urn:infinispan:server:15.1

interfaces

interface*

Name	Type	Default	Description
name	string

inet-address?

Name	Type	Default	Description
value	string

global?

link-local?

loopback?

non-loopback?

site-local?

match-interface?

Name	Type	Default	Description
value	FIXME

match-address?

Name	Type	Default	Description
value	FIXME

socket-bindings

Name	Type	Default	Description
default-interface	string
port-offset	string

socket-binding*

security?

credential-stores?

Complex type to contain the definitions of the credential stores.

credential-store*

An individual credential store definition.

Name	Type	Default	Description
name	string		Specifies the name of the credential keystore.
relative-to	string		A property name whose value will be used to resolve relative paths.
path	string		File name of the credential keystore. If the path is relative, the full path will be resolved using the 'relative-to' attribute.
type	string	pkcs12	The type of the credential store file. Can be either pkcs12 or jceks. Defaults to pkcs12.

clear-text-credential

Specifies a clear-text password that allows access to the credential keystore.

A clear-text credential.

Name	Type	Default	Description
clear-text	string		The clear-text password.

masked-credential

Specifies a masked password that allows access to the credential keystore.

Adds a masked password for the credential keystore.

Name	Type	Default	Description
masked	string		Specifies a masked password in the format of `MASKED_VALUE;SALT;ITERATION`.

command-credential

Specifies an external command that supplies a password that allows access to the credential keystore.

Executes an external command that supplies the password for the credential keystore.

Name	Type	Default	Description
command	string		An external command, including arguments, that returns the credential on the standard output.

credential-reference

Specifies the credential keystore that contains a password that allows access to the credential keystore.

Credential reference to be used by the configuration.

Name	Type	Default	Description
store	string		Credential store name used to fetch credential with given 'alias' from. Credential store name has to be defined elsewhere.
alias	string		Alias of credential in the credential store.

security-realms

security-realm+

Name	Type	Default	Description
name	string
default-realm	string		Specifies which of the underlying realms will be used by default. It defaults to the first realm.
cache-max-size	int	256	The maximum size for the identity cache for this realm. If the size is less than 1, the cache will be disabled. Defaults to 256.
cache-lifespan	string	60s	The lifespan, in milliseconds, of entries in the identity cache after which they expire and are reloaded from the realm provider. Defaults to -1 (never expires).

evidence-decoder?

x500-subject-evidence-decoder?

An EvidenceDecoder that derives the principal associated with the given evidence from the subject from the first certificate in the certificate chain.

x509-subject-alt-name-evidence-decoder?

An EvidenceDecoder that derives the principal associated with the given evidence from an X.509 subject alternative name from the first certificate in the given evidence.

Name

Type

Default

Description

alt-name-type

rfc822Name
dNSName
directoryName
uniformResourceIdentifier
ipAddress
registeredID

The subject alternative name type to decode from the given evidence.

segment

int

The 0-based occurrence of the subject alternative name to map. This attribute is optional and only used when there is more than one subject alternative name of the given alt-name-type

server-identities?

ssl?

keystore?

Name	Type	Default	Description
path	string		Specifies the location of the keystore on the host file system. You can set a relative or absolute value. If you set a relative value, configure a value for the 'relative-to' attribute. The type of the keystore will be auto-detected among JKS, JCEKS, PKCS12 or PEM. BKS, BCFKS and UBER are also supported if the `bouncycastle` libary is present. The path may be omitted when using global store providers, such as 'SunPKCS11-NSS-FIPS'.
relative-to	string	infinispan.server.config.path	Specifies a property name that resolves to a directory on the host file system. Any files that you specify with the 'path' attribute, unless absolute, must be relative to this directory.
keystore-password	string		Deprecated: use the 'password' attribute instead.
password	string		The password required to open the keystore. If the keystore is a PEM file, this should be specified as an empty string.
alias	string		The alias of the entry in the keystore to use as the server identity. Only required if there are multiple entries in the keystore.
key-password	string		A password required to access a specific entry within the keystore. Only needed if the keystore type supports it and the entries have been protected by an additional password.
generate-self-signed-certificate-host	string		If this attribute is set and if the file that backs the KeyStore does not exist, then a self-signed certificate will be generated on first use and it will be persisted to the file that backs the KeyStore. The value of this attribute will be used for the Common Name value in the self-signed certificate. The use of this attribute is intended for testing purposes only. This attribute is not intended for production use.
provider	string		The name of the provider to use to instantiate the KeyManagerFactory. If the provider is not specified, the first provider found that can create an instance of the specified 'type' will be used.
type	string		The type of the keystore. Normally the type will be auto-detected. This attribute is required for file-less keystores, for example when using the `SunPKCS11-nss-fips` provider.

credential-reference?

Credential reference to be used by the configuration.

Name	Type	Default	Description
store	string		Credential store name used to fetch credential with given 'alias' from. Credential store name has to be defined elsewhere.
alias	string		Alias of credential in the credential store.

truststore?

