This topic provides reference information about the StreamBase Server
configuration file, sbd.sbconf. To view the default (or
skeleton) configuration, enter the following command at a terminal window:
sbd -s
To write the default configuration to a file for customization, enter a command like the following example:
sbd -s > /home/myaccount/myapps/mysbd.sbconf
streambase-configuration is the root element that
contains all XML code describing a StreamBase Server
configuration. It has one or more of the following child elements:
-
Zero or one of:
global -
Zero or one of:
server -
Zero or one of:
page-pool -
Zero or one of:
runtime -
Zero or one of:
custom-functions -
Zero or one of:
sbmonitor -
Zero or one of:
security -
Zero or one of:
security-tagging -
Zero or one of:
authentication -
Zero or one of:
high-availability -
Zero or one of:
java-vm -
Zero or one of:
data-sources -
Zero or one of:
operator-parameters -
Zero or one of:
error-handler
Environment variable expansion in the StreamBase Server configuration file works for all environment variables in the UNIX shell that started the sbd process. For Windows, environment variable expansion works for all variables in the System and User environments for the currently logged in Windows user that is running StreamBase Server.
Thus, the use of environment variables in configuration files is not limited to the
STREAMBASE_* variables shown in Environment Variables.
Certain variables, such as STREAMBASE_HOME, are guaranteed
to be set by StreamBase Server, but all other variables are also passed
in from the environment that started StreamBase Server.
You can take advantage of this feature to pass data fields that you do not want to hard-code in the configuration file, such as the username and password for a JDBC connection. For example:
<uri value="jdbc:derby://localhost:1527/mysqldb;user=${MYSQLDB_USER};password=${MYSQLDB_PWD}"/>
Use the ${ENV_VAR} syntax to specify the contents of the variable ENV_VAR. Uppercase is traditional for environment variable names, but
is not required. If you reference a variable that is found to be empty or un-set at
sbd launch time, you receive a
configuration file parsing error, and sbd fails to start.
Identifies the locations of resources, such as custom function plug-ins or modules, that should be loaded when the StreamBase Server runs your application.
Normally, it is not necessary to identify such resources when they are stored and managed within StreamBase Studio. However, you do need to edit the global section to specify the locations of these resources when you deploy applications outside of StreamBase Studio.
In addition, even while working in StreamBase Studio, you may want to store some resources outside of StreamBase Studio. By identifying them here, you can enable applications in your project to locate those resources.
global has one or more of the following child
elements:
-
Zero or more of:
plugin -
Zero or one of:
module-search -
Zero or one of:
operator-resource-search
Example 1. global
The following UNIX example assumes that you have given a value to the
STREAMBASE_HOME environment variable:
<global>
<plugin directory="/usr/share/sbplugins"/>
<module-search directory="/usr/share/sbapps"/>
<operator-resource-search directory="${STREAMBASE_HOME}/resources"/>
</global>
Identifies a custom simple or aggregate function plug-in to be loaded when the application runs. You can have as many plug-in elements as you need, each identifying a different library.
Note that for C++ custom functions, each function name must also be declared in a
custom-functions.
Attributes
| Attribute | Required | Description |
|---|---|---|
| directory | Either this attribute or filename | A directory containing one or more custom function plug-ins (simple and/or aggregate) to be loaded. The StreamBase Server scans each specified directory and loads all the files it finds there. |
| filename | Either this attribute or directory |
A list of one or more paths to individual plug-in files for custom
functions (simple and/or aggregate) that you want to load when your
application runs. Unlike the plugin directory
option, this option causes only the specified files to be loaded.
You can omit the file extension: StreamBase will load the platform-appropriate .so file on UNIX, or .dll file on Windows. |
Note
When running StreamBase in daemon mode (with the -b flag), make sure you use fully qualified paths.
Identifies a directory containing application modules (sbapp or ssql files) to be used by
applications at run time. These external application modules then can be referenced
using a module reference in an EventFlow application, or an APPLY statement in a
StreamSQL application.
When sbd runs the application, it searches for the referenced module in several places (including this configuration file) using a pre-defined sequence. Please refer to Managing Studio Resource Files for the exact sequence.
