ONE Desktop ONE DQ&C ONE MDM ONE RDM ONE Runtime Server
latest (15.4.0) 15.3.0 15.2.0 15.1.0 14.5.x 13.9.x 13.8.x 13.7.x 13.6.x 13.5.0 13.4.x 13.3.x 13.2.x
User Community Service Desk Downloads
If you can't find the product or version you're looking for, visit support.ataccama.com/downloads

MDM Server Application Properties

This article is intended to serve as a reference point for MDM server configuration. As such, it provides an overview of the available properties and, when applicable, refers users to more comprehensive sources. The properties described here are defined in the mdm-server/etc/application.properties file. For each property, you will find information about the required data type, its default value, and a short description. The Mandatory column specifies whether a property is required for the application to run and function as expected.

MDM Solution Configuration

The following properties point to files containing additional MDM settings. The paths are relative to the mdm.serverConfig file.

Name Data Type Default Value Mandatory Description

ataccama.one.mdm.mda.config-file

String

mda-config.xml

Yes

The path to the MDM Web App configuration file (see MDM Web App Backend).

ataccama.one.mdm.nme.config-file

String

nme-config.xml

Yes

The path to the MDM Engine configuration file (see MDM Engine Configuration File).

User Settings Configuration

You can configure how and where MDM Web App user settings are stored. User settings include, for example, which columns users have chosen not to display, filter settings, column width settings, and others.

Name Data Type Default Value Mandatory Description

ataccama.one.mdm.user-settings.type

String

jdbc

Yes

  • inmemory - When the in-memory persistence is used, user settings are stored in the web server memory and are lost on server restart.

  • jdbc - When the database persistence is used, users settings are permanently stored in a database. The component creates all the necessary tables when the server is started for the first time.

Keep in mind that in HA mode the in-memory persistence cannot be used and the database persistence option might lead in some cases to inconsistent settings across nodes.

ataccama.one.mdm.user-settings.datasource

String

mdc_db

Yes

The name of the database.

ataccama.one.mdm.user-settings.table-prefix

String

us_

Yes

The tables created by the server have this prefix to distinguish them from other tables in the database.

Task Configuration

Use the follownig properties to configure tasks.

Name Data Type Default Value Mandatory Description

ataccama.one.mdm.task.datasource

String

mdc_db

Yes

The name of the database that is used for storing tasks and drafts.

ataccama.one.mdm.task.table-prefix

String

tasks_

Yes

The prefix that is used for tables created while working with tasks.

ataccama.one.mdm.task.automation.enabled

Boolean

true

No

Enables automatic task creation.

ataccama.one.mdm.task.automation.datasource.name

String

eh_db

No

The name of the database that is used for storing events related to automatic tasks.

ataccama.one.mdm.task.automation.datasource.prefix

String

tasks_

No

The prefix that is used for tables created while working with automatic tasks.

MDM Features

Use these properties to configure specific MDM features and specify links to other applications.

Name Data Type Default Value Mandatory Description

ataccama.one.mdm.ai-matching.enabled

Boolean

false

No

Enables AI Matching in MDM Web App.

ataccama.client.connection.ai.host

String

localhost

No

The IP address or the hostname of the server where AI Matching microservices are running.

ataccama.client.connection.ai.grpc.port

String

8640

No

The number of the AI Matching gRPC port.

ataccama.one.mdm.mmm.enabled

Boolean

false

No

Enables the communication between MDM and Metadata Management Module (MMM). If set to true, the Glossary button and the link to ONE in MDM Web App navigation are shown.

ataccama.one.mdm.mmm.server-url

String

localhost:8021

No

The URL for MMM (mmm-be).

ataccama.one.mdm.mmm.webapp-url

String

localhost:8020

No

The URL to the ONE Web Application (accessible from the left navigation panel).

ataccama.one.mdm.mmm.cleaning-period

String

24

No

Defines how often the MMM node structure is updated. Accepted units: ns (nanoseconds), us `(microseconds), `ms `(milliseconds), `s (seconds), m (minutes), h (hours), d (days). If not specified, the unit is h.

ataccama.one.mdm.rdm.webapp-url

Number

8060

No

The URL shown as the RDM link in the MDM Web App navigation.

ataccama.one.mdm.notifications.enabled

Boolean

true

No

Enables MDM notifications.

ataccama.one.mdm.license-folder

String

./license

No

Path from where the license file can be loaded (in addition to the user home folder). Relative to the MDM Server folder.

ataccama.one.mdm.features.environment.reset.enabled

Boolean

true

Yes

Enables the possibility to reset the environment from the new Admin Center (for user roles defined by the ataccama.one.mdm.admin-center.full-access.required-roles MDM Server application property).

ataccama.one.mdm.server.refresh.dirs-to-delete

String

/

No

Comma separated list of folders, files in which are deleted when the environment is reset.

ataccama.one.mdm.nme.rest.instanceWriteResponse

String

MINIMAL

No

Specifies if the master_id attribute is included in the response from instance write endpoints. Available values:

  • MINIMAL - The response includes only basic information (id, origin, source_id, action).