Name	Type	Default	Description
path	string		Specifies the location of the truststore on the host file system. You can set a relative or absolute value. If you set a relative value, configure a value for the 'relative-to' attribute. The type of the keystore will be auto-detected among JKS, JCEKS, PKCS12 or PEM. BKS, BCFKS and UBER are also supported if the `bouncycastle` libary is present. The path may be omitted when using global store providers, such as 'SunPKCS11-NSS-FIPS'.
relative-to	string	infinispan.server.config.path	Specifies a property name that resolves to a directory on the host file system. Any files that you specify with the 'path' attribute, unless absolute, must be relative to this directory.
password	string		The password required to open the truststore. If the truststore is a PEM file, this should be specified as an empty string.
provider	string		The name of the provider to use to instantiate the TrustManagerFactory. If the provider is not specified, the first provider found that can create an instance of the specified 'type' will be used.
type	string		The type of the truststore. Normally the type will be auto-detected. This attribute is required for file-less truststores, for example when using the `SunPKCS11-nss-fips` provider.

credential-reference?

Credential reference to be used by the configuration.

Name	Type	Default	Description
store	string		Credential store name used to fetch credential with given 'alias' from. Credential store name has to be defined elsewhere.
alias	string		Alias of credential in the credential store.

engine?

Name	Type	Default	Description
enabled-protocols
enabled-ciphersuites	string	DEFAULT	The filter to be applied to the cipher suites made available by this SSL engine.
enabled-ciphersuites-tls13	string	TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256	The ciphersuite names to use for the TLSv1.3 engine.

kerberos*

Name	Type	Default	Description
principal	string		Specifies the principal that the KeyTab represents.
keytab-path	string		Sets the path to the KeyTab for retrieving credentials.
relative-to	string		Specifies the name of a named path or a standard path that the system provides. If set, the value of the "path" attribute becomes relative to this path.
minimum-remaining-lifetime	int	0	Specifies, in seconds, how long a cached credential can remain before it is recreated.
request-lifetime	int		Specifies, in seconds, how much lifetime to request for newly created credentials.
fail-cache	int		Specifies the amount of time, in seconds, to wait before attempting to obtain server credential if the previous attempt failed. Prevents long waiting periods on every authentication attempt if the KDC is unavailable.
server	boolean	true	Specifies if the realm is server-side (default) or client-side.
obtain-kerberos-ticket	boolean	false	Controls if a KerberosTicket is also obtained and associated with the credential. The value must be true if credentials are delegated to the server.
debug	boolean	false	Defines if the JAAS step to obtain the credential has debug logging enabled.
wrap-gss-credential	boolean	false	Specifies if generated GSS credentials are wrapped to prevent improper disposal.
required	boolean	false	Specifies if the keytab file with adequate principal must exist when the service starts.
mechanism-names		KRB5 SPNEGO	Defines the mechanism names with which the credential can be used. Names are converted to OIDs and used together with OIDs from the mechanism-oids attribute.
mechanism-oids			Defines the mechanism OIDs with which the credential can be used. Used with OIDs derived from names from the mechanism-names attribute.

ldap-realm?

Defines an LDAP security realm.

Name	Type	Default	Description
name	string		Names the security realm to logically separate multiple realms of the same type.
url	string		Specifies the URL for LDAP server connections in the format ldap[s]://{hostname}:{port}.
principal	string		Specifies the user principal for LDAP server connections.
credential	string		Specifies the user credential for LDAP server connections.
direct-verification	boolean		Configures the realm to verify credentials by connecting to LDAP servers with the account. Values are true / false (default).
page-size	int	50	Sets the page size for realm iteration. The default value is 50.
connection-pooling	boolean	false	Enables connection pooling.
referral-mode		follow	Specifies if LDAP server referrals are followed and corresponds to the REFERRAL ("java.naming.referral") environment property. Values are "ignore", "follow" (default), and "throw".
connection-timeout	string	5s	Sets the timeout, in milliseconds, for LDAP server connections. The default value is 5 seconds. You can optionally set one of the following units: ms (milliseconds), s (seconds), m (minutes), h (hours), d (days).
read-timeout	string	1m	Sets the read timeout, in milliseconds, for LDAP server operations. The default value is 1 minute. You can optionally set one of the following units: ms (milliseconds), s (seconds), m (minutes), h (hours), d (days).
client-ssl-context	string		The name of a realm which provides a trust store with which to validate SSL client connections.

credential-reference?

Credential reference to be used by the configuration.

Name	Type	Default	Description
store	string		Credential store name used to fetch credential with given 'alias' from. Credential store name has to be defined elsewhere.
alias	string		Alias of credential in the credential store.

name-rewriter?

Specifies a name rewriter that transforms names returned by a realm.

case-principal-transformer

Specifies a PrincipalTransformer definition using case conversion

Name	Type	Default	Description
uppercase	boolean	true	Whether to transform to UPPERCASE or lowercase. The default is true.

Specifies the base type for all PrincipalTransformer definitions.

Name	Type	Default	Description
name	string		Deprecated. Will be ignored.

common-name-principal-transformer

Specifies a PrincipalTransformer definition which extracts the first CommonName (CN) from a DistinguishedName (DN).

regex-principal-transformer

Specifies a PrincipalTransformer definition using regular expressions and Matcher based replacement.

Name	Type	Default	Description
pattern	string		Specifies the regular expression for this PrincipalTransformer.
replacement	string		Specifies the replacement string for the PrincipalTransformer.
replace-all	boolean	false	Replaces all occurrences instead of the first occurrence.

Specifies the base type for all PrincipalTransformer definitions.

