Appendix: Cloud Service Management Console Properties

If you change this hostname, you must update the value of the idm.csa.hostname property in the PERSISTENT_VOLUME_PATH/jboss-as/standalone/deployments/idm-service.war/WEB-INF/spring/applicationContext.properties file.

If you change this port, you must update the value of the idm.csa.port property in the PERSISTENT_VOLUME_PATH/jboss-as/standalone/deployments/idm-service.war/WEB-INF/spring/applicationContext.properties file.

Required. The protocol used by the REST API to connect to the system on which CSA is running.

This attribute must be set to https.

If you change this protocol, you must update the value of the idm.csa.protocol property in the PERSISTENT_VOLUME_PATH/jboss-as/standalone/deployments/idm-service.war/WEB-INF/spring/applicationContext.properties file.

Required. The provider organization identifier assigned to the organization who is providing this instance of the Cloud Service Management Console.

This attribute must be set to CSA-Provider.

The hcm-csa.yaml key that controls the cache timeout.

Default: 300 seconds

Comma-separated root folder names from Operations Orchestration for the Action Selection Wizard when used in the Lifecycle Action and User Operations areas.

Default: =/Library/CSA Content Pack/CSA3.2/Providers,/Library/CSA Content Pack/CSA3.2/CSA Import and Migration Pack

Comma-separated root folder names from Operations Orchestration for the Action Selection Wizard when used in the Approvals area.

Default: =/Library/CSA Content Pack/CSA3.2/External Approval System/Service Manager/Actions

Comma-separated root folder names from Operations Orchestration for the Action Selection Wizard when used in the Resource Pool area.

Default: =/Library/CSA Content Pack/CSA3.2/Providers/Infrastructure/vCenter/Resource Pool Sync/Actions

By default, this attribute is commented out. When this attribute is commented out or does not contain a valid value, the login disclaimer and color-coded banners are not displayed for the Cloud Service Management Console.

If you want to enable the login disclaimer and color-coded banners, uncomment this attribute and set the value to GOVERNMENT. If set to any other value, the login disclaimer and color-coded banners are not displayed.

To edit the disclaimer page, edit the PERSISTENT_VOLUME_PATH/jboss‑as/standalone/deployments/csa.war/static/template/disclaimerNote.jsp file.

To edit the disclaimer content, edit the PERSISTENT_VOLUME_PATH/jboss‑as/standalone/deployments/csa.war/WEB-INF/classes/msgs/messages_en.properties file. To locate the disclaimer content in this file, search for message property entries beginning with csa.security.warning.

By default, this attribute is commented out. This attribute defines the color and content that displays in the security banner. The security banners appear at the top and bottom of the Cloud Service Management Console.

The following values are shipped with CSA:

• UNCLASSIFIED. The banner is light green and contains no content. An example is shown below.
• UNCLASSIFIED_FOUO. For official use only. The banner is light green and displays the text "FOUO." An example is shown below.

  FOUO

• UNCLASSIFIED_NOFORN. Not releasable to foreign nationals. The banner is light green and displays the text "NOFORN." An example is shown below.

  NOFORN

• CONFIDENTIAL. The banner is light blue and displays the text "CONFIDENTIAL." An example is shown below.

  CONFIDENTIAL

• CONFIDENTIAL_FOUO. The banner is light blue and displays the text "CONFIDENTIAL-FOUO." An example is shown below.

  CONFIDENTIAL-FOUO

• CONFIDENTIAL_NOFORN. The banner is light blue and displays the text "CONFIDENTIAL-NOFORN." An example is shown below.

  CONFIDENTIAL-NOFORN

• SECRET. The banner is red and displays the text "SECRET." An example is shown below.

  SECRET

• TOPSECRET. The banner is orange and displays the text "TOPSECRET." An example is shown below.

  TOPSECRET

To edit the banner content, edit the PERSISTENT_VOLUME_PATH/jboss‑as/standalone/deployments/csa.war/WEB-INF/classes/msgs/messages_en.properties file. To locate the banner content in this file, search for message property entries beginning with csa.security.label.

Defines the type of email notification: html/text.

• html enables custom HTML notifications.
• text enables the legacy text-based notification.

Default: html

The notification templates will be cached so that I/O performance is improved while sending notifications. If any notification template used by CSA is changed, then the changes will not be seen in later notifications unless the CSA service is restarted.

The value of csa.notification.cacheTemplates may be set to false during development of custom notifications so that a service restart is not required every time a notification template is changed.

Default: true

The URL used to access the Marketplace Portal of an organization and is displayed in the Organization URL field in the General Information section of an organization's page in the Cloud Service Management Console.