  • WITH_MASTER_IDS - The response includes basic information plus all master_id column values.

Keycloak Configuration

The following properties configure Keycloak. See Encrypt Passwords for information about how to encrypt passwords.

Name Data type Default Value Mandatory Description

ataccama.authentication.keycloak.realm

String

ataccamaone

Yes

The name of the Keycloak realm.

ataccama.authentication.keycloak.base-url

String

localhost:8083

Yes

The Keycloak base URL.

Do not use / in the end of the URL.

ataccama.authentication.keycloak.server-url

String

${ataccama.authentication.keycloak.base-url}/auth

Yes

The URL of the server where Keycloak is running.

ataccama.authentication.keycloak.admin.client-id

String

mdm-admin-client

Yes

The client identifier used to verify the admin user authorization token.

ataccama.authentication.keycloak.admin.secret

String

mdm-admin-client-s3cret

Yes

The secret key of the client identifier for the admin account. Secret keys can be generated using Keycloak. Used by BASIC and SECRET_JWT strategies.

ataccama.authentication.keycloak.token.client-id

String

mdm-token-client

Yes

The client identifier. Used to verify a user authorization token and to log in a user.

ataccama.authentication.keycloak.token.secret

String

mdm-token-client-s3cret

Yes

The secret key of the client. Secret keys can be generated using Keycloak. Used by BASIC and SECRET_JWT strategies.

ataccama.authentication.keycloak.token.issuer

String

${ataccama.authentication.keycloak.server-url}/realms/${ataccama.authentication.keycloak.realm}

Yes

Specifies the issuer of the JWT token. Typically, Keycloak uses the URL of the realm as the token issuer.

SSL

Use these properties to set up SSL.

Name Data Type Default Value Mandatory Description

server.ssl.enabled

Boolean

true

No

Enables SSL.

server.ssl.key-store

String

/

No

The full path to the keystore.

server.ssl.key-store-password

String

/

No The password for decrypting the keystore. Used if the keystore is encrypted (recommended).

server.ssl.key-password

String

/

No

The password for the private key. Used if the private key is encrypted.

server.ssl.trust-store

String

/

No

The full path to the truststore.

server.ssl.trust-store-password

Logging

The following properties configure logging.

Name Data Type Default Value Mandatory Description

logging.level.root

String

INFO

No

The root logging level. Available values are INFO, WARN, ERROR, DEBUG, OFF.

logging.level.com.ataccama

String

INFO

No

The logging level for com.ataccama packages. Available values are INFO, WARN, ERROR, DEBUG.

logging.file.path

String

./log

No

The path to the logging file.

logging.config

String

classpath:logback-spring.xml

No

The path to the custom logback configuration file.

ataccama.logging.plainTextConsoleAppender

Boolean

true

No

If set to true, logs are outputted as plain text in the console.

ataccama.logging.jsonConsoleAppender

Boolean

false

No

If set to true, logs are outputted in JSON format in the console.

ataccama.logging.plainTextFileAppender

Boolean

false

No

If set to true, logs are outputted as plain text in the log file.

ataccama.logging.jsonFileAppender

Boolean

false

No

If set to true, logs are outputted in JSON format in the log file.

ataccama.one.mdm.db.logging.enabled

Boolean

true

No

Enables SQL logging.

ataccama.one.mdm.db.logging.long-running-operation

String

10s

No

The minimum duration of a logged SQL request. Shorter requests are excluded from the log. Accepted units: ns (nanoseconds), us (microseconds), ms (milliseconds), s (seconds), m (minutes), h (hours), d (days).

ataccama.one.mdm.db.logging.show-parameters

Boolean

false

No

If set to true, the SQL request parameters that are hidden by default and can contain sensitive data are shown. Should not be set to true on systems compliant with the PCI-DSS.

logging.level.com.ataccama.mdm.persistence

String

INFO

No

Defines the logging level:

  • INFO - only logs long-running operations

  • DEBUG - logs all SQL SELECT operations

  • WARN - only logs failed SELECT operations

Logging Filters

Name Data Type Default Value Mandatory Description

logging.filter.on

Boolean

false

No

To log requests made to MDM Server endpoints, set to true.