Name	Type	Default	Description
name	string		Deprecated. Will be ignored.

identity-mapping*

Specifies configuration options that define how principals are mapped to corresponding entries in LDAP servers.

Name	Type	Default	Description
search-dn	string		Names the context for query execution. This option provides a useful method to authenticate users based on names that do not use X.500 format, such as "plainUser". In this case, you must also specify the rdn-identifier. If names to authenticate users are based on the X.500 format, you can suppress this configuration. You should also note that this option lets realms authenticate users based on simple, or X.500, names.
rdn-identifier	string		Specifies an LDAP attribute that contains the user name and appears in the path of new entries.
search-recursive	boolean	false	Performs recursive queries.
search-time-limit	int	10000	The time limit of LDAP search in milliseconds. Defaults to 10000 ms.
filter-name	string	(rdn_identifier={0})	Specifies the LDAP filter that retrieves an identity by name. In the default value, "{0}" is replaced with the searched identity name and "rdn_identifier" is replaced with the value of the "rdn-identifier" attribute.

attribute-mapping?

Specifies the attribute mappings defined for this resource.

attribute

Name	Type	Default	Description
filter	string		The filter to use to obtain the values for a specific attribute. String "{0}" will be replaced by username, "{1}" by user identity DN.

Name	Type	Default	Description
filter-dn	string		The name of the context where the filter should be performed.
from	string		The name of the LDAP attribute to map to an identity attribute. If not defined, DN of the whole entry is used as value.
to	string		The name of the identity attribute mapped from a specific LDAP attribute. If not provided, the name of the attribute is the same as define in 'from'. If the 'from' is not defined too, value 'dn' is used.
search-recursive	boolean	true	Indicates if attribute LDAP search queries are recursive.
role-recursion	int	0	Sets recursive roles assignment - value determine maximum depth of recursion. (0 for no recursion)
role-recursion-name	string	cn	Determine LDAP attribute of role entry which will be substitute for "{0}" in filter-name when searching roles of role. Used only when role-recursion is set.
extract-rdn	string		The RDN key to use as the value for an attribute, in case the value in its raw form is in X.500 format.

attribute-reference

Name	Type	Default	Description
reference	string		The name of an LDAP attribute containing DN of entry to obtain value from.

Name	Type	Default	Description
filter-dn	string		The name of the context where the filter should be performed.
from	string		The name of the LDAP attribute to map to an identity attribute. If not defined, DN of the whole entry is used as value.
to	string		The name of the identity attribute mapped from a specific LDAP attribute. If not provided, the name of the attribute is the same as define in 'from'. If the 'from' is not defined too, value 'dn' is used.
search-recursive	boolean	true	Indicates if attribute LDAP search queries are recursive.
role-recursion	int	0	Sets recursive roles assignment - value determine maximum depth of recursion. (0 for no recursion)
role-recursion-name	string	cn	Determine LDAP attribute of role entry which will be substitute for "{0}" in filter-name when searching roles of role. Used only when role-recursion is set.
extract-rdn	string		The RDN key to use as the value for an attribute, in case the value in its raw form is in X.500 format.

user-password-mapper?

Specifies the user password credential mapping defined for this resource.

Name	Type	Default	Description
from	string		The name of the LDAP attribute to map to an identity user password credential.
verifiable	boolean		If the password credential is verifiable.

local-realm?

Name	Type	Default	Description
name	string	local

properties-realm?

Name	Type	Default	Description
name	string		Names the security realm to logically separate multiple realms of the same type.
groups-attribute	string	Roles

user-properties?

Name	Type	Default
path	string	users.properties
relative-to	string	infinispan.server.config.path
digest-realm-name	string
plain-text	boolean	false

group-properties?

Name	Type	Default	Description
path	string	groups.properties
relative-to	string	infinispan.server.config.path

token-realm?

Name	Type	Default
name	string
auth-server-url	string
client-id	string
principal-claim	string	username

jwt

Name	Type	Default	Description
issuer			Defines one or more string values representing an unique identifier for the entities that are allowed as issuers of a given JWT. During validation JWT tokens must have a iss claim that contains one of the values defined here. If not provided, the validator will not perform validations based on the issuer claim.
audience			Defines one or more string values representing the audiences supported by this configuration. During validation JWT tokens must have an aud claim that contains one of the values defined here. If not provided, the validator will not perform validations based on the audience claim.
public-key	string		A default public key in its PEM format used to validate the signature of tokens without kid header parameter. If not provided, the validator will not validate signatures.
jku-timeout	string	2m	A timeout, in milliseconds for cached jwks when using jku claim. After this timeout, the keys of need to be re-cached before use. Default value is 2 minutes. You can optionally set one of the following units: ms (milliseconds), s (seconds), m (minutes), h (hours), d (days).
connection-timeout	string	2s	Sets the timeout, in milliseconds, for connections to the JKU server. The default value is 2 seconds. You can optionally set one of the following units: ms (milliseconds), s (seconds), m (minutes), h (hours), d (days).
read-timeout	string	2s	Sets the read timeout, in milliseconds, for the JKU server. operations. The default value is 2 seconds. You can optionally set one of the following units: ms (milliseconds), s (seconds), m (minutes), h (hours), d (days).
client-ssl-context	string		The name of a realm which provides a trust store with which to validate SSL client connections.
host-name-verification-policy	string		A HostnameVerifier that will be used to validate the hostname when using SSL/TLS. This configuration is mandatory if using jku claims. Can be ANY or DEFAULT.