There are two situations for defining module-search elements:
-
When you deploy an application, its configuration file must identify any modules that are referenced. For more information, see Deploying Applications in the Administration Guide.
-
When you are designing applications in StreamBase Studio, and the referenced modules are outside of your project's workspace instead of within StreamBase Studio.
Attributes
| Attribute | Required | Description |
|---|---|---|
| directory | Yes |
Directory where application modules (.sbapp
or .ssql files) are stored at run time.
The directory must be local (or shared) to the runtime system, and StreamBase Systems recommends using only full pathnames. |
Specifies a directory containing Java operator and adapter resources. These external resources can then be located by StreamBase applications at run time.
When sbd runs the application, it searches for the resources in several places (including this configuration file) using a pre-defined sequence. Please refer to Managing Studio Resource Files for the exact sequence.
There are two situations for defining operator-resource-search elements:
-
When you deploy an application, its configuration file must identify any Java operator and adapter resources used by the application. For more information, see Deploying Applications in the Admin Guide.
-
When you are designing applications in StreamBase Studio, and the resources are outside of your project's workspace instead of within StreamBase Studio.
Attributes
| Attribute | Required | Description |
|---|---|---|
| directory | Yes |
Directory where Java operator or adapter files are stored at run time.
The directory must be local (or shared) to the runtime system, and StreamBase Systems recommends using only full pathnames. |
Specifies aspects of the StreamBase Server that relate to network I/O.
Optionally designates a data directory for disk-based Query Tables (only available in
StreamBase Enterprise Edition), which allows data to persist between
StreamBase Server sessions. The server element has the following child elements :
-
One or more of:
paramwith any of these name-value attribute pairs:
| name Attribute | value Attribute |
|---|---|
| tcp-port | TCP port number to be used for network I/O. Default: 10000. |
| connection-backlog | Number of backlogged connections. Servers with many clients may want to increase the maximum number of backlogged connections to the server. For further details, lookup the manual page for the system call listen. The default is 10. |
| client-heartbeat-interval |
The number of milliseconds between heartbeat packets sent to clients. Clients
can be configured to require a heartbeat packet from the server at a minimum
interval. This is used primarily for network segmentation detection. Setting
client-heartbeat-interval to 0 will disable
heartbeats from the server. Clients connected to such a server will not have
heartbeat protection, regardless of their locally configured minimum
heartbeat interval. The default value is 10000.
|
| datadir (Enterprise Edition only) |
Directory to be used for persistent data from any Query Tables in your
StreamBase application. Note that the datadir value could come
from other sources. The precedence order is:
|
| disk-querytable-cache (Enterprise Edition only) | Amount of main memory that will be allocated to any disk-based Query Table operations. The value units are in MB of main memory and must be a power of 2. When unspecified, the default value is 16 MB. If your application uses disk-based Query Tables, you may be able to improve performance by setting a higher value. However, use caution with setting this parameter, as too high a value may consume more memory than needed and could negatively impact other resources that require memory during the execution of the StreamBase application or other applications. As with any resource setting, you should establish baseline performance metrics and then test the effect of increasing or decreasing values under normal and peak loads. |
| disk-querytable-pagesize (Enterprise Edition only) | The page size used internally for disk-based Query Table operations. You may be able to improve performance by setting a higher value. This page size has nothing to do with the StreamBase page size, nor the operating system (OS) page size. The value units are in KB and must be a power of 2. Valid values are 0, 1, 2, 4, 8, 16, 32 and 64. The default is 0 and means use the OS-dependent default value. |
| disk-querytable-transaction_mode (Enterprise Edition only) |
Mode of transaction support for disk-based Query Tables.
