ONE Desktop ONE DQ&C ONE MDM ONE RDM ONE Runtime Server
latest (16.1.0) 16.0.0 15.4.0 15.3.0 15.2.0 15.1.0 14.5.x 13.9.x 13.8.x 13.7.x 13.6.x 13.5.0 13.4.x 13.3.x 13.2.x
User Community Service Desk Downloads
If you can't find the product or version you're looking for, visit support.ataccama.com/downloads

MDM Web App Security Configuration

Authentication

Configure client URLs in Keycloak

Edit the following clients in Keycloak following the steps described in this section:

  • mdm-admin-client

  • mdm-token-client

    1. Open the Keycloak administration console.

    2. Make sure Ataccamaone realm is selected.

    3. Select Clients.

    4. From the list of clients, select the client identifier to open the configuration.

    5. Depending on the client Access Type setting, different configuration fields are available and filled in.

      Edit all filled-in fields that contain URLs, for example, Valid Redirect URIs, Base URL, and Admin URL.

      Change the http://localhost:<port> part to the actual client location.

    6. Select Save.

    7. Repeat steps 3-7 for all relevant clients.

      To change the default client password, switch to the Credentials tab of the client configuration and click Regenerate Secret.
      For basic authentication, enable Direct Access Grants Enabled option in the Keycloak client.
      Keycloak admin console

Edit client configuration files

To define the configuration for your Keycloak clients, add or edit the Keycloak configuration section in the MDM Server application.properties file. The settings should correspond to the Keycloak settings for the clients.

Keycloak is case-sensitive. Make sure to use lowercase if referring to the Keycloak server URL via hostname.

The following is a sample configuration for MDM Web App:

Name Default value Mandatory Description

ataccama.authentication.keycloak.realm

ataccamaone

Yes

Keycloak realm.

ataccama.authentication.keycloak.base-url

http://localhost:8083

Yes

Keycloak base URL.

ataccama.authentication.keycloak.server-url

$\{ataccama.authentication.keycloak.base-url}/auth

Yes

Keycloak server URL. Ending with /auth.

ataccama.authentication.keycloak.admin.client-id

mdm-admin-client

Yes

Admin Keycloak client ID.

ataccama.authentication.keycloak.admin.secret

mdm-admin-client-s3cret

Yes

Admin Keycloak client secret.

ataccama.authentication.keycloak.token.client-id

mdm-token-client

Yes

Token Keycloak client ID.

ataccama.authentication.keycloak.token.secret

mdm-token-client-s3cret

Yes

Token Keycloak client secret.

ataccama.authentication.keycloak.token.issuer

$\{ataccama.authentication.keycloak.server-url}/realms/$\{ataccama.authentication.keycloak.realm}

Yes

Token Keycloak issuer.
For information about how to encrypt passwords, see Encrypt Passwords.

Edit the following client adapter files so that MDM Web App connects to Keycloak properly:

  • On the web application server, edit mdm/etc/application.properties.

    ataccama.authentication.keycloak.realm=ataccamaone
ataccama.authentication.keycloak.server-url=http://localhost:8083/auth
ataccama.authentication.keycloak.token.client-id=mdm-webapp-public-client
# Keycloak public client ID for web application browsing
ataccama.authentication.keycloak.public.client-id=$\{ataccama.authentication.keycloak.token.client-id}
ataccama.authentication.keycloak.token.secret=mdm-webapp-public-client-s3cret
ataccama.authentication.keycloak.token.issuer=$\{ataccama.authentication.keycloak.server-url}/realms/$\{ataccama.authentication.keycloak.realm}
    For information about how to encrypt passwords, see Encrypt Passwords.

  • In the project configuration Files/etc/issue_management/ directory, edit the DQIT config.xml file.

In most cases, it is only necessary to modify the ataccama.authentication.keycloak.server-url attribute, which corresponds to the base URL of the Keycloak server. Treat other settings as expert and modify only if you know what you are doing.

Keycloak is case-sensitive. Make sure to use lowercase if referring to the Keycloak server URL via hostname.

Web application security

You can configure MDM Web App security by adding response headers (security headers) to HTTP responses from the web application.

We recommend setting security headers in case your web application is exposed to potential security attacks.

The security headers are configured in MDM Web App application.properties file. They are commented out by default: uncomment them to enable.

Name Default value

one.security.header.content-security-policy.connect-src

'self' ${ataccama.authentication.keycloak.server-url}

one.security.header.content-security-policy.script-src

* 'unsafe-inline' 'unsafe-eval'

one.security.header.content-security-policy.img-src

'self' data:

one.security.header.X-Frame-Options

deny

one.security.header.X-Permitted-Cross-Domain-Policies

none

one.security.header.Referrer-Policy:

strict-origin

one.security.header.X-XSS-Protection

1; mode=block

one.security.header.X-Content-Type-Options

nosniff

Was this page useful?