logging.filter.url

String

/

No

Used to filter logs by URL. If set to a specific endpoint, only traffic for that endpoint will be logged.

logging.filter.includeHeaders

Boolean

false

No

Defines if logs for MDM Server endpoints store the request’s HTTP headers. To log headers, set the value to true.

logging.filter.includePayload

Boolean

true

No

Defines if logs for MDM Server endpoints store the request’s payload. To log payloads, set the value to true.

logging.filter.maxPayloadLength

Number

10000

No

Sets the maximum length of the request’s payload expressed in characters. When the request’s payload exceeds this number, the payload is truncated and logs store only the characters within the limit.

logging.filter.includeQueryString

Boolean

true

No

Defines if logs for MDM Server endpoints store the query string parameters sent with the request. To log all string parameters, set the value to true.

logging.filter.includeClientInfo

Boolean

true

No

Defines if logs for MDM Server endpoints store information about the client that made the request. To log client information, set the value to true.

logging.filter.maskedHeaders

String

host,authorization

No

A list of HTTP headers that are masked in the logs. This is used to prevent leaking sensitive data, such as authentication tokens.

logging.filter.allowRequestHeaderList

String

/

No

A list of HTTP headers that will be logged (other headers will not be logged). Cannot be used together with logging.filter.denyRequestHeaderList.

logging.filter.denyRequestHeaderList

String

/

No

A list of HTTP headers that will not be logged (other headers will be logged). Cannot be used together with logging.filter.allowRequestHeaderList.

Endpoints for Monitoring

To set up monitoring for MDM, specify the following properties. For more information, see Monitoring Configuration.

Name Data Type Default Value Mandatory Description

management.endpoints.enabled-by-default

Boolean

false

No

Enables all actuator endpoints. If set to false, it is possible to configure individually which endpoints should be enabled.

management.endpoint.info.enabled

Boolean

true

No

Enables`/info` monitoring endpoint.

management.endpoint.health.enabled

Boolean

true

No

Enables /health monitoring endpoint.

management.endpoint.prometheus.enabled

Boolean

true

No

Enables /prometheus monitoring endpoint.

management.endpoints.web.exposure.include

String

health,info,prometheus

No

A comma-separated list of exposed actuator endpoints that should provide information about the application. These endpoints track the following:

  • health - The health status of the application.

  • info - Other information about the application.

  • prometheus - Provides all metrics from the application in a format that Prometheus can scrape.

management.endpoint.health.show-details

String

always

No

Specifies how much information is provided by the health monitoring endpoint. The following values are available:

  • never - Health details are never displayed to any user.

  • when-authorized - Only authorized users have access to health information.

  • always - All users can see health details.

management.endpoint.health.show-components

String

always

No

Specifies how much detail the health monitoring endpoint provides about the application components. You can also define which components are shown. The following values are available:

  • never - Component information is never displayed to any user.

  • when-authorized - Only authorized users have access to information about components.

  • always - All users can see component details.

management.endpoint.health.status.order

String

down,out-of-service,reloading,unknown,up

No

A comma-separated list that determines how the /actuator/health monitoring endpoint prioritizes application health statuses.

management.info.git.mode

String

full

No

Configures how much information the /actuator/info monitoring endpoint retrieves from Git about the application source code repository. To show all available information from the git.properties file, set the value to full. To display only basic information, such as the name of the branch, the commit identifier, and the time the commit was made, set the value to simple.

management.endpoint.health.probes.enabled

Boolean

true

No

Enables /actuator/health/liveness and /actuator/health/readiness endpoints.

management.endpoint.health.group.liveness.include

String

diskSpace,ping

No

Defines which components are covered by the liveness probe. These components are a subset of /health components.

management.endpoint.health.group.readiness.include

String

db

No

Defines which components are covered by the readiness probe. These components are a subset of /health components.

ataccama.authentication.http.public-endpoint-restriction-filter

String

/

No

Specifies restricted endpoints that cannot be accessed. Accepts a list of URL patterns as a value.

ataccama.authentication.http.public-endpoints.<key>.endpoint-filter

String

/actuator/health/liveness,/actuator/health/readiness

No

Specifies public endpoints that are excluded from authentication. Accepts a list of URL patterns as a value. The <key> serves for identification only. By default, the key name is actuator.

ataccama.authentication.http.acl.endpoints.<key>.endpoint-filter

String

/actuator/info,/actuator/health,/actuator/prometheus

No

Specifies ACL-secured endpoints. Accepts a list of URL patterns as a value (in version 14.5.2 and earlier, only URL strings are accepted). The <key> serves for identification only. By default, the key name is actuator.

ataccama.authentication.http.acl.endpoints.<key>.allowed-roles

String

ONE_PLATFORM_MONITORING

No

A comma-separated list of user roles allowed to access the ACL-secured endpoints. The <key> serves for identification only. By default, the key name is actuator.

management.metrics.web.server.request.autotime.enabled

Boolean

false

No

Enables timing metrics to all Spring endpoints.

