Ataccama ONE Agentic ONE Desktop ONE DQ&C ONE MDM ONE RDM ONE Runtime Server
latest (17.1.0) 17.0.0 16.3.x 16.2.0 16.1.0 16.0.0 15.4.0 15.3.0 15.2.0 15.1.0 14.5.x 13.9.x 13.8.x 13.7.x 13.6.x 13.5.0 13.4.x 13.3.x 13.2.x
Downloads

MDM Web App Application Properties

This article is intended to serve as a reference point for MDM Web App configuration. As such, it provides an overview of the available properties and, when applicable, refers users to more comprehensive sources. The properties described here are defined in the mdm/etc/application.properties file. For each property, you will find information about the required data type, its default value, and a short description. The Mandatory column specifies whether a property is required for the application to run and function as expected. For certain features (such as SSL), several properties must be configured at the same time for the feature to work. Refer to the property descriptions for details.

MDM Web App

Use these properties to specify details about the MDM Web App URLs. For an overview of all ports used by MDM components and how to change them, see Default ports.

Name Data Type Default Value Mandatory Description

server.port

Number

8050

Yes

The number of the port where MDM Web App is running.

management.server.port

Number

8055

No

The number of the HTTP port for the management endpoint for actuators.

ataccama.one.mda.max.connections

Number

50

Yes

The maximum number of simultaneously opened HTTP connections between the web server (embedded Tomcat in the Springboot) and MDM Web App.

MDM Server connectivity

Use these properties to specify details about the MDM Server location, adjustments of MDM Web App URLs, and connectivity settings.

In this section, the term MDM Server refers specifically to the MDM Web App backend component. It always runs within the MDM Server context, so the URLs for both are the same.
Name Data Type Default Value Mandatory Description

ataccama.one.mda.server.url

String

http://localhost:8051

Yes

The URL of the server where MDM Server is running. Only used when the private and public URLs specified below are not defined.

ataccama.one.mda.server.private.url

String

${ataccama.one.mda.server.url}

No

The private URL of the server where MDM Server is running. Used for communication between MDM Web App and the MDM backend.

ataccama.one.mda.server.public.url

String

${ataccama.one.mda.server.url}

No

The public URL of the server where MDM Server is running. Used for communication between React-based SPAs (like the Admin Center) and the MDM backend.

ataccama.one.mda.server.read.only.url

String

${ataccama.one.mda.server.url}

Yes

The URL of MDM Server for HA read-only requests.

ataccama.one.mda.server.health.url

String

http://localhost:8058/actuator/health/liveness

No

Specifies the URL of MDM Server to perform health checks of its availability.

ataccama.one.mda.server.manager.url

String

http://localhost:8057/manager/graphql

Yes

The URL of the Server Manager GraphQL endpoint, which provides the Server Dashboard in the MDM Admin Center. Set it to http://<mdm server address>:<server manager port>/manager/graphql, for example, http://mdm-server.example.com:8057/manager/graphql.

Unlike the other properties in this section, this URL does not point to the MDM Server HTTP port (8051 by default) but to the Server Manager port (8057 by default). If you change the endpoint path with dgs.graphql.path, update this property to match. For details, see MDM Server Manager Properties > GraphQL endpoints.

The Admin Center calls this endpoint directly from the user’s browser, and the URL is included in the connect-src directive of the Content Security Policy header. For this reason, the URL must be resolvable and reachable from the browser, not only from MDM Web App. In deployments behind a reverse proxy or ingress, use the externally reachable address.

MDM features

Name Data Type Default Value Mandatory Description

ataccama.one.mda.features.environment.reset.enabled

Boolean

true

Yes

Enables the possibility to reset the environment from the new Admin Center (for user roles defined by the ataccama.one.mdm.admin-center.full-access.required-roles MDM Server application property).

ataccama.one.mda.features.git.operations.enabled

Boolean

false

No

Enables Git operations in MDM Web App Admin Center. Shows the Clone config repository option on the Server Dashboard.

ataccama.authentication.http.public-endpoints.public-pages.endpoint-filter

String

/auth-error/**,/styles/**,/images/**

No

Specifies the endpoint filter for excluding the Keycloak authentication error page from security checks.

ataccama.one.mda.backward-compatibility.trailing-slashes

Boolean

false

No

Enables the use of trailing slashes in API URLs for the MDM Web App.

Keycloak

The following properties configure Keycloak. See Encrypt Passwords for information on how to encrypt passwords.

Name Data Type Default Value Mandatory Description

ataccama.authentication.keycloak.server-url

String

http://localhost:8083/auth

Yes

The URL of the server where Keycloak is running.

ataccama.authentication.keycloak.realm

String

ataccamaone

Yes

The name of the Keycloak realm.

ataccama.authentication.keycloak.token.client-id

String

<YOUR-KEYCLOAK-CLIENT-ID>

Yes

The client identifier. Used to verify a user authorization token and to log in a user.

ataccama.authentication.keycloak.public.client-id

String

${ataccama.authentication.keycloak.token.client-id}

Yes

Keycloak public client ID for web application browsing.

ataccama.authentication.keycloak.token.issuer

String

${ataccama.authentication.keycloak.server-url}/realms/${ataccama.authentication.keycloak.realm}

Yes

Specifies the issuer of the JWT token. Typically, Keycloak uses the URL of the realm as the token issuer.

ataccama.authentication.keycloak.admin.enable

Boolean

true

No

Enables access to Keycloak API with admin rights to perform health checks.