You can use specific values or one or more of the following variables:

• {protocol} - The protocol used to connect to the Marketplace Portal. This is either http or https. The variable value is the same protocol used to access the Cloud Service Management Console.
• {host} - The fully-qualified domain name or IP address of the system on which the Marketplace Portal is installed. The variable value is the same host on which the Cloud Service Management Console is installed.
• {orgName} - The organization's name. The variable value is the Organization Identifier displayed in the General Information section of an organization's page. The Organization Identifier is based on the value entered in the Organization Display Name field.

The port configured for the Marketplace Portal in this property should match the port attribute value configured in the PERSISTENT_VOLUME_PATH/portal/conf/mpp.json file.

If a variable's value is incorrect, you can enter a specific value in place of the variable. For example,
https://{host}:8089/org/{orgName} or
{protocol}://csa_system.xyz.com:8089/#/login/marketing

Default: {protocol}://{host}:8089/org/{orgName}

This property is disabled by default in a fresh install, which prevents the administrator from modifying organization widgets. This property controls whether the administrator only sees the widgets, or has the ability to edit the widgets.

• false disables editing the Mashup Widgets, they can only be seen. If the administrator tries to edit the Mashup Widget, a pop-up message appears stating that support for adding and editing Mashup Widgets is currently disabled.
• true enables editing the Mashup Widgets.

Default: false

Required. The encrypted password used by the CSA built-in admin user (defined in the PERSISTENT_VOLUME_PATH/jboss‑as/standalone/deployments/idm-service.war/WEB-INF/classes/provider-users.properties file). The admin user account is used for initial login to the Cloud Service Management Console and can also be used to authenticate REST API calls.

The password should be encrypted (see Encrypt a password for instructions). An encrypted password is preceded by ENC without any separating spaces and is enclosed in parentheses.

If you change this password, you must also update the password of any REST API calls that use this password. For more information about the REST APIs, refer to the Cloud Service Automation API Quick Start Guide and Cloud Service Automation API Guide.

Required. The encrypted password used by the CSA built-in csaReportingUser user (defined in the PERSISTENT_VOLUME_PATH/jboss‑as/standalone/deployments/idm-service.war/WEB-INF/classes/provider-users.properties file). The csaReportingUser user account is used when a subscription is ordered or modified and a field for the subscription includes a dynamically generated list. The dynamically generated list is a subscriber option property configured to use a dynamic query. The dynamic query uses this account to access CSA to determine the values that will appear in the list. This account has read-only access to Cloud Service Automation.

The password should be encrypted (see Encrypt a password for instructions). An encrypted password is preceded by ENC without any separating spaces and is enclosed in parentheses.

If you change this password, you must also update the password of any REST API calls that use this password. For more information about the REST APIs, see the Cloud Service Automation API Guide.

Required. The CSA built-in user used to authenticate REST API calls between the Marketplace Portal and Cloud Service Management Console (it should not be used to log in to the Cloud Service Management Console).

If you change this username, you must update the value of the idm.csa.username property in the PERSISTENT_VOLUME_PATH/jboss-as/standalone/deployments/idm-service.war/WEB-INF/spring/applicationContext.properties file.

For more information about the integration user account, see Change CSA Built-In User Accounts. For more information about the REST APIs, see the Cloud Service Automation API Guide.

Required. The encrypted password used by the CSA built-in csaTransportUser user (defined in the CSA_HOME\jboss‑as\standalone\deployments\csa.war\WEB-INF\applicationContext-security.xml file). The csaTransportUser user account is used to authenticate REST API calls between the Marketplace Portal and Cloud Service Management Console (it should not be used to log in to the Cloud Service Management Console).

The password should be encrypted (see Encrypt a password for instructions). An encrypted password is preceded by ENC without any separating spaces and is enclosed in parentheses.

If you change this password, you must update the value of the idm.csa.password property in the PERSISTENT_VOLUME_PATH/jboss-as/standalone/deployments/idm-service.war/WEB-INF/spring/applicationContext.properties file.

For more information about the integration user account, see Change CSA Built-In User Accounts. For more information about the REST APIs, see the Cloud Service Automation API Guide.

Required. The encrypted password used by the CSA built-in ooInboundUser user (defined in the PERSISTENT_VOLUME_PATH/jboss‑as/standalone/deployments/idm-service.war/WEB-INF/classesprovider-users.properties file). The ooInboundUser user account is used by Operations Orchestration to authenticate REST API calls with CSA (it should not be used to log in to the Cloud Service Management Console).

The password should be encrypted (see Encrypt a password for instructions). An encrypted password is preceded by ENC without any separating spaces and is enclosed in parentheses.