Enumeration: { 0 | 1 | 2 } The default mode is 1, where transactions are enabled, but not flushed to persistent store in any predictable time. Mode 2 will transactionally commit every single table update to persistent store. Mode 0 disables transactional support. Please see the next parameter for a related setting. |
| disk-querytable-logsize (Enterprise Edition only) | If you are using disk-based Query Tables in mode 1 or 2, your Query Table performance may improve if you increase the size of transaction log files. The value units are in MB. The default is 10MB. |
| disk-querytable-flush-interval-ms (Enterprise Edition only) | If you are using disk-based Query Tables in transaction mode 1 or 0, writes to tables are not committed to disk in a predictable time frame. Setting the disk-querytable-flush-interval-ms parameter will force disk commits at the interval specified in milliseconds. Also a flush interval is needed in mode 1 and 2 in order to write a checkpoint and remove unneeded log files. The default interval for mode 0 is no flushing (0) and 30000 (30 seconds) for modes 1 and 2. |
| idle-enqueue-client-timeout-ms, idle-dequeue-client-timeout-ms |
Settings for disconnecting idle clients.
An idle enqueue client is a client who has enqueued at least one tuple and has been idle for idle-enqueue-client-timeout-ms. An idle dequeue client is a client who has subscribed to at least one stream (at any point) and has been idle for idle-dequeue-client-timeout-ms. Clients that have enqueued and subscribed are subject to both settings. The server checks clients every idle-client-check-interval-ms. The actual point that a client is disconnected will be approximate modulo idle-client-check-interval-ms. Values are in milliseconds. Values greater than zero turn these features on. The default is off. |
| idle-client-check-interval-ms | How often the server should check for idle clients. The value is in milliseconds. The default is 60000 (60 seconds). |
| max-persistent-connections |
Maximum number of persistent connections. Each persistent connection uses up
server resources. To protect the server from errant client connections a user
can specify a maximum number of persistent connections. Any attempted client
connections over the limit will be disconnected.
Default value = -1 (no limit). |
| operator-state-change-timeout-ms |
Each Java Operator or Embedded Adapter changes state along with the server
process as a whole. The server waits for each Operator or Adapter to change
state before it completes its state change. The value of operator-state-change-timeout-ms is the amount of time (in
milliseconds) the server will wait before timing out the Operator or Adapter.
If an Operator or Adapter is timed out on a state change, the server shuts
down the Operator or Adapter, and proceeds with its own server state change.
If unspecified in your sbd.sbconf, the default operator-state-change-timeout-ms value is 10000 milliseconds
(ten seconds).
|
Example 5. server
<server>
<param name="tcp-port" value="101000"/>
<param name="connection-backlog" value="12"/>
<param name="datadir" value="/tmp/112233/querytable/last10stocks"/>
<param name="disk-querytable-cache" value="256"/>
<param name="disk-querytable-transaction_mode" value="1"/>
<param name="disk-querytable-flush-interval-ms" value="40000"/>
</server>
Defines memory parameters used by the StreamBase Server. page-pool has the following child elements:
-
One or more of:
paramwith any of these name-value attribute pairs:
| name Attribute | value Attribute |
|---|---|
| page-size |
The size in bytes per page. The StreamBase Server
(sbd) defaults to the proper
minimum value for the machine's architecture. If you change the page-size
value, it must be a multiple of the system page size: 4096 bytes for x86, or
8192 bytes for SPARC.
The StreamBase page size determines the maximum size of a
tuple, so you will need to increase this value if you have large tuples. A
related parameter is:
The initial memory allocation is determined by the JVM heap size for the
hosted StreamBase application. If needed for
StreamBase applications with large memory demands, you can set
a higher initial allocation of heap by specifying |
| max-pooled-pages | Sets the maximum number of pages that will be retained in the application-wide dequeuing client buffer pool. When sbd starts, this pool is empty. As client activity begins, it is dynamically sized to accommodate the sum of max-client-pages from all clients. If client demand subsequently recedes, a certain number of pages is retained in the pool. The default is 1024 pages. |
| max-client-pages |
Sets the maximum number of pages that a dequeue
client connection can allocate. The sbd process will
disconnect clients that try to allocate more. This parameter is designed to
protect sbd from a slow or hung dequeue client. Therefore to understand the
resulting number of bytes allowed, multiply the max-client-pages value by the page-size value. A max-client-pages value of 2048 pages results in about 8
megabytes. If you want to enable a dequeue client connection that would
allocate unlimited memory use, change the max-client-pages value to "0".
|
Example 6. page-pool
In the following configuration example, the administrator decided to increase the page-size and the Java Heap for the StreamBase Server that will host the application:
<page-pool>
<param name="page-size" value="8192"/>
</page-pool>
For related details, see the java-vm section below.