MDM Admin Center Permissions

The following properties configure MDM Admin Center permissions.

Name Data Type Default Value Mandatory Description

ataccama.one.mdm.admin-center.read-only.required-roles

String

MDM_user

No

A comma-separated list of roles with read-only permissions to the MDM Admin Center.

ataccama.one.mdm.admin-center.read-only.match-if-empty

Boolean

true

No

Specifies if read-only access is given to any user in case the list of roles with read-only permissions is empty.

ataccama.one.mdm.admin-center.full-access.required-roles

String

MDM_admin

No

Specifies roles with full access to the MDM Admin Center.

ataccama.one.mdm.admin-center.full-access.match-if-empty

Boolean

false

No

Specifies if full access is given to any user in case the list of roles with full access is empty.

ataccama.one.mdm.admin-center.manager.required-roles

String

MDM_admin

No

Specifies roles with manager access to the MDM Admin Center.

ataccama.one.mdm.admin-center.manager.match-if-empty

Boolean

false

No

Specifies if manager access is given to any user in case the list of roles with manager access is empty.

MDM HTTP Server

The following properties configure the MDM HTTP server.

Name Data Type Default Value Mandatory Description

ataccama.server.http.default.port

Number

8051

Yes

The number of the default server port.

ataccama.server.http.{listener_name}.path.exclude

String

/

No

Specifies the paths that are not available on the defined listener port.

ataccama.server.http.{listener_name}.path.include

String

/

No

Specifies the paths available on the defined port (for example, HA Admin Console, see HA Admin Console, or REST API, see REST API).

ataccama.server.http.{listener_name}.port

Number

/

No

Defines the port for other added custom listener.

MDM Auditing

Use the following properties to configure auditing.

Name Data Type Default Value Mandatory Description

ataccama.one.mdm.audit.enabled

Boolean

true

No

Enables the event log.

ataccama.one.mdm.audit.writters

String

nmeAuditLogWriter,semanticLogWriter

No

A comma-separated list of audit writers. Permitted values are nmeAuditLogWriter (logging events into database) and semanticLogWriter (logging events into server console).

ataccama.one.mdm.audit.nme.table

String

EVENT_LOG

No

The name of the event log table. It is prefixed with the I_ prefix (according to how persistence is implemented in NME).

ataccama.one.mdm.audit.nme.sequence

String

EVENT_LOG_SEQ

No

The name of the ID generator sequence.

ataccama.one.mdm.audit.nme.mapping.id

String

id*

No

The name of the event log entry ID field. It is generated automatically.

ataccama.one.mdm.audit.nme.mapping.msg

String

msg*

No

The name of the event log message field.

ataccama.one.mdm.audit.nme.mapping.username

String

username*

No

The name of the event log username field.

ataccama.one.mdm.audit.nme.mapping.entity

String

entity*

No

The name of the event log entity field.

ataccama.one.mdm.audit.nme.mapping.date

String

date*

No

The name of the event log date field.

ataccama.one.mdm.audit.nme.mapping.operation

String

operation*

No

The name of the event log operation field.

ataccama.one.mdm.audit.nme.mapping.type

String

type*

No

The name of the event log type field.

ataccama.one.mdm.audit.nme.mapping.entity_id

String

entity_id*

No

The name of the event log entity_id field.

  • Default value used if no mapping properties are defined.

HA Configuration

To enable high availability (HA) mode, specify the following properties. For more information about HA, see High Availability Overview.

Name Data Type Default Value Mandatory Description

ataccama.one.mdm.ha.implementation

String

db

No

The HA implementation setting. The default value selects the database locking. Setting the value to zookeeper is possible but unsupported.

ataccama.one.mdm.ha.revoke-leadership-on-disconnect-timeout

String

15s

No

Specifies the timeout in the case of disconnection from the cloud. Can be used only if the ataccama.one.mdm.ha.implementation property is set to zookeeper. The minimum value is 3s.

ataccama.one.mdm.ha.max-active-to-passive-switching-time

String

20s

No

Defines the maximum time interval that the safety watchdog waits for switching from active to passive state of mdm_ha_node. Accepted units: ns (nanoseconds), us (microseconds), ms (milliseconds), s (seconds), m (minutes), h (hours), d (days).

ataccama.one.mdm.ha.load-balancer.port

Number

8058

No

The number of the port where the HA load balancer is running.

