Continue structural port from Spring Boot to Undertow
- Configuration options - Configuration documentation
This commit is contained in:
@@ -68,7 +68,8 @@ We will use the term `Executable` for each lookup/action and `Processor` for eac
|
||||
|
||||
### Global
|
||||
```yaml
|
||||
exec.enabled: <boolean>
|
||||
exec:
|
||||
enabled: <boolean>
|
||||
```
|
||||
Enable/disable the Identity store at a global/default level. Each feature can still be individually enabled/disabled.
|
||||
|
||||
@@ -79,7 +80,9 @@ Not all features use all tokens, and each feature might also have its own specif
|
||||
They can be set within the following scope:
|
||||
|
||||
```yaml
|
||||
exec.token.<token>: '<value>'
|
||||
exec:
|
||||
token:
|
||||
<token>: '<value>'
|
||||
```
|
||||
|
||||
---
|
||||
@@ -184,13 +187,16 @@ The following types are available:
|
||||
### Examples
|
||||
#### Basic
|
||||
```yaml
|
||||
exec.auth.enabled: true
|
||||
exec.auth.command: '/opt/mxisd-exec/auth.sh'
|
||||
exec.auth.args: ['{localpart}']
|
||||
exec.auth.input.type: 'plain'
|
||||
exec.auth.input.template: '{password}'
|
||||
exec.auth.env:
|
||||
DOMAIN: '{domain}'
|
||||
exec:
|
||||
auth:
|
||||
enabled: true
|
||||
command: '/opt/mxisd-exec/auth.sh'
|
||||
args: ['{localpart}']
|
||||
input:
|
||||
type: 'plain'
|
||||
template: '{password}'
|
||||
env:
|
||||
DOMAIN: '{domain}'
|
||||
```
|
||||
With Authentication enabled, run `/opt/mxisd-exec/auth.sh` when validating credentials, providing:
|
||||
- A single command-line argument to provide the `localoart` as username
|
||||
@@ -243,14 +249,17 @@ See each dedicated [Feature](#features) section.
|
||||
## Authentication
|
||||
The Authentication feature can be enabled/disabled using:
|
||||
```yaml
|
||||
exec.auth.enabled: <true/false>
|
||||
exec:
|
||||
auth:
|
||||
enabled: <true/false>
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
This feature provides a single *Executable* under the namespace:
|
||||
```yaml
|
||||
exec.auth:
|
||||
exec:
|
||||
auth:
|
||||
...
|
||||
```
|
||||
|
||||
@@ -294,7 +303,9 @@ Default template:
|
||||
## Directory
|
||||
The Directory feature can be enabled/disabled using:
|
||||
```yaml
|
||||
exec.directory.enabled: <true/false>
|
||||
exec:
|
||||
directory:
|
||||
enabled: <true/false>
|
||||
```
|
||||
|
||||
---
|
||||
@@ -303,13 +314,19 @@ Two search types configuration namespace are available, using the same input/out
|
||||
|
||||
By name:
|
||||
```yaml
|
||||
exec.directory.search.byName:
|
||||
...
|
||||
exec:
|
||||
directory:
|
||||
search:
|
||||
byName:
|
||||
...
|
||||
```
|
||||
By 3PID:
|
||||
```yaml
|
||||
exec.directory.search.byThreepid:
|
||||
...
|
||||
exec:
|
||||
directory:
|
||||
search:
|
||||
byThreepid:
|
||||
...
|
||||
```
|
||||
|
||||
#### Tokens
|
||||
@@ -386,8 +403,11 @@ The User ID type will default to `localpart` if:
|
||||
### Bulk lookup
|
||||
Configuration namespace:
|
||||
```yaml
|
||||
exec.identity.lookup.bulk:
|
||||
...
|
||||
exec:
|
||||
identity:
|
||||
lookup:
|
||||
bulk:
|
||||
...
|
||||
```
|
||||
|
||||
#### Tokens
|
||||
@@ -418,7 +438,9 @@ Same as the [REST Identity Store](rest.md).
|
||||
## Profile
|
||||
The Profile feature can be enabled/disabled using:
|
||||
```yaml
|
||||
exec.profile.enabled: <true/false>
|
||||
exec:
|
||||
profile:
|
||||
enabled: <true/false>
|
||||
```
|
||||
|
||||
---
|
||||
@@ -427,20 +449,26 @@ The following *Executable*s namespace are available, share the same input/output
|
||||
|
||||
Get Display name:
|
||||
```yaml
|
||||
exec.profile.displayName:
|
||||
...
|
||||
exec:
|
||||
profile:
|
||||
displayName:
|
||||
...
