Codar Console properties

If you change this hostname, you must update the value of the idm.codar.hostname property in the CSA_HOME\jboss-as\standalone\deployments\
idm-service.war\WEB-INF\spring\applicationContext.properties file.

If you change this port, you must update the value of the idm.codar.port property in the CSA_HOME\jboss-as\standalone\deployments\
idm-service.war\WEB-INF\spring\applicationContext.properties file.

Required. The protocol used by the REST API to connect to the system on which Codar is running.

This attribute must be set to https.

If you change this protocol, you must update the value of the idm.codar.protocol property in the CSA_HOME\jboss-as\standalone\deployments\
idm-service.war\WEB-INF\spring\applicationContext.properties file.

Required. The provider organization identifier assigned to the organization who is providing this instance of the Codar Console.

This attribute must be set to CSA-Provider.

Required to enable the account lockout mechanism.

To disable, set this property to false. It may be useful to disable account lockout in the case where an attacker continues to lock system accounts to cause denial of service, and the administrator is confident that all Codar Console users have very strong, secret passwords.

Default: true

The amount of failed login attempts that will lock the account

Default: 3

The length of the watch period since the last failed login attempt after which the counter of failed login attempts will be reset.

Default: 60 seconds

The length of the lockout period after which the account will be allowed to log in again.

Default: 300 seconds (5 minutes)

By default, this attribute is commented out. When this attribute is commented out or does not contain a valid value, the login disclaimer and color-coded banners are not displayed for the Codar Console.

If you want to enable the login disclaimer and color-coded banners, uncomment this attribute and set the value to GOVERNMENT. If set to any other value, the login disclaimer and color-coded banners are not displayed.

To edit the disclaimer page, edit the
CSA_HOME\jboss‑as\standalone\
deployments\csa.war\static\template\
disclaimerNote.jsp
file.

To edit the disclaimer content, edit the
CSA_HOME\jboss‑as\standalone\
deployments\csa.war\WEB-INF\classes\
msgs\messages_en.properties
file.

By default, this attribute is commented out. This attribute defines the color and content that displays in the security banner. The security banners appear at the top and bottom of the Codar Console.

The following values are provided out-of-the-box:

• UNCLASSIFIED. The banner is light green and contains no content. An example is shown below.
• UNCLASSIFIED_FOUO. For official use only. The banner is light green and displays the text "FOUO." An example is shown below.

  FOUO

• UNCLASSIFIED_NOFORN. Not releasable to foreign nationals. The banner is light green and displays the text "NOFORN." An example is shown below.

  NOFORN

• CONFIDENTIAL. The banner is light blue and displays the text "CONFIDENTIAL." An example is shown below.

  CONFIDENTIAL

• CONFIDENTIAL_FOUO. The banner is light blue and displays the text "CONFIDENTIAL-FOUO." An example is shown below.

  CONFIDENTIAL-FOUO

• CONFIDENTIAL_NOFORN. The banner is light blue and displays the text "CONFIDENTIAL-NOFORN." An example is shown below.

  CONFIDENTIAL-NOFORN

• SECRET. The banner is red and displays the text "SECRET." An example is shown below.

  SECRET

• TOPSECRET. The banner is orange and displays the text "TOPSECRET." An example is shown below.

  TOPSECRET

To edit the banner content, edit the CSA_HOME\jboss‑as\standalone\deployments\csa.war\WEB-INF\classes\msgs\messages_en.properties file.

Enables or disables package promotion notification.

true enables package promotion notification.

text disables package promotion notification.

Default: true

Required. The encrypted password used by the out-of-the-box admin user (defined in the CSA_HOME\
jboss‑as\standalone\deployments\
csa.war\WEB-INF\applicationContext-security.xml file). The admin user account is used for initial login to the Codar Console and can also be used to authenticate REST API calls.

The password should be encrypted (see Encrypt password for instructions on encrypting passwords).

If you change this password, you must also update the password of any REST API calls that use this password. For more information about the REST APIs, see the Codar API and CLI Reference Guide.

securityCsaReporting
UserPassword

Required. The encrypted password used by the out-of-the-box csaReportingUser user (defined in the CSA_HOME\
jboss‑as\standalone\deployments\
csa.war\WEB-INF\applicationContext-security.xml file).