ataccama.one.mdm.ha.local-target-server.name

String

default

No

The name of the server where the MDM server instance is running.

ataccama.one.mdm.ha.local-target-server.port

String

${ataccama.server.http.${ataccama.one.mdm.ha.local-target-server.name}.port}

No

The name of the port where the MDM server instance is running.

ataccama.one.mdm.ha.server-name

String

mdm-server_1

No

The name of the server where the MDM server instance is running.

ataccama.one.mdm.ha.allow-disconnect-button

Boolean

false

No

Enables the Disconnect button in the HA console.

ataccama.one.mdm.ha.load-balancer.server

String

0.0.0.0

No

The IP address of the server where HA load balancer is running.

ataccama.one.mdm.ha.load-balancer.hostname

String

<assigned automatically>

No

Visible in the HA console. Overrides the ataccama.one.mdm.ha.server-name if defined.

ataccama.one.mdm.ha.db.name

String

mdc_db

No

The name of the HA database.

ataccama.one.mdm.ha.db.table-prefix

String

ha_

No

The table prefix for Lock and HA node.

ataccama.one.mdm.ha.db.lock-key

String

MDM_LEADER_INSTANCE

No

The key for the HA leader instance.

ataccama.one.mdm.ha.db.heartbeat.interval

Number

5000

No

Specifies how often the HA tables are updated. Accepted units: ns (nanoseconds), us (microseconds), ms (milliseconds), s (seconds), m (minutes), h (hours), d (days). If not specified, the unit is ms.

ataccama.one.mdm.ha.db.heartbeat.expiration

Number

30000

No

Defines the time interval after which expired entries are removed from the HA tables. Accepted units: ns (nanoseconds), us (microseconds), ms (milliseconds), s (seconds), m (minutes), h (hours), d (days). If not specified, the unit is ms.

ataccama.one.mdm.ha.db.heartbeat.ttl

Number

30000

No

Defines the time interval after which entries are marked as expired. Accepted units: ns (nanoseconds), us (microseconds), ms (milliseconds), s (seconds), m (minutes), h (hours), d (days). If not specified, the unit is ms.

ataccama.one.mdm.ha.db.election.interval

Number

5000

No

Defines the time interval after which the leadership election workflow is called. Accepted units: ns (nanoseconds), us (microseconds), ms (milliseconds), s (seconds), m (minutes), h (hours), d (days). If not specified, the unit is ms.

ataccama.one.mdm.ha.db.election.startup-timeout

String

${random.int(10000)}

No

Specifies the start delay of the leadership election workflow. Expressed in ms.

ataccama.one.mdm.ha.rw-additional-timeout

Number

3000ms

No

Specifies the additional delay in the case of switching from passive mode to active. The whole delay is ataccama.one.mdm.ha.max-active-to-passive-switching-time + ataccama.one.mdm.ha.rw-additional-timeout.

ataccama.one.mdm.ha.close-additional-timeout

Number

4s

No

Specifies the delay before HA is closed. Accepted units: ns (nanoseconds), us (microseconds), ms (milliseconds), s (seconds), m (minutes), h (hours), d (days).

AI Matching

If you want to generate a new key, you need to provide new sets of keys for both Matching Manager microservice and Matching Worker microservice, and the Matching Worker microservice has to be connected to the MDM Server. If you are not using AI Matching, remove or comment out the properties.

Name Data Type Default Value Mandatory Description

ataccama.one.platform.deployments.ai.uri

String

localhost:8640

Yes

The number of the port where AI Matching microservices are running.

ataccama.one.platform.deployments.ai.module

String

ai

Yes

The name of the module type.

ataccama.one.platform.deployments.ai.environment

String

dev

Yes

The name of the environment.

ataccama.one.platform.deployments.ai.security.jwt-keys.key1.name

String

AI

Yes

The name of the public key.

ataccama.one.platform.deployments.ai.security.jwt-keys.key1.fingerprint

String

/

Yes

The key identifier (kid) value from the file containing the Public and Private Keypair.

ataccama.one.platform.deployments.ai.security.jwt-keys.key1.content

String

/

Yes

The value of the public key. Must use JSON syntax and be provided on a single line.

ataccama.one.platform.deployments.ai.security.jwt-keys.key1.isRevoked

Boolean

false

Yes

Specifies if the public key is valid. If set to true, the key is rejected.

ataccama.one.platform.deployments.ai.security.roles

String

IMPERSONATION

Yes

The user role used to create the service identity during authentication.

DPM Setup

If your product suite includes ONE, configure DPM using the following properties. The JWT secret and the accompanying properties for DPM that are used for communication with ONE can be found in the /opt/ataccama/one/mmm-backend/etc/application.properties configuration file. If you want to generate a new key for the connection between DPM and MDM, follow the instructions in How to Generate JWT Keys.