Obsolete. From versions 13.9.4, 14.4.0, and 15.1.0, and later it must be set to true or not defined at all.

ataccama.authentication.keycloak.token.secret

String

mdm-webapp-public-client-s3cret

Yes

The public key of the client.

Request header is too large error when logging in

If you encounter an HTTP 400 Bad Request response with Request header is too large error when logging in with a user that has many roles assigned (>100), increase the maximum HTTP header size. This prevents the authentication token from exceeding header limits.

Add or edit the following property:

server.max-http-request-header-size=32768
Name Data type Default value Mandatory Description

server.max-http-request-header-size

String

8kB

No

Set the maximum size of the request header in Spring Boot.

SSL

Use these properties to make MDM Web App serve HTTPS instead of HTTP on server.port.

By default, MDM Web App serves plain HTTP and none of the server.ssl.* properties is present in application.properties. To enable HTTPS, set the server.ssl.enabled property to true and configure a keystore using server.ssl.key-store.

If you enable HTTPS without providing a keystore, MDM Web App fails on startup with the SSL is enabled but no trust material is configured error.

Minimal HTTPS configuration
server.ssl.enabled=true
server.ssl.key-store=/opt/ataccama/mdm-web-server/etc/mdm-web-app.p12
server.ssl.key-store-password=<keystore_password>
server.ssl.key-store-type=PKCS12

For all supported options, refer to the official Spring Boot documentation.

Name Data Type Default Value Mandatory Description

server.ssl.enabled

Boolean

true

No

Enables HTTPS. To use HTTPS, set the property to true and configure a keystore in server.ssl.key-store. Set to false to serve plain HTTP.

server.ssl.key-store

String

/

No

The full path to the keystore that contains the server certificate and its private key. To switch MDM Web App from HTTP to HTTPS, ensure server.ssl.enabled is also set to true.

server.ssl.key-store-password

String

/

No

The password for the keystore. Required if the keystore is password-protected.

server.ssl.key-store-type

String

/

No

The keystore type, for example PKCS12 or JKS. If not set, the default keystore type of the Java runtime is used.

server.ssl.key-password

String

/

No

The password of the private key inside the keystore. Set it only if the key is protected by a different password than the keystore.

server.ssl.trust-store

String

/

No

The full path to the truststore with the certificates of trusted clients. Not needed for standard HTTPS. Used only when clients authenticate with certificates (server.ssl.client-auth).

server.ssl.trust-store-password

String

/

No

The password for the truststore.

Logging

The following properties configure logging.

Name Data Type Default Value Mandatory Description

logging.level.root

String

INFO

No

The root logging level. Available values are INFO, WARN, ERROR, DEBUG, OFF.

logging.level.com.ataccama

String

INFO

No

The logging level for com.ataccama packages. Available values are INFO, WARN, ERROR, DEBUG.

logging.level.com.ataccama.mda

String

DEBUG

No

Logging level for MDM Web App packages.

ataccama.logging.plainTextConsoleAppender

Boolean

true

No

If set to true, logs are outputted as plain text in the console.

ataccama.logging.jsonConsoleAppender

Boolean

false

No

If set to true, logs are outputted in JSON format in the console.

ataccama.logging.plainTextFileAppender

Boolean

false

No

If set to true, logs are outputted as plain text in the log file.

ataccama.logging.jsonFileAppender

Boolean

true

No

If set to true, logs are outputted in JSON format in the log file.

Endpoints for monitoring

The following properties configure monitoring. For more information, see Monitoring Configuration.

Name Data Type Default Value Mandatory Description

management.endpoints.enabled-by-default

Boolean

false

No

Enables all actuator endpoints. If set to false, it is possible to configure individually which endpoints should be enabled.

management.endpoint.info.enabled

Boolean

true

No

Enables /info monitoring endpoint.

management.endpoint.health.enabled

Boolean

true

No

Enables /health monitoring endpoint.

management.endpoint.prometheus.enabled

Boolean

true

No

Enables /prometheus monitoring endpoint.

management.endpoints.web.exposure.include

String

health,info,prometheus

No

A comma-separated list of exposed actuator endpoints that should provide information about the application.

These endpoints track the following:

  • health: The health status of the application.

  • info: Other information about the application.

  • prometheus: Provides all metrics from the application in a format that Prometheus can scrape.

management.endpoint.health.show-details

String

always

No

Specifies how much information is provided by the health monitoring endpoint. The following values are available:

  • never: Health details are never displayed to any user.

  • when-authorized: Only authorized users have access to health information.