If you change this password, you must also update and use the same password for the CSA_REST_CREDENTIALS system account in Operations Orchestration (located in the Configuration folder of the Public Repository).

Required. The encrypted password used by the CSA built-in cdaInboundUser user (defined in the PERSISTENT_VOLUME_PATH/jboss‑as/standalone/deployments/idm-service.war/WEB-INF/classes/provider-users.properties file). The cdaInboundUser user account is used by Continuous Delivery Automation to authenticate REST API calls with CSA (it should not be used to log in to the Cloud Service Management Console).

The password should be encrypted (see Encrypt a password for instructions). An encrypted password is preceded by ENC without any separating spaces and is enclosed in parentheses.

If you change this password, you must also update and use the same password in Continuous Delivery Automation. For more information about this user account, see Change CSA Built-In User Accounts.

Required. The encrypted password used by the CSA built-in idmTransportUser user (defined in the PERSISTENT_VOLUME_PATH/jboss‑as/standalone/deployments/csa.war/WEB-INF/applicationContext-security.xml file). The idmTransportUser user account is used to authenticate REST API calls (it should not be used to log in to the Cloud Service Management Console).

The password should be encrypted (see Encrypt a password for instructions). An encrypted password is preceded by ENC without any separating spaces and is enclosed in parentheses.

If you change this password, you must also update the following passwords (you must use the same password):

• the idmTransportUser property in the PERSISTENT_VOLUME_PATH/jboss-as/standalone/deployments/idm-service.war/WEB-INF/classes/integrationusers.properties file.
• the password attribute in the idmProvider section of the
  PERSISTENT_VOLUME_PATH/portal/conf/mpp.json file.

• the password of any REST API calls that use this password.

For more information about this user account, see Change CSA Built-In User Accounts.

Required. The encrypted password used by the CSA built-in csaCatalogAggregationTransportUser user (defined in the PERSISTENT_VOLUME_PATH/jboss‑as/standalone/deployments/csa.war/WEB-INF/applicationContext-security.xml file). The csaCatalogAggregationTransportUser user account is used to authenticate catalog aggregation REST API calls with CSA (it should not be used to log in to the Cloud Service Management Console).

The password should be encrypted

If you change this password, you must also update the password using the catalog aggregation registration REST APIs. For more information about this user account, see Change CSA Built-In User Accounts.

CSA's encrypted signing key used to encrypt and decrypt authentication data passed between CSA and the Identity Management component.

If you change this key, you must also update the idm.encryptedSigningKey property in the PERSISTENT_VOLUME_PATH/jboss-as/standalone/deployments/idm-service.war/WEB-INF/spring/applicationContext.properties file.

The key should be encrypted . The encrypted key is preceded by ENC without any separating spaces and is enclosed in parentheses.

Required. Determines if certificate validation, hostname verification, and certificate authentication are performed by CSA when making a secure connection (only using HTTPS) with an application or a component of CSA. Examples of an application include Operations Orchestration or a resource provider. Examples of a component of CSA include the Marketplace Portal and the Identity Management component. Other non-HTTP connections that have been configured to be secure are not affected by this property. For example, secure connections to the database, LDAP server, or SMTP server are not affected.

By default, this property is set to false. That is, when CSA establishes a secure connection with another application or component, the connection will only be encrypted. No validation, verification, or authentication is performed. This mode should only be used during post-installation configuration or when troubleshooting problems with certificates. This mode should NOT be used in a production environment.

When set to true, when CSA establishes a secure connection with another application or component, the following occurs:

• The connection will be encrypted
• Certificate validation - Checks that the certificate used by the application/component has not expired
• Hostname verification - Checks that the certificate hostname matches the URL hostname of the application/component to which CSA is connecting
• Certificate authentication - Checks that the certificate or the root certificate used to sign the certificate has been imported into JRE truststore (for example, JRE_HOME/lib/security/cacerts)

Default: false

A comma-delimited list of the file extensions that designate the types of documents or files that cannot be uploaded to the Cloud Service Management Console.

Default: exe,bat,com,cmd

A comma-delimited list of the file extensions that designate the types of documents or files that can be uploaded to the Cloud Service Management Console. The file extensions listed can be the sole extension of the file or the start of the file extension followed by one or more characters. For example, listing txt as a file extension will match both mydocument.txt and mydocument.txt_3491767613.

Files can be uploaded using the Cloud Service Management Console, the content archive tool, or the import API. Refer to the Cloud Service Management Console Help, Cloud Service Automation API Guide, or Cloud Service Automation Content Archive Tool for more information about using these features.