The csaReportingUser user account is used when a subscription is ordered or modified and a field for the subscription includes a dynamically generated list. The dynamically generated list is a subscriber option property configured to use a dynamic query. The dynamic query uses this account to access Codar to determine the values that will appear in the list. This account has read-only access to Codar.

The password should be encrypted (see Encrypt password for instructions).

If you change this password, you must also update the password of any REST API calls that use this password. For more information about the REST APIs, see the Codar API and CLI Reference Guide.

Required. The out-of-the-box user used to authenticate REST API calls between the Marketplace Portal and Codar Console (it should not be used to log in to the Codar Console).

If you change this username, you must update the value of the idm.csa.username property in the CSA_HOME\jboss-as\standalone\deployments\
idm-service.war\WEB-INF\spring\applicationContext.properties file.

For more information about the integration user account, see Change Codar out-of-the-box user accounts for Windows and Linux. For more information about the REST APIs, see the Codar API and CLI Reference Guide.

Required only if both the Cloud Service Automation and Codar licenses are used.

The encrypted password used by the out-of-the-box csaTransportUser user (defined in the CSA_HOME\
jboss‑as\standalone\deployments\
csa.war\WEB-INF\applicationContext-security.xml file). The csaTransportUser user account is used to authenticate REST API calls between the Marketplace Portal and Codar Console (it should not be used to log in to the Codar Console).

The password should be encrypted (see Encrypt password for instructions).

If you change this password, you must update the value of the idm.codar.password property in the CSA_HOME\jboss-as\standalone\deployments\
idm-service.war\WEB-INF\spring\applicationContext.properties file.

For more information about the integration user account, see Change Codar out-of-the-box user accounts for Windows and Linux. For more information about the REST APIs, see the Codar API and CLI Reference Guide.

Required. The encrypted password used by the out-of-the-box ooInboundUser user (defined in the CSA_HOME\
jboss‑as\standalone\deployments\
csa.war\WEB-INF\applicationContext-security.xml file). The ooInboundUser user account is used by Operations Orchestration to authenticate REST API calls with

 Codar (it should not be used to log in to the Codar Console).

The password should be encrypted (see Encrypt password for instructions).

If you change this password, you must also update and use the same password for the CSA_REST_CREDENTIALS system account in Operations Orchestration (see Operations Orchestration settings and the Codar Installation and Configuration Guide).

Required. The encrypted password used by the out-of-the-box cdaInboundUser user (defined in the CSA_HOME\
jboss‑as\standalone\deployments\
csa.war\WEB-INF\applicationContext-security.xml file). The cdaInboundUser user account is used by Continuous Delivery Automation to authenticate REST API calls with Codar (it should not be used to log in to the Codar Console).

The password should be encrypted (see Encrypt password for instructions).

If you change this password, you must also update and use the same password in Continuous Delivery Automation. For more information about this user account, see Change Codar out-of-the-box user accounts for Windows and Linux.

Required. The encrypted password used by the out-of-the-box idmTransportUser user (defined in the CSA_HOME\
jboss‑as\standalone\deployments\
csa.war\WEB-INF\applicationContext-security.xml file). The idmTransportUser user account is used to authenticate REST API calls (it should not be used to log in to the Codar Console).

The password should be encrypted (see Encrypt password for instructions).

If you change this password, you must also update the following passwords (you must use the same password):

• idmTransportUser property in the CSA_HOME\
jboss-as\standalone\deployments\
idm-service.war\WEB-INF\classes\
integrationusers.properties file.

• Password of any REST API calls that use this password.

For more information about this user account, see Change Codar out-of-the-box user accounts for Windows and Linux.

Required. The encrypted password used by the out-of-the-box codarCatalogAggregationTransportUser user (defined in the CSA_HOME\jboss‑as\standalone\
deployments\csa.war\WEB-INF\
applicationContext-security.xml file). The codarCatalogAggregationTransportUser user account is used to authenticate catalog aggregation REST API calls with Codar (it should not be used to log in to the Codar Console).

The password should be encrypted (see Encrypt password for instructions).