Use this element to specify one or more containers (one per application) that will be
hosted by the StreamBase Server process, and other aspects of the
server's runtime behavior. This includes selecting the now() function's implementation. You can have one or more
application elements in the runtime section. The runtime section
has the following child elements:
-
One or more of:
application -
One or more of:
paramwith any of these name-value attribute pairs:
| name Attribute | value Attribute |
|---|---|
| schema-max-size |
The maximum size of a stream's schema; that is, the total number of bytes of
all fields you expect in the tuple. The default value is 1048576 bytes, which is 1 MB. While there is no theoretical
upper limit, in practice there is a maximum based on the available memory on
the machine(s) that will host the processing of your application. Be cautious
about creating very large schemas, because applications that move smaller
amounts of data perform much better than applications that move tuples
containing unnecessary fields.
|
| cpp-string-field-size |
A default number of characters for strings that are returned between the
runtime and C++ custom functions. Default: 32768.
|
| now-implementation |
StreamBase provides a now()
function to return the current time. With this parameter, you can select one
of two now() implementations. Default:
system.
|
| application-file |
DEPRECATED. The application-file attribute of
the runtime element was deprecated as of
StreamBase 3.7. Use the application element instead.
|
Example 7. runtime
<runtime>
<application file="myapp.ssql" container="A" enqueue="ENABLED" dequeue="ENABLED"/>
<application file="app.ssql" container="B" enqueue="ENABLED" dequeue="DISABLED">
<container-connection dest="B.InputStream1" source="A.OutputStream1"/>
<container-connection dest="B.InputStream2" source="A.InputStream2"/>
</application>
<application file="precomp.sbar" container="C"/>
<param name="cpp-string-field-size" value="65536"/>
<param name="now-implementation" value="system"/>
</runtime>
For related details, see Addressing Entities in Containers in Using Containers, and the java-vm section below.
Use this element to specify the application file to load into a named container.
The application file can be in EventFlow (sbapp),
StreamSQL (ssql), or precompiled (sbar) forms.
Attributes
| Attribute | Required | Description |
|---|---|---|
| file | Yes |
The name of an EventFlow, StreamSQL, or precompiled application file. |
| container | Yes |
The name you assign to the container to hold the specified application.
Use the default container name default, or
another, more descriptive name.
|
| enqueue | No | One of ENABLED, DISABLED, or DROP_TUPLES to specify the startup state of enqueuing for this container. ENABLED is the default settting. If you specify DISABLED, then enqueue attempts are actively refused and exceptions are thrown. If you specify DROP_TUPLES, then tuples are silently dropped. |
| dequeue | No | One of ENABLED, DISABLED, or DROP_TUPLES, as described above. |
| suspend | No |
Use suspend=true to specify that the
application in this container should start up suspended. Specify
false, the default, to have the application
start running when the container is added. You can start a suspended
container with the sbadmin
resume command.
|
| datadir | No |
Specify the absolute path (or a path relative to the running location of
the sbd server) to a
directory to contain the files that implement all disk query tables for
this container. If unspecified, the container uses the --datadir location if specified on the
sbd command line, or the
default temporary location if not.
|
application has the following child elements:
-
One or more of:
container-connection
Example 8. application
<application file="myapp.ssql" container="A"/> <application file="app.ssql" container="B"> <container-connection dest="B.InputStream1" source="A.OutputStream1"/> <container-connection dest="B.InputStream2" source="A.InputStream2"/> </application>
Use this element to identify a container for this server. In the case of multiple
containers, the dest and source attributes can define connections between the containers.
For notation and guidelines, please refer to the section on addressing entities in
Using Containers.