oauth2-introspection

Name	Type	Default	Description
client-id	string		The identifier of a client registered within the OAuth2 Authorization Server that will be used to authenticate this server in order to validate bearer tokens arriving to this server. Please note that the client will be usually a confidential client with both an identifier and secret configured in order to authenticate against the token introspection endpoint. In this case, the endpoint must support HTTP BASIC authentication using the client credentials (both id and secret).
client-secret	string		The secret of the client identified by the given clientId.
introspection-url	string		An URL pointing to a RFC-7662 OAuth2 Token Introspection compatible endpoint.
connection-timeout	string	2s	Sets the timeout, in milliseconds, for connections to the OAuth2 server. The default value is 2 seconds. You can optionally set one of the following units: ms (milliseconds), s (seconds), m (minutes), h (hours), d (days).
read-timeout	string	2s	Sets the read timeout, in milliseconds, for the OAuth2 server. operations. The default value is 2 seconds. You can optionally set one of the following units: ms (milliseconds), s (seconds), m (minutes), h (hours), d (days).
client-ssl-context	string		The name of a realm which provides a trust store with which to validate SSL client connections.
host-name-verification-policy	string		A HostnameVerifier that will be used to validate the hostname when using SSL/TLS. This configuration is mandatory if the given token introspection url is using SSL/TLS. Can be ANY or DEFAULT.

credential-reference?

Credential reference to be used by the configuration.

Name	Type	Default	Description
store	string		Credential store name used to fetch credential with given 'alias' from. Credential store name has to be defined elsewhere.
alias	string		Alias of credential in the credential store.

truststore-realm?

Name	Type	Default	Description
name	string

distributed-realm?

A realm definition for authentication and authorization of identities distributed between multiple realms.

Name	Type	Default	Description
name	string
realms			A list of security realms that should be used for authentication until one succeeds. If no realms are specified, all the available realms will be used.

aggregate-realm?

A realm definition for authentication and authorization of identities aggregated between multiple realms.

Name	Type	Description
name	string
authentication-realm	FIXME	The name of a security realm that should be used for authentication.
authorization-realms		A list of security realm names that should be used for authorization. If no realms are specified, all the available realms will be used.

name-rewriter?

Specifies a name rewriter that transforms names returned by a realm.

case-principal-transformer

Specifies a PrincipalTransformer definition using case conversion

Name	Type	Default	Description
uppercase	boolean	true	Whether to transform to UPPERCASE or lowercase. The default is true.

Specifies the base type for all PrincipalTransformer definitions.

Name	Type	Default	Description
name	string		Deprecated. Will be ignored.

common-name-principal-transformer

Specifies a PrincipalTransformer definition which extracts the first CommonName (CN) from a DistinguishedName (DN).

regex-principal-transformer

Specifies a PrincipalTransformer definition using regular expressions and Matcher based replacement.

Name	Type	Default	Description
pattern	string		Specifies the regular expression for this PrincipalTransformer.
replacement	string		Specifies the replacement string for the PrincipalTransformer.
replace-all	boolean	false	Replaces all occurrences instead of the first occurrence.

Specifies the base type for all PrincipalTransformer definitions.

Name	Type	Default	Description
name	string		Deprecated. Will be ignored.

data-sources?

data-source*

Name	Type	Default	Description
name	token		Name for the datasource (used for management)
jndi-name	token		JNDI name for the datasource
statistics	boolean	false	Enable statistics for this datasource

connection-factory

Configuration for the connection factory

Name

Type

Default

Description

driver

token

Unique reference to the JDBC driver

url

token

JDBC driver connection URL (e.g. "jdbc:h2:tcp://localhost:1234")

transaction-isolation

NONE
READ_UNCOMMITTED
READ_COMMITTED
REPEATABLE_READ
SERIALIZABLE

READ_COMMITTED

Set the java.sql.Connection transaction isolation level to use. Defaults to READ_COMMITTED

new-connection-sql

token

SQL statement to be executed on a connection after creation

username

token

Username to use for basic authentication with the database

password

token

Password to use for basic authentication with the database

credential-reference

Credential reference to be used by the configuration.

Name	Type	Default	Description
store	string		Credential store name used to fetch credential with given 'alias' from. Credential store name has to be defined elsewhere.
alias	string		Alias of credential in the credential store.

connection-property

Properties for the JDBC driver

connection-pool

Configuration for the connection pool

Name	Type	Default	Description
max-size	nonNegativeInteger	2147483647	Maximum number of connections in the pool
min-size	nonNegativeInteger	0	Minimum number of connections the pool should hold
initial-size	nonNegativeInteger	0	Initial number of connections the pool should hold
blocking-timeout	string	0	Maximum time in milliseconds to block while waiting for a connection before throwing an exception This will never throw an exception if creating a new connection takes an inordinately long period of time Default is 0 meaning that a call will wait indefinitely You can optionally set one of the following units: ms (milliseconds), s (seconds), m (minutes), h (hours), d (days).
background-validation	string	0	Time in milliseconds between background validation runs. A duration of 0 means that this feature is disabled. You can optionally set one of the following units: ms (milliseconds), s (seconds), m (minutes), h (hours), d (days).
validate-on-acquisition	string	0	Connections idle for longer than this time, specified in milliseconds, are validated before being acquired (foreground validation). A duration of 0 means that this feature is disabled. You can optionally set one of the following units: ms (milliseconds), s (seconds), m (minutes), h (hours), d (days).
leak-detection	string	0	Time in milliseconds a connection has to be held before a leak warning You can optionally set one of the following units: ms (milliseconds), s (seconds), m (minutes), h (hours), d (days).
idle-removal	string	0	Time in milliseconds a connection has to be idle before it can be removed. You can optionally set one of the following units: ms (milliseconds), s (seconds), m (minutes), h (hours), d (days).

