Installing Aginity Premium on Linux

General Configuration Parameters

SERVICE_KEYSTORE_PATH

The path to a keystore file in format PKCS12. Aginity Premium generates this file when you run /opt/aginity-team/bin/ssl-certificate-gen.sh. You can use your own keystore file by setting a path to the file by replacing default one.

Default: /etc/aginity-team/cacerts

KEYSTORE_PASSWORD

A password to the keystore file.

Default: changeit

CERTIFICATE_ALIAS

A keystore alias.

Default: aginity_cert

JVM_MEMORY_LIMIT

The value of JVM maximum heap size. The number has to be an integer. You should specify its value using one of the letters “m” or “M” for MB, or “g” or “G” for GB. Examples: 1024m, 1024MB, 12g, 12GB.

Default: 1024m

AGINITY_ENCRYPTION_KEY

The value of the encryption key which is used to encrypt H2 database used by the application. This value is generated by Aginity Team.

Note
We recommend that you copy the encryption key to a safe 
place as you may need it to recover Aginity Team Server using a database backup.

AGINITY_CONFIG_PATH

The path to the application configuration yml-file. Do not change its value.

Default: /etc/aginity-team/application.yml

DB_PATH

The path to a directory to deploy Aginity Team’s H2 database in.

Default: /var/lib/aginity-team/

Default: /var/lib/aginity-team

Configuring the YML Application File

Aginity Premium server can be customized through a number of settings of the /etc/aginity-team/application.yml file. It uses YAML format. Depending on your needs Aginity Team can be configured to use either embedded H2 database or PostgreSQL database server. You may want to change TCP port the server is accepting HTTP request on or integrate Aginity Team with external identity providers.

Note
YAML does not support tab characters for indentation. 
You should use spaces for that.

For the reason of backward compatibility, some settings in application.yml use parameter expansions. The basic form of parameter expansion is ${parameter:-}. The parameter is a key from /etc/aginity-team/service.conf. You can replace any ${parameter:-} with your custom value. There are default values for some parameters in the configuration file:

${parameter:-defaultValue}

If parameter is unset in /etc/aginity-team/service.conf, the expansion of defaultValue is substituted. Otherwise, the value of the parameter is substituted.

Webserver Options

Server Options

server:
port: ${SERVICE_PORT:-8080}
publicUrl: ${PUBLIC_URL:-'http://localhost:8080'}

server.port

TCP port Aginity Team uses to accept HTTP requests. You may want to setup Aginity Team to listen on 443 to simplify URL users should use to access Aginity Team. In this case, the server section looks like as follows:

Default: 8080

server:
  port: 443
  publicUrl: https://my.example.com

server.publicUrl

publicUrl is a URL of a server running the Aginity Team. It is a public URL available outside your corporate network.

publicUrl has the following format {scheme}://{host}:{port} where {scheme} can be either http or https, {host} is hostname of the server running Aginity Team, {port} is TCP port Aginity Team is using.

Default: http://localhost:8080

Catalog Database Options

Database Options

database:
# BEGIN H2 database configuration
  h2:
    dbFilePath: ${DB_PATH:-}
# END H2 database configuration
#
# BEGIN PostgreSQL configuration
#
# This section is commented out by default since only one type of database could be enabled
# to enable PostgreSQL, comment out the H2 database configuration section and uncomment the section below
#  postgres:
#    user: {user}
#    password: {password}
#    jdbcUrl: jdbc:postgresql://{host}:{port}/{database_name}
#    properties: # any properties specific to your JDBC driver:
#      ssl: true # connect using SSL. SSL support must be enabled on the database server side.
#      sslmode: require
#
# END PostgreSQL configuration

By default, Aginity Team installs an embedded H2 database to store application data. Another option is to use a PostgreSQL database. In this case, you have to deploy PostgreSQL server and create a database by yourself. Here is an example of the database section with enabled PostgreSQL database:

database:
# BEGIN H2 database configuration
#  h2:
#    dbFilePath: ${DB_PATH:-}
# END H2 database configuration
#
# BEGIN PostgreSQL configuration
#
  postgres:
    user: db_user
    password: db_passowd
    jdbcUrl: jdbc:postgresql://my.example.com:5432/aginity_team_database
    properties:
      ssl: true
      sslmode: require
#
# END PostgreSQL configuration

Note
Only one type of database could be enabled. To enable PostgreSQL, comment out the H2 database configuration section and uncomment the PostgreSQL configuration section.

database.h2.dbFilePath

The path to a directory to deploy Aginity Team’s H2 database in.

database.postgres.user

The database user.

database.postgres.password

The database user’s password.

database.postgres.jdbcUrl

The connection URL.

jdbcUrl has the following format jdbc:postgresql://{host}:{port}/{database_name} where {host} is the IP address or the hostname of the database server, {port} is TCP port the database server is listening, {database_name} is the name of Aginity Team database created by you.

database.postgres.properies

This section may contain any number of additional connection parameters which PostgreSQL JDBC driver supports. You can read about the jdbc driver parameters at jdbc.postgresql.org

Logging Options

logging Options

logging:
    pathToLogFile: ${PATH_TO_LOG_FILE:-/var/log/aginity-team}
    maxFilesCount: ${MAX_FILES_COUNT:-100MB}
    maxFileSize: ${MAX_FILE_SIZE:-1}

logging.pathToLogFile

The path to a directory to store application log files in.