Name Data Type Default Value Mandatory Description

ataccama.one.platform.deployments.dpm.uri

String

localhost:8031

No

The number of the port where DPM is running.

ataccama.one.platform.deployments.dpm.module

String

dpm

No

The name of the module type.

ataccama.one.platform.deployments.dpm.environment

String

dev

No

The name of the environment.

ataccama.one.platform.deployments.dpm.security.jwt-keys.key1.name

String

dpm

No

The name of the public key.

ataccama.one.platform.deployments.dpm.security.jwt-keys.key1.fingerprint

String

/

No

The key identifier (kid) value from the file containing the Public and Private Keypair.

ataccama.one.platform.deployments.dpm.security.jwt-keys.key1.content

String

/

No

The value of the public key. The value must use JSON syntax and be provided on a single line.

ataccama.one.platform.deployments.dpm.security.jwt-keys.key1.isRevoked

Boolean

false

No

Specifies if the public key is valid. If set to true, the key is rejected.

ataccama.one.platform.deployments.dpm.security.roles

String

IMPERSONATION

No

The user role used to create the service identity during authentication.

MDM gRPC Server

The following property configures the MDM gRPC server.

Name Data Type Default Value Mandatory Description

ataccama.server.grpc.port

Number

8551

Yes

The number of the port where the gRPC server is running. Authentication depends on the Keycloak configuration.

Configuration Service

The following property sets whether the Configuration Service is used.

Name Data Type Default Value Mandatory Description

ataccama.config-service.runtime

String

off

Yes

Enables using the Configuration Service. Valid values: off, optional, mandatory. If set to mandatory, the module fails when there is an error connecting to the Configuration Service.

Service Private Key

Provide the service private key for MDM using the following property. The key must be set if your instance uses any of the following modules: Configuration Service, AI Matching, ONE Platform.

Name Data Type Default Value Mandatory Description

ataccama.authentication.internal.jwt.generator.key

String

/

No

The key generated for internal JWT authentication.

GraphQL and CORS

Set these properties if you use GraphQL and CORS. Otherwise, you can remove or comment them out.

Name Data Type Default Value Mandatory Description

ataccama.one.webserver.gql.default-allow

Boolean

true

No

If set to true, all roles are allowed to access the MDM GraphQL endpoint.

graphql.servlet.mapping

String

/api/graphql/mda

No

MDM uses the custom servlet mapping /api/graphql/mda instead of the default /graphql.

graphql.servlet.exceptionHandlersEnabled

Boolean

true

No

If set to true, additional data is printed to error output.

graphql.servlet.async-mode-enabled

Boolean

false

No

Enables asynchronous mode. Must be set to false to keep track of the currently logged-in user and the correlation ID that is used for auditing and logging purposes.

graphql.servlet.cors.allowed-origins

String

*

No

Specifies all origins allowed for all GraphQL tools.

graphql.servlet.cors.allowed-headers

String

*

No

Specifies all headers allowed (content-type, authorization are required).

graphql.servlet.actuator-metrics

Boolean

true

No

If set to`true`, the GraphQL metric is exposed to the actuator.

management.endpoints.web.cors.allowed-origins

String

*

No

Specifies all origins allowed for the management endpoint.

management.endpoints.web.cors.allowed-headers

String

*

No

Specifies all headers allowed.

management.endpoints.web.cors.allowed-methods

String

*

No

Specifies the HTTP methods allowed.

External Drivers Folder

You can specify the location of external drivers using the following property.

Name Data Type Default Value Mandatory Description

ataccama.one.mdm.external.drivers.paths

String

./lib-ext

No

A comma-separated list of paths to the directories with additional, non-standard drivers (relative to user.dir).

Client Security Headers

You can configure MDM Server security by adding response headers (security headers) to HTTP responses from the server.

Name Data Type Default Value Mandatory Description

one.security.header.content-security-policy.connect-src

String

'self' ${ataccama.authentication.keycloak.server-url}

No

Specifies allowed connections. We strongly recommend using the default value.

one.security.header.content-security-policy.script-src

String

* 'unsafe-inline' 'unsafe-eval'

No

Specifies allowed script sources. We strongly recommend using the default value.

one.security.header.content-security-policy.img-src

String

'self' data:

No

Specifies allowed image sources. We strongly recommend using the default value.

one.security.header.X-Frame-Options

String

deny

No

Protects against clickjacking. If set to deny, iframes are disabled.

one.security.header.X-Permitted-Cross-Domain-Policies

String

none

No

Specifies if cross-domain requests from Flash and PDF documents are allowed.

one.security.header.Referrer-Policy:

String

strict-origin

No

Defines how much referrer information (sent with the Referer header) should be included with requests. If set to strict-origin, only the origin is sent.

one.security.header.X-XSS-Protection

String

1; mode=block

No

Protects against cross-site scripting attacks. If set to block, the page doesn’t load when an attack is detected.

one.security.header.X-Content-Type-Options

String

nosniff

No

Protects against MIME sniffing.