endpoints

Name	Type	Default	Description
socket-binding	string		Specifies the socket the endpoint connector binds to.
security-realm	string		Names the security realm to use for authentication, cache authorization, and encryption.

endpoint*

Name	Type	Default	Description
socket-binding	string		Specifies the socket the endpoint connector binds to.
security-realm	string		Names the security realm to use for authentication, cache authorization, and encryption.
admin	boolean	true	Enable administrative features on this endpoint. Defaults to true.
metrics-auth	boolean	true	Enable metrics authentication on this endpoint. Defaults to true.

Name	Type	Default	Description
socket-binding	string		Specifies the socket this connector binds to. If no socket binding is declared, the server does not listen to TCP connections.
cache-container	string		Names the cache container this connector exposes.
io-threads	int		Sets the number of I/O threads. Defaults to 2 * cpu cores. This configuration is ignored when using single port.
idle-timeout	string	0	Specifies the maximum time, in seconds, that client connections can remain inactive. Defaults to 0 (no timeout). You can optionally set one of the following units: ms (milliseconds), s (seconds), m (minutes), h (hours), d (days).
tcp-nodelay	boolean		Enables TCP NODELAY on the TCP stack. Values are enabled (default) / disabled.
tcp-keepalive	boolean		Enables TCP KEEPALIVE on the TCP stack. Values are enabled / disabled (default).
send-buffer-size	int		Sets the size of the send buffer.
receive-buffer-size	int		Sets the size of the receive buffer.
require-ssl-client-auth	boolean		Requires clients to use certificates for authentication.

credential-stores?

Complex type to contain the definitions of the credential stores.

credential-store*

An individual credential store definition.

Name	Type	Default	Description
name	string		Specifies the name of the credential keystore.
relative-to	string		A property name whose value will be used to resolve relative paths.
path	string		File name of the credential keystore. If the path is relative, the full path will be resolved using the 'relative-to' attribute.
type	string	pkcs12	The type of the credential store file. Can be either pkcs12 or jceks. Defaults to pkcs12.

clear-text-credential

Specifies a clear-text password that allows access to the credential keystore.

A clear-text credential.

Name	Type	Default	Description
clear-text	string		The clear-text password.

masked-credential

Specifies a masked password that allows access to the credential keystore.

Adds a masked password for the credential keystore.

Name	Type	Default	Description
masked	string		Specifies a masked password in the format of `MASKED_VALUE;SALT;ITERATION`.

command-credential

Specifies an external command that supplies a password that allows access to the credential keystore.

Executes an external command that supplies the password for the credential keystore.

Name	Type	Default	Description
command	string		An external command, including arguments, that returns the credential on the standard output.

credential-reference

Specifies the credential keystore that contains a password that allows access to the credential keystore.

Credential reference to be used by the configuration.

Name	Type	Default	Description
store	string		Credential store name used to fetch credential with given 'alias' from. Credential store name has to be defined elsewhere.
alias	string		Alias of credential in the credential store.

security-realms

security-realm+

Name	Type	Default	Description
name	string
default-realm	string		Specifies which of the underlying realms will be used by default. It defaults to the first realm.
cache-max-size	int	256	The maximum size for the identity cache for this realm. If the size is less than 1, the cache will be disabled. Defaults to 256.
cache-lifespan	string	60s	The lifespan, in milliseconds, of entries in the identity cache after which they expire and are reloaded from the realm provider. Defaults to -1 (never expires).

evidence-decoder?

x500-subject-evidence-decoder?

An EvidenceDecoder that derives the principal associated with the given evidence from the subject from the first certificate in the certificate chain.

x509-subject-alt-name-evidence-decoder?

An EvidenceDecoder that derives the principal associated with the given evidence from an X.509 subject alternative name from the first certificate in the given evidence.

Name

Type

Default

Description

alt-name-type

rfc822Name
dNSName
directoryName
uniformResourceIdentifier
ipAddress
registeredID

The subject alternative name type to decode from the given evidence.

segment

int

The 0-based occurrence of the subject alternative name to map. This attribute is optional and only used when there is more than one subject alternative name of the given alt-name-type

server-identities?

ssl?

keystore?