  • always: All users can see health details.

management.endpoint.health.show-components

String

always

No

Specifies how much detail the health monitoring endpoint provides about the application components. You can also define which components are shown. The following values are available:

  • never: Component information is never displayed to any user.

  • when-authorized: Only authorized users have access to information about components.

  • always: All users can see component details.

management.endpoint.health.status.order

String

down,out-of-service,reloading,unknown,up

No

A comma-separated list that determines how the /health monitoring endpoint prioritizes application health statuses.

management.info.git.mode

String

full

No

Configures how much information the /info monitoring endpoint retrieves from Git about the application source code repository. To show all available information from the git.properties file, set the value to full. To display only basic information, such as the name of the branch, the commit identifier, and the time the commit was made, set the value to simple.

management.endpoint.health.probes.enabled

Boolean

true

No

Enables /health/liveness and /health/readiness endpoints `management.endpoint.health.group.liveness.include`StringdiskSpace,pingNo

management.endpoint.health.group.liveness.include

String

diskSpace,ping

No

Defines which components are covered by the liveness probe. These components are a subset of /health components.

management.endpoint.health.group.readiness.include

String

db

No

Defines which components are covered by the readiness probe. These components are a subset of /health components.

ataccama.authentication.http.acl.endpoints.prometheus.endpoint-filter

String

/actuator/prometheus

No

Allows access to the endpoint defined in the endpoint-filter property for the selected user roles.

ataccama.authentication.http.acl.endpoints.prometheus.allowed-roles

String

ONE_PLATFORM_MONITORING

No

A comma-separated list of user roles allowed to access the Prometheus endpoint.

management.metrics.web.server.request.autotime.enable

Boolean

false

No

Enables recording metrics for all Spring MVC requests.

management.metrics.web.server.auto-time-requests

Boolean

false

No

Timing metrics to all Spring endpoints.

ataccama.one.mda.server.health.url

String

http://localhost:8058/actuator/health/liveness

No

Specifies the URL for performing health checks between MDM Web App and MDM Server.

Client security headers

You can configure MDM Web App security by adding response headers (security headers) to HTTP responses from the web application.

We recommend setting security headers to help protect your web application against potential security threats.
Name Data Type Default value Mandatory Desription

one.security.header.content-security-policy.connect-src

String

'self' ${ataccama.authentication.keycloak.server-url}

No

Specifies allowed connections. We strongly recommend using the default value.

one.security.header.content-security-policy.script-src

String

* 'unsafe-inline' 'unsafe-eval'

No

Specifies allowed script sources. We strongly recommend using the default value.

one.security.header.content-security-policy.img-src

String

'self' data:

No

Specifies allowed image sources. We strongly recommend using the default value.

one.security.header.X-Frame-Options

String

deny

No

Protects against clickjacking. If set to deny, iframes are disabled.

one.security.header.X-Permitted-Cross-Domain-Policies

String

none

No

Specifies if cross-domain requests from Flash and PDF documents are allowed.

one.security.header.Referrer-Policy:

String

strict-origin

No

Defines how much referrer information (sent with the Referer header) should be included with requests. If set to strict-origin, only the origin is sent.

one.security.header.X-XSS-Protection

String

1; mode=block

No

Protects against cross-site scripting attacks. If set to block, the page doesn’t load when an attack is detected.

one.security.header.X-Content-Type-Options

String

nosniff

No

Protects against MIME sniffing.

Retry connection functionality

Use the following properties to configure repeated attempts for initial connection to critical components.

MDM-gRPC retry setup

Name Data Type Default value Mandatory Desription

resilience4j.retry.configs.mdm-grpc.maxAttempts

Number

3

Yes

The maximum number of attempts (including the initial call as the first attempt).

`resilience4j.retry.configs.mdm-grpc.waitDuration

Number

5000

Yes

A fixed wait duration between retry attempts (in milliseconds).

resilience4j.retry.configs.mdm-grpc.retryExceptions

String

java.lang.Throwable

Yes

Configures a list of Throwable classes that are recorded as a failure and thus are retried.

Retry instances

Name Data Type Default value Mandatory Desription

resilience4j.retry.instances.mdm-grpc.baseConfig

String

mdm-grpc

Yes

Internal reference to gRPC resilience4j setup. Not user-configurable.

Environment banner in MDM Web App Admin Center

Available from 16.3.1.
Name Data Type Default value Mandatory Desription

ataccama.one.mda.application.environment.label

String

No

Sets the environment name used in the environment banner in the MDM Web App Admin Center. Available from 16.3.1.

The banner displays the message: This is a [value] environment. For example, setting this to DEV results in: This is a DEV environment.

If not set, no banner is shown.

ataccama.one.mda.application.environment.color

String

BLUE

No

Sets the background color of the environment banner. Only applies when ataccama.one.mda.application.environment.label is configured.

Supported values:

  • RED

  • GREEN

  • YELLOW

  • BLUE

  • PINK

  • PURPLE

Defaults to BLUE. If you specify an unsupported value, MDM fails to start and logs an error similar to the following: Invalid environment color: ORANGE.

Was this page useful?