If you change this password, you must also update the password using the catalog aggregation registration REST APIs. For more information about this user account, see Change Codar out-of-the-box user accounts for Windows and Linux.

Codar's encrypted signing key used to encrypt and decrypt authentication data passed between Codar and the Identity Management component.

If you change this key, you must also update the idm.encryptedSigningKey property in the CSA_HOME\jboss-as\standalone\deployments\
idm-service.war\WEB-INF\spring\applicationContext.properties file.

The key should be encrypted (see Encrypt passwordfor instructions. The encrypted key is preceded by ENC without any separating spaces and is enclosed in parentheses.

A comma-delimited list of the file extensions that designate the types of documents or files that cannot be uploaded to the Codar Console.

Default: exe,bat,com,cmd

A comma-delimited list of the file extensions that designate the types of documents or files that can be uploaded to the Codar Console. The file extensions listed can be the sole extension of the file (for example, mydocument.txt, where txt is one of the listed file extensions) or the start of the file extension (for example, mydocument.txt_3491767613).

Files can be uploaded using the Codar Console, the content archive tool, or the import API. See the Codar Console Help or Codar API and CLI Reference Guide for more information about using these features.

The following extensions are automatically supported (and do not need to be defined by this property): jpg, jpeg, jpe, jfif, svg, tif, tiff, ras, cmx, ico, pnm, pbm, pgm, ppm, rgb, xbm, xpm, xwd, png, gif, bmp, cod, ief, json, xml, jsp, jspf.

Default: (no default defined)

Example: txt,log

csa.maxFileUploadSize

The maximum size of a file, in megabytes (MB), that can be uploaded to the Codar system using the Codar Console. If this property is not listed or is not set in the csa.properties file, the default maximum size of 50 MB is used.

Default: 50 (MB)

A total size limit for all images or icons that are uploaded into CSA_HOME/jbossas/ standalone/deployments/csa.war/images. The limit is used to prevent exhausting of server disk space through image upload in UI.

Unit: bytes.

Default: 500000000 bytes (500 MB)

Used when computing space occupied by existing image/icon files (see above csa.war.images.directory.byteLimit). For each file in the images directory, a value of this property is added to its size to account for the overhead of small files on the file system.

Unit: bytes.

Default: 4096 bytes

Enables/disables the security warning messages for files that are uploaded or downloaded in the Cloud Service Management Console. Value is true or false. enableSecurityWarning is in the CSA_HOME\jbossas\ standalone\deployments\csa.war\offerings\conf ig.json file.

Default: true

Required. The Codar keystore that stores trusted Certificate Authority certificates.

Default: No default specified

Example
CSA_JRE_HOME/lib/security/cacerts

Required. The encrypted password of the Codar keystore (see Encrypt password). An encrypted password is preceded by ENC without any separating spaces and is enclosed in parentheses.

Default: No default specified

Example

ENC(9eC7TTnB0uGOGK5U648UITcEV5AuV5T)

Optional. The maximum number of service requests the service request processor can process when it checks the start and end dates of submitted subscriptions.

Default: 100

Optional. How often, in milliseconds, the service request processor checks the start and end dates of submitted subscriptions.

Default: 5000 (5 seconds)

Size of the thread pool for the release gate deploy action.

Default: 2

Size of the thread pool for the release gate custom action.

Default: 2

Size of the thread pool for the release gate approval action

Default: 2

Thread pool wake up time for the release gate execution engine. The engine will sleep for the specified time in milliseconds

Default:5000

Default thread pool size for all release gate actions

Default: 2

The maximum number of release gate instances that will be fetched by the engine at any point of time.

Default: 30

The maximum number of approvers you can set to approve release gate action.

Default: 10

Optional. Enable or disable auditing, which tracks user activities and system-generated events. Messages are logged to the CSA_AUDIT_EVENT table in the database.

Default: true (enabled)

Required. This property is set during installation and must not be changed. The location of the JBoss log file that records when the Codar service was stopped. Used for auditing purposes.

Default: CSA_HOME/jboss‑as/bin/shutdown.log

Optional. How often, in milliseconds, the process execution manager starts new process instances (which start Operations Orchestration flows) and checks the status of process instances.

Default: 5000 (5 seconds)

Optional. The maximum number of threads used to run process instances.