Name	Type	Default	Description
path	string		Specifies the location of the keystore on the host file system. You can set a relative or absolute value. If you set a relative value, configure a value for the 'relative-to' attribute. The type of the keystore will be auto-detected among JKS, JCEKS, PKCS12 or PEM. BKS, BCFKS and UBER are also supported if the `bouncycastle` libary is present. The path may be omitted when using global store providers, such as 'SunPKCS11-NSS-FIPS'.
relative-to	string	infinispan.server.config.path	Specifies a property name that resolves to a directory on the host file system. Any files that you specify with the 'path' attribute, unless absolute, must be relative to this directory.
keystore-password	string		Deprecated: use the 'password' attribute instead.
password	string		The password required to open the keystore. If the keystore is a PEM file, this should be specified as an empty string.
alias	string		The alias of the entry in the keystore to use as the server identity. Only required if there are multiple entries in the keystore.
key-password	string		A password required to access a specific entry within the keystore. Only needed if the keystore type supports it and the entries have been protected by an additional password.
generate-self-signed-certificate-host	string		If this attribute is set and if the file that backs the KeyStore does not exist, then a self-signed certificate will be generated on first use and it will be persisted to the file that backs the KeyStore. The value of this attribute will be used for the Common Name value in the self-signed certificate. The use of this attribute is intended for testing purposes only. This attribute is not intended for production use.
provider	string		The name of the provider to use to instantiate the KeyManagerFactory. If the provider is not specified, the first provider found that can create an instance of the specified 'type' will be used.
type	string		The type of the keystore. Normally the type will be auto-detected. This attribute is required for file-less keystores, for example when using the `SunPKCS11-nss-fips` provider.

credential-reference?

Credential reference to be used by the configuration.

Name	Type	Default	Description
store	string		Credential store name used to fetch credential with given 'alias' from. Credential store name has to be defined elsewhere.
alias	string		Alias of credential in the credential store.

truststore?

Name	Type	Default	Description
path	string		Specifies the location of the truststore on the host file system. You can set a relative or absolute value. If you set a relative value, configure a value for the 'relative-to' attribute. The type of the keystore will be auto-detected among JKS, JCEKS, PKCS12 or PEM. BKS, BCFKS and UBER are also supported if the `bouncycastle` libary is present. The path may be omitted when using global store providers, such as 'SunPKCS11-NSS-FIPS'.
relative-to	string	infinispan.server.config.path	Specifies a property name that resolves to a directory on the host file system. Any files that you specify with the 'path' attribute, unless absolute, must be relative to this directory.
password	string		The password required to open the truststore. If the truststore is a PEM file, this should be specified as an empty string.
provider	string		The name of the provider to use to instantiate the TrustManagerFactory. If the provider is not specified, the first provider found that can create an instance of the specified 'type' will be used.
type	string		The type of the truststore. Normally the type will be auto-detected. This attribute is required for file-less truststores, for example when using the `SunPKCS11-nss-fips` provider.

credential-reference?

Credential reference to be used by the configuration.

Name	Type	Default	Description
store	string		Credential store name used to fetch credential with given 'alias' from. Credential store name has to be defined elsewhere.
alias	string		Alias of credential in the credential store.

engine?

Name	Type	Default	Description
enabled-protocols
enabled-ciphersuites	string	DEFAULT	The filter to be applied to the cipher suites made available by this SSL engine.
enabled-ciphersuites-tls13	string	TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256	The ciphersuite names to use for the TLSv1.3 engine.

kerberos*

Name	Type	Default	Description
principal	string		Specifies the principal that the KeyTab represents.
keytab-path	string		Sets the path to the KeyTab for retrieving credentials.
relative-to	string		Specifies the name of a named path or a standard path that the system provides. If set, the value of the "path" attribute becomes relative to this path.
minimum-remaining-lifetime	int	0	Specifies, in seconds, how long a cached credential can remain before it is recreated.
request-lifetime	int		Specifies, in seconds, how much lifetime to request for newly created credentials.
fail-cache	int		Specifies the amount of time, in seconds, to wait before attempting to obtain server credential if the previous attempt failed. Prevents long waiting periods on every authentication attempt if the KDC is unavailable.
server	boolean	true	Specifies if the realm is server-side (default) or client-side.
obtain-kerberos-ticket	boolean	false	Controls if a KerberosTicket is also obtained and associated with the credential. The value must be true if credentials are delegated to the server.
debug	boolean	false	Defines if the JAAS step to obtain the credential has debug logging enabled.
wrap-gss-credential	boolean	false	Specifies if generated GSS credentials are wrapped to prevent improper disposal.
required	boolean	false	Specifies if the keytab file with adequate principal must exist when the service starts.
mechanism-names		KRB5 SPNEGO	Defines the mechanism names with which the credential can be used. Names are converted to OIDs and used together with OIDs from the mechanism-oids attribute.
mechanism-oids			Defines the mechanism OIDs with which the credential can be used. Used with OIDs derived from names from the mechanism-names attribute.

ldap-realm?

Defines an LDAP security realm.