Attributes
| Attribute | Required | Description |
|---|---|---|
| dest | Yes |
The entity (such as an Input Stream) in one named container that will consume the output of the connected source container. |
| source | Yes | The entity in one named container (such as an Output Stream) that will send the data to the destination container. |
Element for all the declarations for a custom function. Has the following child elements:
-
One or more of:
custom-function
Example 10. custom-functions
The custom-functions section is used for two reasons: to register the type signatures of custom C++ functions used in the server, contained in libraries imported using the <plugin> tag in the <global> section above; and to assign short name aliases to C++ or Java functions so they can be called in the same way as built-in functions.
In the following example, a custom simple function named func1 takes a string and an int argument and returns a string
of size 16:
<custom-functions>
<custom-function name="func1" type="simple" >
<args>
<arg type="int" />
<arg type="string" />
</args>
<return type="string" size="16" />
</custom-function>
</custom-functions>
Add the alias attribute to tell StreamBase
to allow you to use a short function name for a given function. For example, the
following would allow you to call the same function in StreamBase
expressions in the form f(myString,
myInt):
<custom-functions>
<custom-function name="func1" type="simple" alias="f">
<args>
<arg type="int" />
<arg type="string" />
</args>
<return type="string" size="16" />
</custom-function>
</custom-functions>
Finally, you can specify the attributes language to be
java and class to be the
fully qualified class name where a named public static function is found. This
allows you to specify short names or alternate names for arbitrary Java
functions. You can also specify the attribute args to
be auto and leave out the args and return-type tags to ask StreamBase to
autodetect them. For example:
<custom-function language="java" class="java.lang.Math"
name="log10" alias="log_base_ten" args="auto"/>
Each C++ simple or aggregate plug-in function must be declared in a custom-function element. Each function must also be imported into a directory specified in the global plug-in element. C++ and Java functions can be assigned aliases. Java functions from public Java classes can be aliased for use as if that function were embedded in your StreamBase application.
Attributes
| Attribute | Required | Description |
|---|---|---|
| name | Yes |
Must match the name used in the application expression that calls the function. |
| type | Yes | Enumeration: { simple | aggregate } |
| alias | No | A substitute name for this function, to be called as alias-name() instead of using calljava(). |
| language | No |
Set to java.
|
| class | No | The fully qualified class name where a named public static function is found. |
| args | No |
Set to auto to have StreamBase
Server autodetect the arguments of the public function.
|
Parent element for all the argument declarations for a function. Has the following child elements:
-
One or more of:
arg
Use this element to define characteristics of the statistics that will be generated for use by the sbmonitor. sbmonitor has the following child elements:
-
One or more of:
paramwith any of these name-value attribute pairs:
| name Attribute | value Attribute |
|---|---|
| enabled |
Either true or false.
Set to true to enable statistics collection, or false to disable it. If it is set to false, sbmonitor will not be usable with the daemon. The default is true. |
| period-ms | Specifies the period, in milliseconds, over which statistics are aggregated. The default is 1000 ms (every second). |
Example 11. sbmonitor
<sbmonitor>
<param name="enabled" value="true"/>
<param name="period-ms" value="2000"/>
</sbmonitor>
The security section controls security and authentication in the sbproxy and sbd. If there is a security section, the
sbd will only listen for connections on
localhost, so connections from remote computers cannot be made. If there is a
security section in the sbconf file, the
sbproxy server will allow only SSL
connections from clients.
Note
This section cannot be configured together with the authentication section, which provides a different
authentication method.
security has one or more of the following child
elements:
-
One of:
ssl-authentication -
One
paramelement using this name-value attribute pair:name Attribute value Attribute perform-authentication - true
-
Restrictions to user actions will be added in this section.
- false
-
All users will be able to perform any action. The client connections will still be SSL, but no further authentication will be performed.