The following extensions are automatically supported (and do not need to be defined by this property): jpg, jpeg, jpe, jfif, svg, tif, tiff, ras, cmx, ico, pnm, pbm, pgm, ppm, rgb, xbm, xpm, xwd, png, gif, bmp, cod, ief, json, xml, jsp, jspf.

Default: (no default defined)

Example: txt,log

The maximum size of a file, in megabytes (MB), that can be uploaded to the CSA system using the Cloud Service Management Console. If this property is not listed or is not set in the hcm-csa.yaml file, the default maximum size of 50 MB is used.

Default: 50 (MB)

csa.war.images.directory.byteLimit

A total size limit for all images or icons that are uploaded into PERSISTENT_VOLUME_PATH/jboss-as/standalone/deployments/csa.war/images. The limit is used to prevent exhausting of server disk space through image upload in UI.

Unit: bytes.

Default: 500000000 bytes (500 MB)

csa.war.images.directory.smallFileByteOverhead

Used when computing space occupied by existing image/icon files (see above csa.war.images.directory.byteLimit). For each file in the images directory, a value of this property is added to its size to account for the overhead of small files on the file system.

Unit: bytes.

Default: 4096 bytes

enableSecurityWarning

Enables/disables the security warning messages for files that are uploaded or downloaded in the Cloud Service Management Console. Value is true or false.

enableSecurityWarning is in the PERSISTENT_VOLUME_PATH/jboss-as/standalone/deployments/csa.war/offerings/config.json file.

Default: true

Required. The CSA keystore that stores trusted Certificate Authority certificates.

Default: No default specified

Example

Linux:  /usr/local/hpe/csa/openjre/lib/security/cacerts

Required. The encrypted password of the CSA keystore (see Encrypt a password for instructions on encrypting passwords). An encrypted password is preceded by ENC without any separating spaces and is enclosed in parentheses.

Default: ENC(<encrypted_value>)
where the default value of <encrypted_value> is the encrypted value of "changeit".

Optional. The maximum number of service requests the service request processor can process when it checks the start and end dates of submitted subscriptions.

Default: 100

Optional. How often, in milliseconds, the service request processor checks the start and end dates of submitted subscriptions.

Default: 5000 (5 seconds)

Optional. Enable or disable auditing, which tracks user activities and system-generated events. Messages are logged to the CSA_AUDIT_EVENT table in the database.

Default: true (enabled)

Required. This property is set during installation and must not be changed. The location of the JBoss log file that records when the CSA service was stopped. Used for auditing purposes.

Default: PERSISTENT_VOLUME_PATH/jboss‑as/bin/shutdown.log

Optional. Defines a custom HTTP header used to capture the originating IP address of a REST API call. If this property is disabled (commented out) or not set to a value, the standard HTTP header X-Forwarded-For is used to capture the originating IP address. If the originating IP address is not captured by either this custom or the standard header, CSA fetches the originating IP address from the incoming request. The originating IP address is used for auditing.

CSA sets the following precedence when capturing the originating IP address of a REST API call:

1. Uses the custom HTTP header (if defined)
2. Uses the X-Forwarded-For header
3. Fetches from the incoming request

If this property is set to a custom HTTP header, CSA checks if this custom HTTP header is defined (set to the originating IP address) in the REST API call. If this property is not set or if the custom header is not defined, CSA checks if the X-Forwarded-For header is defined in the REST API call. If the X-Forwarded-For header is not defined, CSA fetches the originating IP address from the incoming request. CSA does not validate the captured value (if the value is an IP address and if it is a valid IP address).

The following is a list of CSA REST API types and which ones do and do not capture the originating IP address:

• Legacy CSA 3.x APIs: originating IP address IS CAPTURED
• Consumer (Consumption) APIs that include onBehalf parameter in the Response Content Type (i.e. Consumer APIs that use the POST, PUT, or DELETE methods): originating IP address IS CAPTURED
• Consumer (Consumption) APIs that do not include onBehalf parameter in the Response Content Type (i.e. Consumer APIs that use the GET method): originating IP address IS NOT CAPTURED
• Management (Consumption) APIs: originating IP address IS NOT CAPTURED

The originating IP address is stored in the ORIGIN_IP field of the RPT_AUDIT_EVENT_V view and the ORIGIN_IP column of the CSA_AUDIT_EVENT table. If the originating IP address is not captured, the field or column is empty.

Default: (disabled)

Optional. How often, in milliseconds, the process execution manager starts new process instances (which start Operations Orchestration flows) and checks the status of process instances.

Default: 5000 (5 seconds)

Optional. The maximum number of threads used to run process instances.

Default: 2

Optional. The token that stores the process instance ID and is used when CSA starts an Operations Orchestration flow.