Name	Type	Default	Description
name	string		Names the security realm to logically separate multiple realms of the same type.
url	string		Specifies the URL for LDAP server connections in the format ldap[s]://{hostname}:{port}.
principal	string		Specifies the user principal for LDAP server connections.
credential	string		Specifies the user credential for LDAP server connections.
direct-verification	boolean		Configures the realm to verify credentials by connecting to LDAP servers with the account. Values are true / false (default).
page-size	int	50	Sets the page size for realm iteration. The default value is 50.
connection-pooling	boolean	false	Enables connection pooling.
referral-mode		follow	Specifies if LDAP server referrals are followed and corresponds to the REFERRAL ("java.naming.referral") environment property. Values are "ignore", "follow" (default), and "throw".
connection-timeout	string	5s	Sets the timeout, in milliseconds, for LDAP server connections. The default value is 5 seconds. You can optionally set one of the following units: ms (milliseconds), s (seconds), m (minutes), h (hours), d (days).
read-timeout	string	1m	Sets the read timeout, in milliseconds, for LDAP server operations. The default value is 1 minute. You can optionally set one of the following units: ms (milliseconds), s (seconds), m (minutes), h (hours), d (days).
client-ssl-context	string		The name of a realm which provides a trust store with which to validate SSL client connections.

credential-reference?

Credential reference to be used by the configuration.

Name	Type	Default	Description
store	string		Credential store name used to fetch credential with given 'alias' from. Credential store name has to be defined elsewhere.
alias	string		Alias of credential in the credential store.

name-rewriter?

Specifies a name rewriter that transforms names returned by a realm.

case-principal-transformer

Specifies a PrincipalTransformer definition using case conversion

Name	Type	Default	Description
uppercase	boolean	true	Whether to transform to UPPERCASE or lowercase. The default is true.

Specifies the base type for all PrincipalTransformer definitions.

Name	Type	Default	Description
name	string		Deprecated. Will be ignored.

common-name-principal-transformer

Specifies a PrincipalTransformer definition which extracts the first CommonName (CN) from a DistinguishedName (DN).

regex-principal-transformer

Specifies a PrincipalTransformer definition using regular expressions and Matcher based replacement.

Name	Type	Default	Description
pattern	string		Specifies the regular expression for this PrincipalTransformer.
replacement	string		Specifies the replacement string for the PrincipalTransformer.
replace-all	boolean	false	Replaces all occurrences instead of the first occurrence.

Specifies the base type for all PrincipalTransformer definitions.

Name	Type	Default	Description
name	string		Deprecated. Will be ignored.

identity-mapping*

Specifies configuration options that define how principals are mapped to corresponding entries in LDAP servers.

Name	Type	Default	Description
search-dn	string		Names the context for query execution. This option provides a useful method to authenticate users based on names that do not use X.500 format, such as "plainUser". In this case, you must also specify the rdn-identifier. If names to authenticate users are based on the X.500 format, you can suppress this configuration. You should also note that this option lets realms authenticate users based on simple, or X.500, names.
rdn-identifier	string		Specifies an LDAP attribute that contains the user name and appears in the path of new entries.
search-recursive	boolean	false	Performs recursive queries.
search-time-limit	int	10000	The time limit of LDAP search in milliseconds. Defaults to 10000 ms.
filter-name	string	(rdn_identifier={0})	Specifies the LDAP filter that retrieves an identity by name. In the default value, "{0}" is replaced with the searched identity name and "rdn_identifier" is replaced with the value of the "rdn-identifier" attribute.

attribute-mapping?

Specifies the attribute mappings defined for this resource.

attribute

Name	Type	Default	Description
filter	string		The filter to use to obtain the values for a specific attribute. String "{0}" will be replaced by username, "{1}" by user identity DN.

Name	Type	Default	Description
filter-dn	string		The name of the context where the filter should be performed.
from	string		The name of the LDAP attribute to map to an identity attribute. If not defined, DN of the whole entry is used as value.
to	string		The name of the identity attribute mapped from a specific LDAP attribute. If not provided, the name of the attribute is the same as define in 'from'. If the 'from' is not defined too, value 'dn' is used.
search-recursive	boolean	true	Indicates if attribute LDAP search queries are recursive.
role-recursion	int	0	Sets recursive roles assignment - value determine maximum depth of recursion. (0 for no recursion)
role-recursion-name	string	cn	Determine LDAP attribute of role entry which will be substitute for "{0}" in filter-name when searching roles of role. Used only when role-recursion is set.
extract-rdn	string		The RDN key to use as the value for an attribute, in case the value in its raw form is in X.500 format.

attribute-reference

Name	Type	Default	Description
reference	string		The name of an LDAP attribute containing DN of entry to obtain value from.

Name	Type	Default	Description
filter-dn	string		The name of the context where the filter should be performed.
from	string		The name of the LDAP attribute to map to an identity attribute. If not defined, DN of the whole entry is used as value.
to	string		The name of the identity attribute mapped from a specific LDAP attribute. If not provided, the name of the attribute is the same as define in 'from'. If the 'from' is not defined too, value 'dn' is used.
search-recursive	boolean	true	Indicates if attribute LDAP search queries are recursive.
role-recursion	int	0	Sets recursive roles assignment - value determine maximum depth of recursion. (0 for no recursion)
role-recursion-name	string	cn	Determine LDAP attribute of role entry which will be substitute for "{0}" in filter-name when searching roles of role. Used only when role-recursion is set.
extract-rdn	string		The RDN key to use as the value for an attribute, in case the value in its raw form is in X.500 format.

user-password-mapper?

Specifies the user password credential mapping defined for this resource.

Name	Type	Default	Description
from	string		The name of the LDAP attribute to map to an identity user password credential.
verifiable	boolean		If the password credential is verifiable.

local-realm?

Name	Type	Default	Description
name	string	local

properties-realm?