Default: /var/log/aginity-team

logging.maxFilesCount

The maximum number of the log files the Aginity Team creates.

Default: 1

logging.maxFileSize

The maximum size of a log file. The number has to be an integer. You should specify its value using one of the letters ‘KB’, ‘MB’ or ‘GB’ after the number. Examples: 200KB, 35MB, 1GB.

Default: 100MB

Platform Options

This section is used to set up OAuth for the Snowflake databases. Please refer to the specific Snowflake section in the documentation Enabling Snowflake SSO.

Security Configuration Options

userDirectory Options

This section allows you to integrate Aginity Team with your LDAP system to import users, sync user information and delegate user authentication to LDAP server.

userDirectory: 
name: "LDAP Server"
    enabled: true
    serverSettings:
        host: ldapserver.example.com
        port: 389
        bindDN: cn=admin,dc=example,dc=com
        bindPassword: admin_password
        encryption: PLAIN
        verifyCertificates: false
        tlsOptions:
            trustStorePath: /path/to/trustStore/file
            trustStorePassword: my_password
            trustStoreType: PKCS12
    connectionRule:
        connectTimeout: 0
        responseTimeout: 0
    userSchema:
        baseDN: ou=users,dc=example,dc=com
        userFilter:
        usernameAttribute: uid
        firstNameAttribute: givenName
        lastNameAttribute: sn
        emailAttribute: mail
        searchScope: SUB_TREE

sync:
        interval: 60
    groupSchema:
        baseDN: ou=groups,dc=company,dc=com
        groupFilter: (objectClass=groupOfUniqueNames)
        nameAttribute: cn
        descriptionAttribute: description
        searchScope: SUB_TREE
    membershipSchema:
        type: GROUP_LISTS_USERS
        groupMembersAttribute: uniqueMember # in case of GROUP_LISTS_USERS     
        memberOfGroupsAttribute: memberOf # in case of USER_LISTS_GROUPS

userDirectory.name

A descriptive name of the LDAP connection.

userDirectory.enabled

Flag to indicate whether LDAP authentication is on or off.

userDirectory.serverSettings.host

The IP address or hostname of the LDAP server.

userDirectory.serverSettings.port

TCP port of the LDAP server.

userDirectory.serverSettings.bindDN

The distinguished name of the user that the application will use when connecting to the directory server. Example: cn=admin,dc=example,dc=com

userDirectory.serverSettings.bindPassword

The user password.

userDirectory.serverSettings.encryption

Type of connection encyption. Can be set to PLAIN, START_TLS or SIMPLE_TLS. START_TLS is preferred option. START_TLS begins as a plaintext connection over the standard LDAP port (389), and that connection is then upgraded to SSL/TLS.

userDirectory.serverSettings.verifyCertificates

If set to true, Aginity Team verifies the certificate used for SSLTLS connection to the LDAP server. A java truststore configured in userDirectory.serverSettings.tlsOptions is used to verify the certificate. If you use a self-signed certificate, you must import the certificate to the truststore before starting Aginity Team.

userDirectory.serverSettings.tlsOptions

Use this section to configure your java truststore that is used to verify the LDAP server certificate.

userDirectory.serverSettings.tlsOptions.trustStorePath

The path to the Java trust store where certificates are stored.

userDirectory.serverSettings.tlsOptions.trustStorePassword

The password to the java trust store.

userDirectory.serverSettings.tlsOptions.trustStoreType

The type of the trust store. The most common are JKS and PKCS12.

userDirectory.connectionRule.connectTimeout

Timeout in milliseconds for connection to LDAP server. 0 means no timeout.

userDirectory.connectionRule.responseTimeout

Timeout in milliseconds for response time from LDAP server. 0 means no timeout.

userDirectory.userSchema.baseDN

The root distinguished name (DN) to use when running queries against the directory server.

userDirectory.userSchema.userFilter

An LDAP search filter to be used when searching user objects from the LDAP server within the base DN. Example: “(&(objectCategory=Person)(sAMAccountName=*))”

userDirectory.userSchema.usernameAttribute

Defines which attributes on an LDAP user entry will be used as its username.

userDirectory.userSchema.firstNameAttribute

Defines which attributes on an LDAP user entry will be used as its first name.

userDirectory.userSchema.lastNameAttribute

Defines which attributes on an LDAP user entry will be used as its last name.

userDirectory.userSchema.emailAttribute

Defines which attributes on an LDAP user entry will be used as its email address.

userDirectory.userSchema.searchScope

Specify strategy to use when doing a search. Possible options: SUB_TREE (search request should be performed against the search base and all entries below), ONE (search request should be performed against entries that are immediate subordinates of the entry specified as the search base DN), BASE (search request should only be performed against the entry specified as the search base DN).