|
||||
```
|
||||
|
||||
Get 3PIDs:
|
||||
```yaml
|
||||
exec.profile.threePid:
|
||||
...
|
||||
exec:
|
||||
profile:
|
||||
threePid:
|
||||
...
|
||||
```
|
||||
|
||||
Get Roles:
|
||||
```yaml
|
||||
exec.profile.role:
|
||||
...
|
||||
exec:
|
||||
profile:
|
||||
role:
|
||||
...
|
||||
```
|
||||
|
||||
|
||||
|
||||
@@ -19,35 +19,41 @@ If your client is Riot, you will need a custom version.
|
||||
|
||||
## Configuration
|
||||
```yaml
|
||||
firebase.enabled: <boolean>
|
||||
firebase:
|
||||
enabled: <boolean>
|
||||
```
|
||||
Enable/disable this identity store.
|
||||
|
||||
Example:
|
||||
```yaml
|
||||
firebase.enabled: <boolean>
|
||||
firebase:
|
||||
enabled: <boolean>
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
```yaml
|
||||
firebase.credentials: <string>
|
||||
firebase:
|
||||
credentials: <string>
|
||||
```
|
||||
Path to the credentials file provided by Google Firebase to use with an external app.
|
||||
|
||||
Example:
|
||||
```yaml
|
||||
firebase.credentials: '/path/to/firebase/credentials.json'
|
||||
firebase:
|
||||
credentials: '/path/to/firebase/credentials.json'
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
```yaml
|
||||
firebase.database: <string>
|
||||
firebase:
|
||||
database: <string>
|
||||
```
|
||||
URL to your Firebase database.
|
||||
|
||||
Example:
|
||||
```yaml
|
||||
firebase.database: 'https://my-project.firebaseio.com/'
|
||||
firebase:
|
||||
database: 'https://my-project.firebaseio.com/'
|
||||
```
|
||||
|
||||
@@ -19,13 +19,15 @@ For NetIQ, replace all the `ldap` prefix in the configuration by `netiq`.
|
||||
### Base
|
||||
To use your LDAP backend, add the bare minimum configuration in mxisd config file:
|
||||
```yaml
|
||||
ldap.enabled: true
|
||||
ldap.connection.host: 'ldapHostnameOrIp'
|
||||
ldap.connection.port: 389
|
||||
ldap.connection.bindDn: 'CN=My Mxisd User,OU=Users,DC=example,DC=org'
|
||||
ldap.connection.bindPassword: 'TheUserPassword'
|
||||
ldap.connection.baseDNs:
|
||||
- 'OU=Users,DC=example,DC=org'
|
||||
ldap:
|
||||
enabled: true
|
||||
connection:
|
||||
host: 'ldapHostnameOrIp'
|
||||
port: 389
|
||||
bindDn: 'CN=My Mxisd User,OU=Users,DC=example,DC=org'
|
||||
bindPassword: 'TheUserPassword'
|
||||
baseDNs:
|
||||
- 'OU=Users,DC=example,DC=org'
|
||||
```
|
||||
These are standard LDAP connection configuration. mxisd will try to connect on port default port 389 without encryption.
|
||||
|
||||
@@ -34,14 +36,17 @@ If you would like to use several Base DNs, simply add more entries under `baseDN
|
||||
### TLS/SSL connection
|
||||
If you would like to use a TLS/SSL connection, use the following configuration options (STARTLS not supported):
|
||||
```yaml
|
||||
ldap.connection.tls: true
|
||||
ldap.connection.port: 12345
|
||||
ldap:
|
||||
connection:
|
||||
tls: true
|
||||
port: 12345
|
||||
```
|
||||
|
||||
### Filter results
|
||||
You can also set a default global filter on any LDAP queries:
|
||||
```yaml
|
||||
ldap.filter: '(memberOf=CN=My Matrix Users,OU=Groups,DC=example,DC=org)'
|
||||
ldap:
|
||||
filter: '(memberOf=CN=My Matrix Users,OU=Groups,DC=example,DC=org)'
|
||||
```
|
||||
This example would only return users part of the group called `My Matrix Users`.
|
||||
This can be overwritten or append in each specific flow describe below.
|
||||
@@ -64,8 +69,11 @@ most certainly configure those mappings.
|
||||
|
||||
The following example would set the `sAMAccountName` attribute as a Matrix User ID localpart:
|
||||
```yaml
|
||||
ldap.attribute.uid.type: 'uid'
|
||||
ldap.attribute.uid.value: 'sAMAccountName'
|
||||
ldap:
|
||||
attribute:
|
||||
uid:
|
||||
type: 'uid'
|
||||
value: 'sAMAccountName'
|
||||
```
|
||||
|
||||
#### Display name
|
||||
@@ -73,7 +81,9 @@ Use `ldap.attribute.name`.