-
Zero or one of:
transform-principal -
Zero or one of:
client-ssl-connections -
Zero or more of:
ldap -
Zero or more of:
role -
Zero or one of:
user-data
Example 12. security
<security>
<ssl-authentication>
<param name="keystore" value="../test/proxy/security/signed.keystore"/>
<param name="keystore-password" value="secret"/>
</ssl-authentication>
<param name="perform-authentication" value="false"/>
<transform-principal>
<param name="searchRegexp" value="cn=([^,]*).*"/>
<param name="replaceRegexp" value="$1"/>
</transform-principal>
<client-ssl-connections>
<param name="require-client-authentication" value="true"/>
<param name="cipher-suite" value="SSL_RSA_WITH_3DES_EDE_CBC_SHA"/>
</client-ssl-connections>
<ldap>
<!-- a TLS auth server -->
<server host="parallels" port="838">
<param name="principal-root" value="ou=Users,dc=example,dc=com"/>
<param name="principal-search" value="cn={0}"/>
<param name="keystore" value="ldapuser.keystore"/>
<param name="keystore-password" value="secret"/>
</server>
</ldap>
<ldap>
<!-- a basic auth server -->
<server host="parallels" port="839">
<param name="principal-root" value="ou=Users,dc=example,dc=com"/>
<param name="principal-search" value="cn={0}"/>
<param name="root-dn" value="cn=Manager,dc=example,dc=com"/>
<param name="password" value="secret"/>
</server>
<role name="StreamBaseSuperuser">
<param name="action" value="Administrate"/>
</role>
<role name="InnocentBystander">
<param name="action" value="Status"/>
<param name="action" value="Enqueue default.InputStream1"/>
<param name="action" value="Dequeue default.OutputStream1"/>
</role>
<user-data>
<user>
<param name="cn" value="cn=Alice Pleasance Liddell,ou=Users,dc=example,dc=com"/>
<param name="role" value="InnocentBystander"/>
<param name="role" value="StreamBaseSuperuser"/>
<param name="password" value="secret"/>
</user>
<user>
<param name="cn" value="EMAILADDRESS=bobn@streambase.com, CN=Bob Newhart,
OU=Users, O=StreamBase Systems, L=Lexington, ST=Massachusetts, C=US"/>
<param name="role" value="InnocentBystander"/>
</user>
</user-data>
</security>
Specifies the keystore that holds the signed X.509 server certificate that will be used for SSL connections between clients and the sbproxy server.
ssl-authentication has the following child
elements:
-
Two
paramelements, each using one of these name-value attribute pairs:name Attribute value Attribute keystore URI of the keystore that identifies a certificate authority (CA). Alternatively, the URI can point to a trust store, which defines multiple CAs that your organization recognizes. keystore-password The password to access the keystore.
Defines a search/replace regular expression that will change the name of the principal. The transform in the preceding security example extracts the CN section from the entire principal's name as it appears in a certificate.
transform-principal has the following child
elements:
-
Two
paramelements, each using one of these name-value attribute pairs:name Attribute value Attribute searchRegexp Matches on a pattern in a field in an LDAP database. replaceRegexp Specifies the replacement pattern.
Defines the type of SSL connection and the external tools used for encryption.
client-ssl-connections has the following child
elements:
-
One of:
paramwith this name-value attribute pair:name Attribute value Attribute require-client-authentication - false
-
SSL connections will be accepted from clients that do not have a signed user certificate. This is sometimes called 1-way SSL, and is the default value. The principal and password attributes (user= and password= attributes) must be specified in the URI, unless the perform-authentication parameter is false (see below)
- true
-
Only client connections that have a certificate signed by a known certificate authority will be allowed. This is sometimes called 2-way SSL. The principal will be taken from the certificate.
