This section is used to configure the Identity provider used to manage the users and log in to the different components of the solution. See Identity provider configuration to help configure an identity provider for beVault.
Don’t forget to prefix the variables with the component’s name
Config variable details
Parameter
Explanation
AuthMethod
Defines how authentication will function in Metavault and States. There are three possible values:
Jwt (default): This is the classical OIDC setup, where the front will get a token that the back-end will validate.
FakeJwt: Used for testing, don’t activate in production. This uses a json format with a list of claims as authentication token. Useful to bypass auth and test with various values.
None: Used when authentication is handled by an external actor. All calls will be accepted. If using this mode, see UserIdHeader config to specify which HTTP header to use as the user id “Claim“.
ValidIssuers
For the “Jwt” AuthMethod. A list of additional issuer URLs that are considered valid when found in JWT authentication tokens. This concerns the “iss“ field in said tokens. Sometimes, token endpoints use different urls than the one specified in automatic configuration “.well-known” endpoints. This helps working around this problem.
AdminEmail
This user id will be considered an admin when connected, meaning they will have the rights to manage users/groups and their associated access rights.
Additionally, with AuthMethod set to None and with an empty UserIdHeader, all calls to the Metavault and States will use this identity.
UserIdHeader
With AuthMethod set to None, if this is set, Metavault and States will use the contents of the specified HTTP header as the user id of the call.
Example: If UserIdHeader is set to MV-USER-ID Metavault will look for something like this in the HTTP request: MV-USER-ID=bob, the connecting user will then be “bob“.
This is mostly useful when incoming calls are already authenticated, like in the Snowflake app store.
RequireHttpsMetadata
Defines the protocol used to communicate with the Oauth authentication provider (Keycloak). “True“, which is the default, requires https. Local deployments may want to set “false”.
ExecutionRetentionDays: After how many days, the info about execution already finished should be deleted. Default to 90 days
ExecutionCountLimit: After how many executions should we start to clean up finished execution. Default to 1000 executions.
AwsAccessKey, AwsSecretKey: >= 1.5.0 if specified, a user will be created with this access key and corresponding secret key
If the ExecutionRetentionDays and ExecutionCountLimit options are both set, the first condition that is met will trigger the deletion of executions.
logs
By default, all applications are sending reasonable logs to the console, the configuration can be updated using Serilog configuration section.
Here is the configuration of the logs. The most useful field to set is probably the path field, which sets where the logs will be stored on the disk.
For the other options :
MinimumLevel: Indicate the level of log we want to store. From low to high, these are Verbose, Debug, Information, Warning, Error and Fatal
rollOnfileSizeLimit: Indicate if we want to create a new log file when the current one reaches its size limit
fileSizeLimitByte: Indicate the size limit of a log file. Once this size is reached, a new file will be created if the rollOnfileSizeLimit is set to true
retainedFileCountLimit: Indicate how much file we should have, we start overriding the first log file.
option : formatter: The formatter decides the format of the logs (text, json, …)
Don’t forget to prefix the variables with the component’s name
HTTP Strict Transport Security (HSTS) is a simple and widely supported standard to protect visitors by ensuring that their browsers always connect to a website over HTTPS.
MaxAge: The time, that the browser should remember that a site is only to be accessed using HTTPS.
Preload: it is possible to enforce secure connections on a higher level, even before visiting a website for the first time: the HSTS preload list. This is a list, managed by google, with domain names that by default support HSTS:
DefaultContextLabel: Metrics recorded are grouped into “Contexts”, for example a database context or application context. Metrics names should be unique per context. The default is “Application”.
Enabled: Allows recording of all metrics to be enabled/disabled, default is true.
ApdexTrackingEnabled: Allows enabling/disabling of calculating the apdex score on the overall responses times. Defaults to true. The Apdex (Application Performance Index) is used to monitor end-user satisfaction. It is an open industry standard that estimates the end user’s satisfaction level on an application’s response time through a score between 0 and 1.
apdexTSeconds: The Apdex T seconds value used in calculating the score on the samples collected.
IgnoredHttpStatusCode: Allows specific HTTP status codes to be ignored when reporting on response related information, e.g., You might not want to monitor 404 status codes.
IngoredRoutesRegexPatterns: An list of regex patterns used to ignore matching routes from metrics tracking.
Oauth2TrackingEnabled: Allows recording of all OAuth2 Client tracking to be enabled/disabled. Defaults to true.
MetricsEndPointEnabled: Allows enabling/disabling of the /metrics endpoint, when disabled will result in a 404 status code, the default is true.
MetrucsTextEndpointEnabled: Allows enabling/disabling of the /metrics-text endpoint, when disabled will result in a 404 status code, the default is true.
EnvironmentInfoEndpointEnabled: Allows enabling/disabling of the /env endpoint, when disabled will result in a 404 status code, the default is true.
DSN: where to send events, so the events are associated with the correct project.
IncludeRequestPayload: whether we should send the request body to Sentry. This is done so that the request data can be read at a later point in case an error happens while processing the request.
SendDefaultPii: Whether we should report the user who made the request
MinimumBreadcrumbLevel: Configure the lowest level a message has to be to become a breadcrumb. Breadcrumbs are the last (by default 100) log that were sent before the event was fired to Sentry.
MinimumEventLevel: A LogLevel which indicates the minimum level a log message has to be sent to Sentry as an event. By default, this value is Error.
AttachStackTrace: Configures whether Sentry should generate and attach stack traces to capture message calls.
Debug: Turns debug mode on or off. If debug is enabled, Sentry will attempt to print out useful debugging information if something goes wrong with sending the event. The default is always false. It's generally not recommended to turn it on in production, though turning debug mode on will not cause any safety concerns.