Default: CSA_PROCESS_ID

Optional. The token that stores the artifact ID of the artifact that owns the action that executes the Operations Orchestration flow.

Default: CSA_CONTEXT_ID

Optional. How often, in milliseconds, the lifecycle engine checks for service components that it needs to transition.

Default: 5000 (5 seconds)

Optional. The maximum number of threads used to transition service components.

Default: 2

Optional. The maximum number of threads used to process approvals.

Default: 4

Optional. How often, in milliseconds, the approval engine scheduler checks for completion of an approval process to determine if an approval process should be approved or denied.

Default: 5000 (5 seconds)

Optional. How often, in minutes, the LDAP cache scheduler checks for user group caches that have expired. This number should be less than the value configured for com.hp.csa.UserGroupExecutor.
CACHE_EXPIRATION_TIME.

Default: 20

Optional. How long, in minutes, LDAP user groups for a user are temporarily cached in the database before they are deleted. This time should be greater than the value configured for com.hp.csa.UserGroupExecutor.
THREAD_WAKEUP_TIME.

Default: 30

Optional. The maximum number of user IDs that are deleted in a single batch from the cache. This number cannot be larger than 1,000.

Default: 250

Required. The mode in which CSA is running (single or clustered). When set to single, CSA runs in standalone mode (on a single instance) and all CSA services are run on this instance. When set to clustered, CSA runs in a clustered environment and all CSA services run on only one node (which is selected by the cluster as the singleton-service provider).

Default: single

com.hp.csa.LockMonitorService.LOCK_TIMEOUT

Default timeout in milliseconds for the background thread that checks if processes have stale locks. Individual entities may have their own timeout.

com.hp.csa.LockMonitorService.NODE_TIMEOUT

Optional. How long, in milliseconds, CSA attempts to fetch or retrieve data for dynamic properties.

Default: 30000 (30 seconds)

Optional. The maximum amount of data, in bytes, that can be retrieved for dynamic properties.

Default: 50000

Optional. The maximum number of members in an LDAP group used for approvals. For reasonable performance, do not specify more than ten (10) members.

Default: 10

Optional. The default value of the Featured Category field displayed in the Cloud Service Management Console of a selected organization. This value may be overwritten in the Cloud Service Management Console. The value configured in the Cloud Service Management Console takes precedence over this value.

This is the category that is used when displaying service offerings in the Marketplace Portal.

The value entered for this attribute is the name of a category configured in the Cloud Service Management Console but is in all capitalized letters and replaces any spaces with an underscore (_). For example, if you configure a category named e-mail Servers and want to feature this category, you would set this attribute to E-MAIL_SERVERS.

• ACCESSORY
• APPLICATION_SERVERS - Default.
• APPLICATION_SERVICES
• BACKUP_SERVICES
• CRM
• DATABASE_SERVERS
• FILE_SERVERS
• HARDWARE
• MAIL_SERVICES
• NETWORK_SERVICES
• PLATFORM_SERVICES
• SIMPLE_SYSTEM
• SOFTWARE
• WEB_HOSTING_SERVICES

For more information about the featured services, refer to the Marketplace Portal Help.

Default: APPLICATION_SERVERS

Optional. The default value of the Subscription End Date field displayed in the Cloud Service Management Console of a selected organization. This value may be overwritten in the Cloud Service Management Console by a lower value. The value configured in the Cloud Service Management Console takes precedence over this value.

This is the maximum length of a subscription, in months, if a requested end date is specified. When a subscriber selects a requested start date and requests an end date, the length of the subscription cannot be longer than the value of this property. The maximum allowed value is 12 months. For example, if the subscriber selects a requested start date of June 15, 2015, based on the default value of this property, the requested end date cannot be later than June 14, 2016. If no end date is selected, this value is ignored.

Default: 12 (months)

Optional. The default value of the Privacy Statement Link field displayed in the Cloud Service Management Console of a selected organization. This value may be overwritten in the Cloud Service Management Console. The value configured in the Cloud Service Management Console takes precedence over this value.

This is a link to an organization's privacy statement and, when enabled in the Cloud Service Management Console, appears on the login page below the copyright statement.

Default: The online privacy statement.

Optional. The default value of the Terms and Conditions Link field displayed in the Cloud Service Management Console of a selected organization. This value may be overwritten in the Cloud Service Management Console. The value configured in the Cloud Service Management Console takes precedence over this value.

This is a link to an organization's terms and conditions statement and, when enabled in the Cloud Service Management Console, appears when a subscriber is ordering a service.

Default: The terms of use statement.

Optional. Enable integration between CAC and CSA, where the CAC is used as an approval mechanism. To enable, this property must be uncommented and set to true. To disable, either comment out the property or set it to false.