|
||||
|
||||
The following example would set the display name to the value of the `cn` attribute:
|
||||
```yaml
|
||||
ldap.attribute.name: 'cn'
|
||||
ldap:
|
||||
attribute:
|
||||
name: 'cn'
|
||||
```
|
||||
|
||||
#### 3PIDs
|
||||
@@ -82,13 +92,15 @@ You can also change the attribute lists for 3PID, like email or phone numbers.
|
||||
The following example would overwrite the [default list of attributes](../../src/main/resources/application.yaml#L67)
|
||||
for emails and phone number:
|
||||
```yaml
|
||||
ldap.attribute.threepid.email:
|
||||
- 'mail'
|
||||
- 'otherMailAttribute'
|
||||
|
||||
ldap.attribute.threepid.msisdn:
|
||||
- 'phone'
|
||||
- 'otherPhoneAttribute'
|
||||
ldap:
|
||||
attribute:
|
||||
threepid:
|
||||
email:
|
||||
- 'mail'
|
||||
- 'otherMailAttribute'
|
||||
msisdn:
|
||||
- 'phone'
|
||||
- 'otherPhoneAttribute'
|
||||
```
|
||||
|
||||
## Features
|
||||
@@ -117,8 +129,11 @@ To set a specific filter applied during directory search, use `ldap.directory.fi
|
||||
|
||||
If you would like to use extra attributes in search that are not 3PIDs, like nicknames, group names, employee number:
|
||||
```yaml
|
||||
ldap.directory.attribute.other:
|
||||
- 'myNicknameAttribute'
|
||||
- 'memberOf'
|
||||
- 'employeeNumberAttribute'
|
||||
ldap:
|
||||
directory:
|
||||
attribute:
|
||||
other:
|
||||
- 'myNicknameAttribute'
|
||||
- 'memberOf'
|
||||
- 'employeeNumberAttribute'
|
||||
```
|
||||
|
||||
@@ -15,19 +15,21 @@
|
||||
|
||||
Due to the implementation complexity of supporting arbitrary hashing/encoding mechanisms or auth flow, Authentication
|
||||
will be out of scope of SQL Identity stores and should be done via one of the other identity stores, typically
|
||||
the [REST Identity store](rest.md).
|
||||
the [Exec Identity Store](exec.md) or the [REST Identity Store](rest.md).
|
||||
|
||||
## Configuration
|
||||
### Basic
|
||||
```yaml
|
||||
sql.enabled: <boolean>
|
||||
sql:
|
||||
enabled: <boolean>
|
||||
```
|
||||
Enable/disable the identity store
|
||||
|
||||
---
|
||||
|
||||
```yaml
|
||||
sql.type: <string>
|
||||
sql:
|
||||
type: <string>
|
||||
```
|
||||
Set the SQL backend to use:
|
||||
- `sqlite`
|
||||
@@ -38,14 +40,16 @@ Set the SQL backend to use:
|
||||
### Connection
|
||||
#### SQLite
|
||||
```yaml
|
||||
sql.connection: <string>
|
||||
sql:
|
||||
connection: <string>
|
||||
```
|
||||
Set the value to the absolute path to the Synapse SQLite DB file.
|
||||
Example: `/path/to/sqlite/file.db`
|
||||
|
||||
#### Others
|
||||
```yaml
|
||||
sql.connection: //<HOST[:PORT]/DB?user=USER&password=PASS
|
||||
sql:
|
||||
connection: //<HOST[:PORT]/DB?user=USER&password=PASS
|
||||
```
|
||||
Set the connection info for the database by replacing the following values:
|
||||
- `HOST`: Hostname of the SQL server
|
||||
@@ -58,20 +62,23 @@ This follow the JDBC URI syntax. See [official website](https://docs.oracle.com/
|
||||
|
||||
### Directory
|
||||
```yaml
|
||||
sql.directory.enabled: false
|
||||
sql:
|
||||
directory:
|
||||
enabled: false
|
||||
```
|
||||
|
||||
|
||||
---
|
||||
|
||||
```yaml
|
||||
sql.directory.query:
|
||||
name:
|
||||
type: <string>
|
||||
value: <string>
|
||||
threepid:
|
||||
type: <string>
|
||||
value: <string>
|
||||
sql:
|
||||
directory:
|
||||
query:
|
||||
name:
|
||||
type: <string>
|
||||
value: <string>
|
||||
threepid:
|
||||
type: <string>
|
||||
value: <string>
|
||||
```
|
||||
For each query, `type` can be used to tell mxisd how to process the ID column:
|
||||
- `localpart` will append the `matrix.domain` to it
|
||||
@@ -83,17 +90,21 @@ For each query, `type` can be used to tell mxisd how to process the ID column:
|
||||
|
||||
Example:
|
||||
```yaml
|
||||
sql.directory.query:
|
||||
name:
|
||||
type: 'localpart'
|
||||
value: 'SELECT idColumn, displayNameColumn FROM table WHERE displayNameColumn LIKE ?'
