L67)
for emails and phone number:
```yaml
ldap.attribute.threepid.email:
- 'mail'
- 'otherMailAttribute'
ldap.attribute.threepid.msisdn:
- 'phone'
- 'otherPhoneAttribute'
ldap:
attribute:
threepid:
email:
- 'mail'
- 'otherMailAttribute'
msisdn:
- 'phone'
- 'otherPhoneAttribute'
```
## Features
@@ -117,8 +129,11 @@ To set a specific filter applied during directory search, use `ldap.directory.fi
If you would like to use extra attributes in search that are not 3PIDs, like nicknames, group names, employee number:
```yaml
ldap.directory.attribute.other:
- 'myNicknameAttribute'
- 'memberOf'
- 'employeeNumberAttribute'
ldap:
directory:
attribute:
other:
- 'myNicknameAttribute'
- 'memberOf'
- 'employeeNumberAttribute'
```

View File

@@ -15,19 +15,21 @@
Due to the implementation complexity of supporting arbitrary hashing/encoding mechanisms or auth flow, Authentication
will be out of scope of SQL Identity stores and should be done via one of the other identity stores, typically
the [REST Identity store](rest.md).
the [Exec Identity Store](exec.md) or the [REST Identity Store](rest.md).
## Configuration
### Basic
```yaml
sql.enabled: <boolean>
sql:
enabled: <boolean>
```
Enable/disable the identity store
---
```yaml
sql.type: <string>
sql:
type: <string>
```
Set the SQL backend to use:
- `sqlite`
@@ -38,14 +40,16 @@ Set the SQL backend to use:
### Connection
#### SQLite
```yaml
sql.connection: <string>
sql:
connection: <string>
```
Set the value to the absolute path to the Synapse SQLite DB file.
Example: `/path/to/sqlite/file.db`
#### Others
```yaml
sql.connection: //<HOST[:PORT]/DB?user=USER&password=PASS
sql:
connection: //<HOST[:PORT]/DB?user=USER&password=PASS
```
Set the connection info for the database by replacing the following values:
- `HOST`: Hostname of the SQL server
@@ -58,20 +62,23 @@ This follow the JDBC URI syntax. See [official website](https://docs.oracle.com/
### Directory
```yaml
sql.directory.enabled: false
sql:
directory:
enabled: false
```
---
```yaml
sql.directory.query:
name:
type: <string>
value: <string>
threepid:
type: <string>
value: <string>
sql:
directory:
query:
name:
type: <string>
value: <string>
threepid:
type: <string>
value: <string>
```
For each query, `type` can be used to tell mxisd how to process the ID column:
- `localpart` will append the `matrix.domain` to it
@@ -83,17 +90,21 @@ For each query, `type` can be used to tell mxisd how to process the ID column:
Example:
```yaml
sql.directory.query:
name:
type: 'localpart'
value: 'SELECT idColumn, displayNameColumn FROM table WHERE displayNameColumn LIKE ?'
threepid:
type: 'localpart'
value: 'SELECT idColumn, displayNameColumn FROM table WHERE threepidColumn LIKE ?'
sql:
directory:
query:
name:
type: 'localpart'
value: 'SELECT idColumn, displayNameColumn FROM table WHERE displayNameColumn LIKE ?'
threepid:
type: 'localpart'
value: 'SELECT idColumn, displayNameColumn FROM table WHERE threepidColumn LIKE ?'
```
### Identity
```yaml
sql.identity.type: <string>
sql.identity.query: <string>
sql:
identity:
type: <string>
query: <string>
```

View File

@@ -14,14 +14,16 @@ Authentication is done by Synapse itself.
## Configuration
### Basic
```yaml
synapseSql.enabled: <boolean>
synapseSql:
enabled: <boolean>
```
Enable/disable the identity store
---
```yaml
synapseSql.type: <string>
synapseSql:
type: <string>
```
Set the SQL backend to use which is configured in synapse:
- `sqlite`
@@ -29,14 +31,16 @@ Set the SQL backend to use which is configured in synapse:
### SQLite
```yaml
synapseSql.connection: <string>
synapseSql:
connection: <string>
```
Set the value to the absolute path to the Synapse SQLite DB file.
Example: `/path/to/synapse/sqliteFile.db`
### PostgreSQL
```yaml
synapseSql.connection: //<HOST[:PORT]/DB?user=USER&password=PASS
synapseSql:
connection: //<HOST[:PORT]/DB?user=USER&password=PASS
```
Set the connection info for the database by replacing the following values:
- `HOST`: Hostname of the SQL server

View File

@@ -34,22 +34,29 @@ If this is not the case for your installation, the mxisd URL will need to be app
### mxisd
Enable in the configuration:
```yaml
wordpress.enabled: true
wordpress:
enabled: true
```
Configure the URL to your Wordpress installation - see above about added `/index.php`:
```yaml
wordpress.rest.base: 'http://localhost:8080'
wordpress:
rest:
base: 'http://localhost:8080'
```
Configure the SQL connection to your Wordpress database:
```yaml
wordpress.sql.connection: '//127.0.0.1/wordpress?user=root&password=example'
wordpress:
sql:
connection: '//127.0.0.1/wordpress?user=root&password=example'
```
---
By default, MySQL database is expected. If you use another database, use:
```yaml
wordpress.sql.type: <string>
wordpress:
sql:
type: <string>
```
With possible values:
- `mysql`
@@ -61,6 +68,8 @@ With possible values:
To configure the tables prefix for default queries, in case a custom value was set during Wordpress install:
```yaml
wordpress.sql.tablePrefix: <string>
wordpress:
sql:
tablePrefix: <string>
```
By default, the value is set to `wp_`.