Default: false (disabled)

The regular expression used to extract a user name from the subjectDN X.509 attribute. If this property is not set, then the default for regex is CN=(.*?). This property need not be set if the property csa.cac.x509Attribute is set to "san".

The regular expression used to extract a user name from the subjectDN X.509 attribute. If this property is not set, then the default for regex is CN=(.*?). This property need not be set if the property idm.cac.x509Attribute is set to "san".

Optional. The maximum number of threads used for processing internal executors (for example, clone patterns).

Default: 2

Optional. The maximum number of threads used for processing external executors (for example, Operations Orchestration).

Default: 2

Optional. The maximum number of threads used by the callback pool.

Default: 2

Optional. The maximum number of threads used by the monitor pool.

Default: 2

Optional. How often, in milliseconds, the background thread monitors plug-in processes.

Default: 20000

Optional. How often, in milliseconds, the background thread monitors for processes that have timed out.

Default: 300000

com.hp.csa.ExportSvcOffering.THREAD_WAKEUP_TIME

Defines the background service wakeup time to export non-posted offerings, subscriptions and instances into elasticsearch. When the CSA service starts, the background service wakes up. If there are no records to be exported to elasticsearch then the background services dies immediately. Otherwise the background service exports records into elasticsearch in the batches of the property defined in com.hp.csa.ExportSvcOffering.FETCH_SIZE. The background service continues to run until it processes all the non-posted records available in the CSA database.

If the background service is not running, it wakes-up again according to the time defined in this property. The value of this property should be in milliseconds.

com.hp.csa.ExportSvcOffering.FETCH_SIZE

Defines the number of records to be processed at a time. The SQL used to fetch the records from the CSA database, uses this property value to limit the number of records that can be fetched from the database and then exported to elasticsearch.

com.hp.csa.plugin.cloudos.util.TokenCache.TIMEOUT

Identity Management component token cache timeout, in milliseconds.

Every REST call to CSA (such as for provisioning) is authenticated by Identity Management. CSA uses trustId to get the authentication token from Identity Management. Because these REST calls can be more frequent, this property allows you to define the cache timeout to prevent enormous sizes during the REST call’s authentication lifecycle.

Default value: 300000 (5 minutes)

Value 0 disables cache

com.hp.csa.import.BUILD_ARTIFACT_RELATIONSHIP

Disables the artifact relationship section of the import/preview results.

loggerEnabled

csa.productPerspective

jdbc.dialect

Holds explicitly set Hibernate dialect for a given database. Recommended values for the databases are:

• MSSQL: org.hibernate.dialect.SQLServer2008Dialect
• Oracle: org.hibernate.dialect.Oracle10gDialect
• PostgreSQL: org.hibernate.dialect.PostgreSQLDialect

The URL used to access Operations Orchestration Central. This is the Operations Orchestration used for provisioning topology designs. For example, https://<hostname>:8445.

This property is automatically set during installation. If you are using the embedded Operations Orchestration that is included with CSA, this property is set using the values entered for the Fully qualified domain name on Windows or the Fully Qualified Hostname on Linux and HPE OO Port fields during installation. If you are using a standalone/external Operations Orchestration, this property is set using the values entered for the HPE OO Hostname and HPE OO Port fields during installation.

The username used to log in to Operations Orchestration Central.

This property is automatically set during installation using the value entered for the HPE OO User Name field during installation.

The encrypted password used by the user defined in OOS_USERNAME to log in to Operations Orchestration Central.

This property is automatically set during installation using the value entered for the HPE OO Password field during installation.

embedded.oo.root.dir

Location of the embedded Operations Orchestration when it is installed with CSA. This property is generated when embedded Operations Orchestration is installed during the CSA installation.

This property is the only indicator of embedded Operations Orchestration, which is important mainly for uninstallation and upgrades. This property cannot be edited.

Optional. How long, in milliseconds, CSA keeps a socket open for SOAP-based communication with Operations Orchestration.

Default: 60000

Optional. How often, in milliseconds, the background thread monitors Operations Orchestration processes.

Default: 60000

Optional. The maximum number of threads used by the monitor pool.

Default: 2

The location in Operations Orchestration where CSA generates topology design-based master Operations Orchestration flows and related subflows. The folder structure must use forward slashes.

Default: Library/CSA/Topology_Generated_Flows

Optional. An optional token in the Authorization header used for HTTP basic authentication by the CSA 3.x API. If the token is sent, it is used to authenticate the userIdentifier parameter in the REST API. For more information about the CSA API,see the Cloud Service Automation API Quick Start Guide.