Request Response Time Logging

Use the following properties to log the response time of the MDM Server.

Name Data Type Default Value Mandatory Description

request-response-time-logger.filter.enabled

Boolean

false

No

To log request response time, set to true.

request-response-time-logger.filter.name

String

/

No

Name of the logger that will appear in the log.

request-response-time-logger.filter.level

String

DEBUG

No

Defines the logging level:

  • OFF - logs nothing

  • FATAL - logs fatal errors only

  • WARNING - logs warning messages only

  • INFO - logs informative messages only

  • DEBUG - logs debug messages only

  • ALL - logs all events

request-response-time-logger.filter.headers

String

/

No

Comma-separated list of sub-elements containing HTTP header names that will be printed together with the log message.

request-response-time-logger.filter.appendClientInfo

Boolean

false

No

If set to true, the message will include client IP address and port.

request-response-time-logger.filter.urlPatterns

String

/

No

List of URL patterns where the filter will be registered.

Reply with Headers

Use the following properties to include additional HTTP headers from the request in the server response.

Name Data Type Default Value Mandatory Description

reply-with-headers.filter.enabled

Boolean

false

No

If set to true, the filter is enabled.

reply-with-headers.filter.headers

String

No

Comma-separated list of additional headers to be included in the response.

reply-with-headers.filter.urlPatterns

String

No

List of URL patterns where the filter will be registered.

Retry Connection Functionality

Use the following properties to configure repeated attempts for initial connection to critical components.

Retry Default Configuration

Name Data Type Default Value Mandatory Description

resilience4j.retry.configs.default.maxAttempts

Number

3

Yes

The maximum number of attempts (including the initial call as the first attempt).

resilience4j.retry.configs.default.waitDuration

Number

1000

Yes

A fixed wait duration between retry attempts (in milliseconds).

resilience4j.retry.configs.default.retryExceptions

String

java.lang.Exception

Yes

Configures a list of Throwable classes that are recorded as a failure and thus are retried.

MDM-MMM Retry Setup

Name Data Type Default Value Mandatory Description

resilience4j.retry.configs.mdm-mmm.maxAttempts

Number

3

Yes

The maximum number of attempts (including the initial call as the first attempt).

resilience4j.retry.configs.mdm-mmm.waitDuration

Number

5000

Yes

A fixed wait duration between retry attempts (in milliseconds).

resilience4j.retry.configs.mdm-mmm.retryExceptions

String

java.lang.Exception

Yes

Configures a list of Throwable classes that are recorded as a failure and thus are retried.

MDM-AI Retry Setup

Name Data Type Default Value Mandatory Description

resilience4j.retry.configs.mdm-ai.maxAttempts

Number

3

Yes

The maximum number of attempts (including the initial call as the first attempt).

resilience4j.retry.configs.mdm-ai.waitDuration

Number

5000

Yes

A fixed wait duration between retry attempts (in milliseconds).

resilience4j.retry.configs.mdm-ai.retryExceptions

String

java.lang.Throwable

Yes

Configures a list of Throwable classes that are recorded as a failure and thus are retried.

MDM-Keycloak Retry Setup

Name Data Type Default Value Mandatory Description

resilience4j.retry.configs.mdm-keycloak.maxAttempts

Number

3

Yes

The maximum number of attempts (including the initial call as the first attempt).

resilience4j.retry.configs.mdm-keycloak.waitDuration

Number

5000

Yes

A fixed wait duration between retry attempts (in milliseconds).

resilience4j.retry.configs.mdm-keycloak.retryExceptions

String

java.lang.Throwable

Yes

Configures a list of Throwable classes that are recorded as a failure and thus are retried.

Retry Instances

Name Data Type Default Value Mandatory Description

resilience4j.retry.instances.mdm-mmm.baseConfig

String

` mdm-mmm`

Yes

Internal reference to MMM resilience4j setup. Not user-configurable.

resilience4j.retry.instances.mdm-ai.baseConfig

String

mdm-ai

Yes

Internal reference to AI resilience4j setup. Not user-configurable.

resilience4j.retry.instances.mdm-keycloak.baseConfig

String

mdm-keycloak

Yes

Internal reference to Keycloak resilience4j setup. Not user-configurable.