|
||||
threepid:
|
||||
type: 'localpart'
|
||||
value: 'SELECT idColumn, displayNameColumn FROM table WHERE threepidColumn LIKE ?'
|
||||
sql:
|
||||
directory:
|
||||
query:
|
||||
name:
|
||||
type: 'localpart'
|
||||
value: 'SELECT idColumn, displayNameColumn FROM table WHERE displayNameColumn LIKE ?'
|
||||
threepid:
|
||||
type: 'localpart'
|
||||
value: 'SELECT idColumn, displayNameColumn FROM table WHERE threepidColumn LIKE ?'
|
||||
```
|
||||
|
||||
### Identity
|
||||
```yaml
|
||||
sql.identity.type: <string>
|
||||
sql.identity.query: <string>
|
||||
sql:
|
||||
identity:
|
||||
type: <string>
|
||||
query: <string>
|
||||
```
|
||||
|
||||
@@ -14,14 +14,16 @@ Authentication is done by Synapse itself.
|
||||
## Configuration
|
||||
### Basic
|
||||
```yaml
|
||||
synapseSql.enabled: <boolean>
|
||||
synapseSql:
|
||||
enabled: <boolean>
|
||||
```
|
||||
Enable/disable the identity store
|
||||
|
||||
---
|
||||
|
||||
```yaml
|
||||
synapseSql.type: <string>
|
||||
synapseSql:
|
||||
type: <string>
|
||||
```
|
||||
Set the SQL backend to use which is configured in synapse:
|
||||
- `sqlite`
|
||||
@@ -29,14 +31,16 @@ Set the SQL backend to use which is configured in synapse:
|
||||
|
||||
### SQLite
|
||||
```yaml
|
||||
synapseSql.connection: <string>
|
||||
synapseSql:
|
||||
connection: <string>
|
||||
```
|
||||
Set the value to the absolute path to the Synapse SQLite DB file.
|
||||
Example: `/path/to/synapse/sqliteFile.db`
|
||||
|
||||
### PostgreSQL
|
||||
```yaml
|
||||
synapseSql.connection: //<HOST[:PORT]/DB?user=USER&password=PASS
|
||||
synapseSql:
|
||||
connection: //<HOST[:PORT]/DB?user=USER&password=PASS
|
||||
```
|
||||
Set the connection info for the database by replacing the following values:
|
||||
- `HOST`: Hostname of the SQL server
|
||||
|
||||
@@ -34,22 +34,29 @@ If this is not the case for your installation, the mxisd URL will need to be app
|
||||
### mxisd
|
||||
Enable in the configuration:
|
||||
```yaml
|
||||
wordpress.enabled: true
|
||||
wordpress:
|
||||
enabled: true
|
||||
```
|
||||
Configure the URL to your Wordpress installation - see above about added `/index.php`:
|
||||
```yaml
|
||||
wordpress.rest.base: 'http://localhost:8080'
|
||||
wordpress:
|
||||
rest:
|
||||
base: 'http://localhost:8080'
|
||||
```
|
||||
Configure the SQL connection to your Wordpress database:
|
||||
```yaml
|
||||
wordpress.sql.connection: '//127.0.0.1/wordpress?user=root&password=example'
|
||||
wordpress:
|
||||
sql:
|
||||
connection: '//127.0.0.1/wordpress?user=root&password=example'
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
By default, MySQL database is expected. If you use another database, use:
|
||||
```yaml
|
||||
wordpress.sql.type: <string>
|
||||
wordpress:
|
||||
sql:
|
||||
type: <string>
|
||||
```
|
||||
With possible values:
|
||||
- `mysql`
|
||||
@@ -61,6 +68,8 @@ With possible values:
|
||||
|
||||
To configure the tables prefix for default queries, in case a custom value was set during Wordpress install:
|
||||
```yaml
|
||||
wordpress.sql.tablePrefix: <string>
|
||||
wordpress:
|
||||
sql:
|
||||
tablePrefix: <string>
|
||||
```
|
||||
By default, the value is set to `wp_`.
|
||||
|
||||
Reference in New Issue
Block a user