Default: X-Auth-Token

Required. A comma-delimited list of users who are authorized to exercise the CSA 3.x API. The username in the Authorization header used for HTTP basic authentication must match one of the users in this list.

By default, the following CSA built-in users are configured: admin, csaCatalogAggregationTransportUser, csaReportingUser, csaTransportUser, ooInboundUser, and cdaInboundUser. You can also add LDAP users (identified by the User ID) to this list. For example, if you use email addresses for the User ID, you could add user1@xyz.com to the list.

For more information about the CSA API, see the Cloud Service Automation API Quick Start Guide.

Default: admin,csaReportingUser,ooInboundUser,
cdaInboundUser,csaTransportUser,
csaCatalogAggregationTransportUser

Optional. The amount of time, in seconds, CSA attempts to provision or de-provision a topology design that is not based on an Helion OpenStack® provider (topology design provisioning and de-provisioning is orchestrated by interacting with resource providers corresponding to the components used in the design).

If the time is exceeded, in the Operations area of the Cloud Service Management Console, the subscription (to a service offering that is created from a topology design that is not based on an Helion OpenStack® provider) will show a Subscription Status of Failed and a Service Instance Status of Failed. If you select the Events tab of the subscription, the event will show a Status of Timeout. If you select the Topology tab of the subscription, the topology view will show the status of the components in the service instance as their respective status just before the timeout occurred.

It is recommended that this value be set to the same value as the Operations Orchestration flow timeout value.

Default: 7200 (2 hours)

Optional. Enable or disable resource environment and provider selection by the subscriber in the Marketplace Portal for service offerings based on topology designs that are not based on an Helion OpenStack® provider. For more information, refer to the Cloud Service Management Console Help.

Default: true (enabled)

Required. Enable or disable the global search feature on this CSA node. If enabled, additional microservice properties may be configured.

To enable the global search feature, set this property to yes.

Default: yes (enabled)

Required if csa.provider.es.exists is enabled (set to yes). The user used by the Elasticsearch service to authenticate requests coming from CSA. It is recommended that you create a user specifically for this purpose.

If the CSA built-in consumer user is disabled or another user is used, either another built-in user or LDAP user must be configured. If using a built-in user, this user must have the SERVICE_CONSUMER role configured. If using an LDAP user, this user must be assigned to the Service Consumer role.

Default: consumer

Required if csa.provider.es.exists is enabled (set to yes). The encrypted password of the csa.provider.es.authUser user.

The password should be encrypted (see Encrypt a password for instructions). An encrypted password is preceded by ENC without any separating spaces and is enclosed in parentheses.

Default: <encrypted password of the consumer user>

Required if csa.provider.es.exists is enabled (set to yes). The name of the organization to which the csa.provider.es.authUser user belongs.

The organization is used only for authentication purposes. The Elasticsearch service will index the service offerings, service instances, or subscriptions for all organizations. However, global search results for a Marketplace Portal user will be limited to the service offerings, service instances, or subscriptions of the organization to which the user belongs and to which the user has access.

If the CSA built-in CONSUMER organization is disabled or removed, the csa.provider.es.authUser, csa.provider.es.authPassword, and csa.provider.es.authOrganization properties must be updated to use a valid user and organization.

Default: CONSUMER

csa.provider.es.idmURL

Required if csa.provider.es.exists is enabled (set to yes). The URL used to generate Identity Management component tokens for Elasticsearch service authentication. If a CSA cluster is configured for high availability using a load balancer, localhost must be changed to the hostname or IP address of the system on which the load balancer is running.

Default: https://localhost:8444/idm-service

Required if csa.provider.es.exists is enabled (set to yes). The fully-qualified domain name of the system on which the HPE Search Service is running or localhost.

Default: localhost

Required if csa.provider.es.exists is enabled (set to yes). The port used to connect to the system on which the HPE Search Service is running.

Default: 9000

Required if csa.provider.es.exists is enabled (set to yes). The protocol used by the REST API to connect to the system on which the HPE Search Service is running.

Default: https

Required. Enable or disable access to the LDAP access point configuration in the Cloud Service Management Console.

By default, the property is set to false and the CSA administrator can configure the LDAP access point of any organization from the Cloud Service Management Console (the LDAP access point is typically configured when an organization is created in the Cloud Service Management Console). LDAP configuration includes fields for the LDAP Server Information, LDAP Attributes, and User Login Information in the Cloud Service Management Console. The LDAP access point is used by CSA for authentication and authorization.