Default: 2

Optional. The token that stores the process instance ID and is used when Codar starts an Operations Orchestration flow.

Default: CSA_PROCESS_ID

Optional. The token that stores the artifact ID of the artifact that owns the action that executes the Operations Orchestration flow.

Default: CSA_CONTEXT_ID

Optional. How often, in milliseconds, the lifecycle engine checks for service components that it needs to transition.

Default: 5000 (5 seconds)

Optional. The maximum number of threads used to transition service components.

Default: 2

Optional. The maximum number of lifecycle stages that can be created.

Default: 12

If you set it to a value greater than 12, it will default to a value of 12. That is, you cannot create more than 12 lifecycle stages.

Optional. The maximum number of roles that can be created.

Default: 100

If you set it to a value greater than 100, it will default to a value of 100. That is, you cannot create more than 100 roles.

Optional. How often, in minutes, the approval engine scheduler checks for completion of an approval process to determine if an approval process should be approved or denied.

Default: 1

Optional. How often, in minutes, the LDAP cache scheduler checks for user group caches that have expired. This number should be less than the value configured for com.hp.csa.UserGroupExecutor.
CACHE_EXPIRATION_TIME.

Default: 20

Optional. How long, in minutes, LDAP user groups for a user are temporarily cached in the database before they are deleted. This time should be greater than the value configured for com.hp.csa.UserGroupExecutor.
THREAD_WAKEUP_TIME.

Default: 30

Optional. The maximum number of user IDs that are deleted in a single batch from the cache. This number cannot be larger than 1,000.

Default: 250

Required. The mode in which Codar is running (single or clustered). When set to single, Codar runs in standalone mode (on a single instance) and all Codar services are run on this instance. When set to clustered, Codar runs in domain mode (in a clustered environment) and all Codar services are run on the master node.

If you are using Microsoft SQL Server as your database, this property must be set to single.

If you are running on Linux, this property must be set to single.

Default: single

Optional. How long, in milliseconds, Codar attempts to fetch or retrieve data for dynamic properties.

Default: 3000 (3 seconds)

Optional. The maximum amount of data, in bytes, that can be retrieved for dynamic properties.

Default: 50000

csa.group.numberOfApprovers

Optional. The maximum number of members in an LDAP group used for approvals. For reasonable performance, do not specify more than ten (10) members.

Default: 10

Optional. Enable integration between Common Access Card (CAC) and Codar, where the Common Access Card is used as an approval mechanism. To enable, this property must be uncommented and set to true. To disable, either comment out the property or set it to false.

Default: (disabled)

Optional. Enable integration between CA SiteMinder and Codar, where the SiteMinder is used for single sign-on. To enable, this property must be uncommented and set to true. To disable, either comment out the property or set it to false.

Default: (disabled)

Optional. Enable integration between Single Sign-On and the Codar Console. To enable, this property must be uncommented and set to true. To disable, either comment out the property or set it to false.

In a FIPS 140-2 compliant environment, this property must be set to false or must be commented out.

This property is automatically set during installation.

Optional. The maximum number of threads used for processing internal executors (for example, clone patterns).

Default: 2

Optional. The maximum number of threads used for processing external executors (for example, Operations Orchestration).

Default: 2

Optional. The maximum number of threads used by the callback pool.

Default: 2

Optional. The maximum number of threads used by the monitor pool.

Default: 2

Optional. How often, in milliseconds, the background thread monitors plug-in processes.

Default: 20000

Optional. How often, in milliseconds, the background thread monitors for processes that have timed out.

Default: 300000

Defines the background service wakeup time to export non-posted offerings, subscriptions and instances into Elasticsearch. When the CSA service starts, the background service wakes up. If there are no records to be exported to elasticsearch then the background services dies immediately. Otherwise the background service exports records into elasticsearch in the batches of the property defined in com.hp.csa.ExportSvcOffering.FETCH_SIZE. The background service continues to run until it processes all the non-posted records available in the CSA database.

If the background service is not running, it wakes-up again according to the time defined in this property. The value of this property should be in milliseconds.

Identity Management component token cache timeout, in milliseconds.

Every REST call to CSA (such as for provisioning) is authenticated by Identity.