Name	Type	Default	Description
name	string		Names the security realm to logically separate multiple realms of the same type.
groups-attribute	string	Roles

user-properties?

Name	Type	Default
path	string	users.properties
relative-to	string	infinispan.server.config.path
digest-realm-name	string
plain-text	boolean	false

group-properties?

Name	Type	Default	Description
path	string	groups.properties
relative-to	string	infinispan.server.config.path

token-realm?

Name	Type	Default
name	string
auth-server-url	string
client-id	string
principal-claim	string	username

jwt

Name	Type	Default	Description
issuer			Defines one or more string values representing an unique identifier for the entities that are allowed as issuers of a given JWT. During validation JWT tokens must have a iss claim that contains one of the values defined here. If not provided, the validator will not perform validations based on the issuer claim.
audience			Defines one or more string values representing the audiences supported by this configuration. During validation JWT tokens must have an aud claim that contains one of the values defined here. If not provided, the validator will not perform validations based on the audience claim.
public-key	string		A default public key in its PEM format used to validate the signature of tokens without kid header parameter. If not provided, the validator will not validate signatures.
jku-timeout	string	2m	A timeout, in milliseconds for cached jwks when using jku claim. After this timeout, the keys of need to be re-cached before use. Default value is 2 minutes. You can optionally set one of the following units: ms (milliseconds), s (seconds), m (minutes), h (hours), d (days).
connection-timeout	string	2s	Sets the timeout, in milliseconds, for connections to the JKU server. The default value is 2 seconds. You can optionally set one of the following units: ms (milliseconds), s (seconds), m (minutes), h (hours), d (days).
read-timeout	string	2s	Sets the read timeout, in milliseconds, for the JKU server. operations. The default value is 2 seconds. You can optionally set one of the following units: ms (milliseconds), s (seconds), m (minutes), h (hours), d (days).
client-ssl-context	string		The name of a realm which provides a trust store with which to validate SSL client connections.
host-name-verification-policy	string		A HostnameVerifier that will be used to validate the hostname when using SSL/TLS. This configuration is mandatory if using jku claims. Can be ANY or DEFAULT.

oauth2-introspection

Name	Type	Default	Description
client-id	string		The identifier of a client registered within the OAuth2 Authorization Server that will be used to authenticate this server in order to validate bearer tokens arriving to this server. Please note that the client will be usually a confidential client with both an identifier and secret configured in order to authenticate against the token introspection endpoint. In this case, the endpoint must support HTTP BASIC authentication using the client credentials (both id and secret).
client-secret	string		The secret of the client identified by the given clientId.
introspection-url	string		An URL pointing to a RFC-7662 OAuth2 Token Introspection compatible endpoint.
connection-timeout	string	2s	Sets the timeout, in milliseconds, for connections to the OAuth2 server. The default value is 2 seconds. You can optionally set one of the following units: ms (milliseconds), s (seconds), m (minutes), h (hours), d (days).
read-timeout	string	2s	Sets the read timeout, in milliseconds, for the OAuth2 server. operations. The default value is 2 seconds. You can optionally set one of the following units: ms (milliseconds), s (seconds), m (minutes), h (hours), d (days).
client-ssl-context	string		The name of a realm which provides a trust store with which to validate SSL client connections.
host-name-verification-policy	string		A HostnameVerifier that will be used to validate the hostname when using SSL/TLS. This configuration is mandatory if the given token introspection url is using SSL/TLS. Can be ANY or DEFAULT.

credential-reference?

Credential reference to be used by the configuration.

Name	Type	Default	Description
store	string		Credential store name used to fetch credential with given 'alias' from. Credential store name has to be defined elsewhere.
alias	string		Alias of credential in the credential store.

truststore-realm?

Name	Type	Default	Description
name	string

distributed-realm?

A realm definition for authentication and authorization of identities distributed between multiple realms.

Name	Type	Default	Description
name	string
realms			A list of security realms that should be used for authentication until one succeeds. If no realms are specified, all the available realms will be used.

aggregate-realm?

A realm definition for authentication and authorization of identities aggregated between multiple realms.

Name	Type	Description
name	string
authentication-realm	FIXME	The name of a security realm that should be used for authentication.
authorization-realms		A list of security realm names that should be used for authorization. If no realms are specified, all the available realms will be used.

name-rewriter?

Specifies a name rewriter that transforms names returned by a realm.

case-principal-transformer

Specifies a PrincipalTransformer definition using case conversion

Name	Type	Default	Description
uppercase	boolean	true	Whether to transform to UPPERCASE or lowercase. The default is true.

Specifies the base type for all PrincipalTransformer definitions.

Name	Type	Default	Description
name	string		Deprecated. Will be ignored.

common-name-principal-transformer

Specifies a PrincipalTransformer definition which extracts the first CommonName (CN) from a DistinguishedName (DN).

regex-principal-transformer

Specifies a PrincipalTransformer definition using regular expressions and Matcher based replacement.

Name	Type	Default	Description
pattern	string		Specifies the regular expression for this PrincipalTransformer.
replacement	string		Specifies the replacement string for the PrincipalTransformer.
replace-all	boolean	false	Replaces all occurrences instead of the first occurrence.

Specifies the base type for all PrincipalTransformer definitions.

Name	Type	Default	Description
name	string		Deprecated. Will be ignored.