-
Zero or more of:
paramwith this name-value attribute pair:name Attribute value Attribute cipher-suite Comma-separated list of cipher suites that can be used for SSL encryption. If this element is not listed, sbproxy uses all the cipher suites that are installed with the JVM. When this element is present, sbproxy is limited to the suites you list. Typical suites for the JDK 1.5 JVM include: SSL_RSA_WITH_RC4_128_MD5, SSL_RSA_WITH_RC4_128_SHA, TLS_RSA_WITH_AES_128_CBC_SHA, TLS_DHE_RSA_WITH_AES_128_CBC_SHA, TLS_DHE_DSS_WITH_AES_128_CBC_SHA, SSL_RSA_WITH_3DES_EDE_CBC_SHA, SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA, SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA, SSL_RSA_WITH_DES_CBC_SHA, SSL_DHE_RSA_WITH_DES_CBC_SHA, SSL_DHE_DSS_WITH_DES_CBC_SHA, SSL_RSA_EXPORT_WITH_RC4_40_MD5, SSL_RSA_EXPORT_WITH_DES40_CBC_SHA, SSL_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA, SSL_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA, SSL_RSA_WITH_NULL_MD5, SSL_RSA_WITH_NULL_SHA, SSL_DH_anon_WITH_RC4_128_MD5, TLS_DH_anon_WITH_AES_128_CBC_SHA, SSL_DH_anon_WITH_3DES_EDE_CBC_SHA, SSL_DH_anon_WITH_DES_CBC_SHA, SSL_DH_anon_EXPORT_WITH_RC4_40_MD5, SSL_DH_anon_EXPORT_WITH_DES40_CBC_SHA, TLS_KRB5_WITH_RC4_128_SHA, TLS_KRB5_WITH_RC4_128_MD5, TLS_KRB5_WITH_3DES_EDE_CBC_SHA, TLS_KRB5_WITH_3DES_EDE_CBC_MD5, TLS_KRB5_WITH_DES_CBC_SHA, TLS_KRB5_WITH_DES_CBC_MD5, TLS_KRB5_EXPORT_WITH_RC4_40_SHA, TLS_KRB5_EXPORT_WITH_RC4_40_MD5, TLS_KRB5_EXPORT_WITH_DES_CBC_40_SHA, TLS_KRB5_EXPORT_WITH_DES_CBC_40_MD5
Specifies information for connecting to and searching LDAP servers to manage user
authentication. Create a separate ldap element
for each LDAP server. If more than one LDAP server is defined, the requests will be
sent to each ldap server in turn, in a round-robin manner. You can configure one or
more LDAP servers.
ldap has the following child elements:
-
One of:
server
Identifies an LDAP server that you want to connect to, and specifies the type of authentication to be used.
Attributes
| Attribute | Required | Description |
|---|---|---|
| host | Yes | The address presented to clients. |
| port | Yes | The port number used by the ldap server. |
server has the following child elements:
-
Two of:
paramelements, each with one of these name-attribute pairs:name Attribute value Attribute principal-root The Distinguished Name pattern that describes the directory information tree on the LDAP server, from the required entry to the directory root. Principal names will be applied to the pattern during authentication. principal-search The field name and index within the LDAP to use when looking up principals. -
One of the following groups of elements:
- To authenticate in the sbconf file
-
Two of:
param, each with one of these name-attribute pairsname Attribute value Attribute root-dn The Distinguished Name pattern that identifies a valid user to the LDAP server. password The password that must be entered to authenticate a user. - To authenticate in LDAP (TLS)
-
Two of:
param, each with one of these name-attribute pairsname Attribute value Attribute keystore URI of the keystore that identifies users for the LDAP server. keystore-password The password to access the keystore.
Use the role element to define a role and assign its actions. You can define any number of roles and use any role names, each with a different combination of actions. Later (in the user-data element) you can assign users to roles.
When a client attempts to perform an action, such as dequeue OutputStream1, the
user is authenticated, then the authentication source (an LDAP server or a
user-data in the sbconf file) is asked for all of the
roles the user has. If the user has as role which has the dequeue
default.OutputStream1 action listed, then the dequeue operation is allowed. .
Attributes
| Attribute | Required | Description |
|---|---|---|
| name | Yes | A name for a group of actions. You can assign any name. |
role has the following child elements:
-
One or more
paramelements with this name-attribute pair:
| name Attribute | value Attribute | |||
|---|---|---|---|---|
| action |
By assigning actions, you determine the commands that a user is authorized to use (and, by omission, not use). Specify one of the following:
|
Defines the Principal-to-role mapping for each user. This section should not be
defined if an ldap section is defined.
user-data has the following child elements:
-
One or more of:
user
A user corresponds to a Principal in an LDAP database. Specifies authentication data and assigns user roles.
user has the following child elements:
-
One of:
paramwith the following name-attribute pair:name Attribute value Attribute cn The full Distinguished Name of the Principal. -
One of:
paramwith the following name-attribute pair:name Attribute value Attribute password The user's password. -
Zero or more of:
paramwith the following name-attribute pair:name Attribute value Attribute