Management. CSA uses trustId to get the authentication token from Identity Management.

Because these REST calls can be more frequent, this property allows you to define the cache timeout to prevent enormous sizes during the REST call’s authentication lifecycle.

Default value: 300000 (5 minutes)

Value 0 disables cache

Holds explicitly set Hibernate dialect for a given

database. Recommended values for the databases are:

• MSSQL:

org.hibernate.dialect.SQLServer2008Dialect

• Oracle:

org.hibernate.dialect.Oracle10gDialect

• PostgreSQL:

org.hibernate.dialect.PostgreSQLDialect

The URL used to access Operations Orchestration Central. This is the Operations Orchestration used for provisioning topology designs (Operations Orchestration version 10.21).

Set this URL to the system on which Operations Orchestration version 10.21 is installed. For example, https://<hostname>:8443.

The username used to log in to Operations Orchestration Central.

Set this username to admin.

The encrypted password used by the user defined in OOS_USERNAME to log in to Operations Orchestration Central.

Set this property to the encrypted value of the user defined in OOS_USERNAME (see Encrypt password). An encrypted password is preceded by ENC without any separating spaces and is enclosed in parentheses.

Location of the embedded Operations Orchestration when it is installed with Codar. This property is generated when embedded Operations Orchestration is installed during the Codar installation.

This property is the only indicator of embedded Operations Orchestration, which is important mainly for uninstallation and upgrades. This property cannot be edited.

Optional. How long, in milliseconds, Codar keeps a socket open for SOAP-based communication with Operations Orchestration.

Default: 60000

Optional. How often, in milliseconds, the background thread monitors Operations Orchestration processes.

Default: 60000

Optional. The maximum number of threads used by the monitor pool.

Default: 2

Optional. The amount of time, in seconds, Codar attempts to provision or de-provision a topology design that is not based on an Helion OpenStack® provider (topology design provisioning and de-provisioning is orchestrated by interacting with resource providers corresponding to the components used in the design).

If the time is exceeded, in the Operations area of the Codar Console, the subscription (to a service offering that is created from a topology design that is not based on an HPE Helion OpenStack® provider) will show a Subscription Status of Failed and a Service Instance Status of Failed. If you select the Events tab of the subscription, the event will show a Status of Timeout. If you select the Topology tab of the subscription, the topology view will show the status of the components in the service instance as their respective status just before the timeout occurred.

HPE recommends that this value is set to the same value as the Operations Orchestration flow timeout value.

Default: 7200 (2 hours)

Optional. Enable or disable the resource provider selection option (displaying or not displaying this option to a subscriber) for topology designs that are not based on an Helion OpenStack® provider.

Default: true (enabled)

Optional. Enable or disable express designs in the topology designer. Express designs simplify the process of creating basic Helion OpenStack® topology designs.

Default: false

Optional. Enable or disable the Pre-create Callout and Post-create Callout properties of the Server Group Type component in the topology designer. See the Codar Console Help for more information about these properties.

Default: false

Optional. Enable or disable the OpenStack tab in the Create new design dialog in the topology designer. The tab allows the designer to select an OpenStack provider when creating a topology design.

Default: false

Optional. The amount of inactivity, in minutes, that causes the Codar Console session to time out.

Default: 60

Optional. Set the size of the thread pool for Codar scheduler.

Default: 2

Optional. Set the thread wake-up time (in milliseconds) for the scheduler engine. The engine will go to Sleep mode for the specified duration.

Default: 600000

Optional. Set the maximum number of schedule jobs that will be processed by the engine at any point of time.

Default: 20

Optional. Set the maximum number of packages that will be cleaned up in a scheduled package cleanup action.

Default: 30

Optional. Set the maximum number of deployments that will be cleaned up in a scheduled deployment cleanup action.

Default: 30

Optional. Set the maximum number of promotion schedules allowed per day across designs and lifecycle stages.

Default: 50

Optional. Enable/disable scheduler notifications for deletion of packages and cancellation of deployments.

If you set this to true then advance notifications are sent to the owner of the packages/deployments that are qualified for deletion/cancellation respectively.

In addition to the advance notification, another notification is sent to the owners when the package deletion or deployment cancellation is triggered.

Default: true