Data Source Configuration

The following properties define the internal data source configuration. See Data Sources Connection.

Note that a data source can be defined either here, or in the mdm.runtimeConfig, not in both places at once.

Name Data Type Default Value Mandatory Description

ataccama.one.mdm.datasource.mdc_db.url

String

jdbc:postgresql://localhost:5432/mdc

No

URL for the MDM persistence database connection.

ataccama.one.mdm.datasource.mdc_db.waiting.timeout

String

5m

No

Timeout for reconnection attempts to the MDM persistence database (in minutes).

ataccama.one.mdm.datasource.mdc_db.waiting.interval

String

5s

No

Interval for reconnection attempts to the MDM persistence database (in seconds).

ataccama.one.mdm.datasource.mdc_db.username

String

mdc

No

Username for the MDM persistence database connection.

ataccama.one.mdm.datasource.mdc_db.password

String

mdc

No

Password for the MDM persistence database connection.

ataccama.one.mdm.datasource.{additional_data_source_name}.url

String

No

URL for additional data source connections.

ataccama.one.mdm.datasource.{additional_data_source_name}.waiting.timeout

String

No

Timeout for reconnection attempts (in minutes).

ataccama.one.mdm.datasource.{additional_data_source_name}.waiting.interval

String

No

Interval for reconnection attempts (in seconds).

ataccama.one.mdm.datasource.{additional_data_source_name}.username

String

No

Username for additional data source connections.

ataccama.one.mdm.datasource.{additional_data_source_name}.password

String

No

Password for additional data source connections.

API Endpoint Required Role Configuration

You can configure required roles for MDM API endpoints by adding the following properties. For more information about how to authenticate API requests, see API Requests Authentication.

Name Data Type Default Value Mandatory Description

ataccama.authentication.http.acl.endpoints.onlineServices.endpoint-filter=/soapServices/**

String

/

No

<API-endpoint> specifies the API endpoint. For example, onlineServices.

ataccama.authentication.http.acl.onlineServices.actuator.allowed-roles=<MY_REQUIRED_ROLE>

String

/

No

<MY_REQUIRED_ROLE> is a comma-separated list of user roles allowed to access the ACL-secured endpoint.

Version Check

Name Data Type Default value Mandatory Description

ataccama.one.mdm.version.check

Boolean

true

No

When set to true, the MDM Version Check is enabled (see MDM Version Check).

Rate Limiter

Available in version 14.5.2-patch2 and later.

For example configuration and more details, see Rate Limiter.

Name Data Type Default Value Mandatory Description

ataccama.server.ratelimiter.enabled

Boolean

false

No

If set to true, the rate limiter is enabled.

ataccama.server.ratelimiter.http.<limiter>.urls

String

No

Comma-separated list of URL prefixes. Can also contain the HTTP method.

The most precise rate limiter is used and in case there are multiple matches, the HTTP method is taken into consideration as well.

Resilience4j

Name Data Type Default Value Mandatory Description

resilience4j.ratelimiter.instances.<RateLimiterName>.limit-for-period

Number

No

The maximum allowed number of operations within a defined time period. For example, if you set the value to 10, a user can perform a maximum of 10 operations within the time period specified by the limit-refresh-period property.

resilience4j.ratelimiter.instances.<RateLimiterName>.limit-refresh-period

String

No

The time period after which the limit for the number of operations is refreshed. For example, if you set the value to 1s, the limit for the number of operations is refreshed every second.

resilience4j.ratelimiter.instances.<RateLimiterName>.timeout-duration

String

No

Specifies how long to wait for a request to be processed before it’s considered a failure. If this period elapses, the request is considered unsuccessful.

resilience4j.ratelimiter.instances.<RateLimiterName>.register-health-indicator

Boolean

No

Determines whether to register a health indicator for the specified rate limiter. If set to true, a health indicator is available within Spring Boot actuators, allowing you to monitor the rate limiter’s status. We recommend enabling it for debugging or monitoring purposes.

Database Performance

Available in version 14.5.3 and later.
Applies only to PostgreSQL databases.
Name Data Type Default Value Mandatory Description

ataccama.one.mdm.inlist.db.settings.random-page-cost

Number

40

No

Specifies the random_page_cost parameter for PostgreSQL databases while performing InList operations. Applied on the database session level. Possible values: 0.0 - 100.0.

ataccama.one.mdm.inlist.db.settings.work-mem-mega-bytes

Number

60

No

Specifies the work_mem parameter for PostgreSQL while performing InList operations. Applied on the database session level. Possible values: 2 - 1024.

Was this page useful?