For security reasons, you may not want to allow the CSA administrator to configure the LDAP access point from the Cloud Service Management Console. You can disable access to the LDAP access point fields for all organizations from the Cloud Service Management Console by setting this property to true (disabling access makes the LDAP configuration fields read-only in the Cloud Service Management Console). By disabling this access, only the system administrator or other privileged users on the CSA system can update the LDAP access point using the LDAP Configuration Tool. Refer to the LDAP Configuration Tool guide for more information about the LDAP Configuration Tool.

To enable access to the LDAP access point configuration in the Cloud Service Management Console, set this property to false. To disable access to the LDAP access point configuration in the Cloud Service Management Console, set this property to true.

Default: false

Required. Enable or disable service design, service offering, and catalog content archive verification.

By default, the property is set to false (verification is disabled), allowing the Cloud Service Management Console or Content Archive Tool to import a service design, service offering, or catalog content archive directly without verification.

When the property is set to true (verification is enabled), CSA verifies the digital signature of the content archive, validates the date of the certificate used to sign the content archive, and verifies that the content in the content archive has not been modified after it was signed. If the content archive fails one of these validation or verification checks, the content archive will not be imported into CSA.

When enabled, all imported service design, service offering, or catalog content archives must be signed. Refer to Signing the Content Archive for the steps required to sign a content archive.

Default: false

Optional. Enable or disable integration between CSA and  ITOC. To enable, this property must be uncommented and set to true. To disable, either comment out the property or set it to false.

Default: (disabled)

Required if integration between CSA and  ITOC is enabled. To enable, this property must be uncommented and set to the endpoint of the ITOC instance. The endpoint is the URL for connecting to the ITOC instance where <protocol> is the protocol used to communicate with the ITOC instance (for example, http or https), <itoc_host> is the hostname of the ITOC instance, and <port> is the port used to connect to the system on which ITOC is running.

Default: (disabled)

Required if integration between CSA and ITOC is enabled. To enable, this property must be uncommented and set to the username used to log in to the ITOC instance.

Default: (disabled)

Required if integration between CSA and ITOC is enabled. To enable, this property must be uncommented and set to the encrypted password used by the user defined in csa.ITOC.Notification.username to log in to the ITOC instance.

Default: (disabled)

Required if integration between CSA and ITOC is enabled. To enable, this property must be uncommented and set to the tenant group to which the user defined in csa.ITOC.Notification.username belongs.

Default: (disabled)

Optional. Enable or disable integration v2 between CSA and  ITOC. To enable, this property must be uncommented and set to true. To disable, either comment out the property or set it to false.

Default: (disabled)

Required if integration v2 between CSA and  ITOC is enabled. To enable, this property must be uncommented and set to the endpoint of the ITOC instance. The endpoint is the URL for connecting to the ITOC instance where <protocol> is the protocol used to communicate with the ITOC instance (for example, http or https), <itoc_host> is the hostname of the ITOC instance, and <port> is the port used to connect to the system on which ITOC is running.

Default: (disabled)

Required if integration v2 between CSA and ITOC is enabled. To enable, this property must be uncommented and set to the ITOC integration credentials. It is used to access ITOC public tenant to get the list of policies and maintenance windows.

Username is part of the configuration key and encrypted password is value of the configuration key.

(see Encrypt a password for instructions). An encrypted password is preceded by ENC without any separating spaces and is enclosed in parentheses.

Default: (disabled)

Required if integration v2 between CSA and ITOC is enabled. To enable, this property must be uncommented and and set to integration credentials for each consumer tenant of ITOC. Tenant is part of the configuration key, username is part of the configuration key and encrypted password is value of the configuration key.

Default: (disabled)

Required if integration v2 between CSA and ITOC is enabled. To enable, this property must be uncommented and set to connection timeout in milliseconds.

Default: (disabled)

Optional. The amount of inactivity, in minutes, that causes the Cloud Service Management Console session to time out.

Default: 60

rest.restrict.fields

A comma separated list of the fields that are not included in the REST response. By default the rest.restrict.fields property includes these fields: createdBy, updatedBy, createdOn, updatedOn, description, iconUrl, and categoryType.

For details see "Values for the restrict parameter" in the Cloud Service Automation API Guide.

rest.restrict

Enable or disable the fields specified in the rest.restrict.fields property to be excluded/included in the output of the REST response.

If set to true, the fields are excluded in the output of the REST response.

If set to false, the fields are included in the output of the REST response.

Default: false

For details see "Values for the restrict parameter" in the Cloud Service Automation API Guide.

Enable or disable the document field to be excluded/included in the output of the REST response.

If set to true, the document field is excluded in the output of the REST response.

If set to false, the document field is included in the output of the REST response.

Default: false

For details see "Values for the excludedoc parameter" in the Cloud Service Automation API Guide.