Advanced Configuration: Difference between revisions

From Obsidian Scheduler
Jump to navigationJump to search
← Older edit
 
(3 intermediate revisions by the same user not shown)
Line 15: Line 15:
#Set your LDAP info here
#Set your LDAP info here
com.carfey.suite.security.Authenticator=com.carfey.suite.security.LdapAuthenticator
com.carfey.suite.security.Authenticator=com.carfey.suite.security.LdapAuthenticator
# As of Obsidian 2.1.1, you can specify the attribute type used in building up the distinguished name (dn). If unspecified, defaults to cn
# You can specify the attribute type used in building up the distinguished name (dn). If unspecified, defaults to cn
com.carfey.suite.security.LdapAuthenticator.dn.attribute=uid
com.carfey.suite.security.LdapAuthenticator.dn.attribute=uid
# As of Obsidian 4.5.0, you can provide a delimited list (delimiter is 3 tildes ~~~) of dn.bases to search.
# As of Obsidian 4.5.0, you can provide a delimited list (delimiter is 3 tildes ~~~) of dn.bases to search.
com.carfey.suite.security.LdapAuthenticator.dn.base=ou=people,o=MyOrgHere
com.carfey.suite.security.LdapAuthenticator.dn.base=ou=people,o=MyOrgHere
com.carfey.suite.security.LdapAuthenticator.url=ldap://localhost:10389
com.carfey.suite.security.LdapAuthenticator.url=ldap://localhost:10389
# As of Obsidian 2.1.1, you can specify the SECURITY_AUTHENTICATION. Defaults to simple.  
# You can specify the SECURITY_AUTHENTICATION. Defaults to simple.
com.carfey.suite.security.LdapAuthenticator.securityAuthentication=simple
com.carfey.suite.security.LdapAuthenticator.securityAuthentication=simple
# Any necessary additional information such as Provider, Principal and Host will need to be handled in your custom class extending LdapAuthenticator.
# Any necessary additional information such as Provider, Principal and Host will need to be handled in your custom class extending LdapAuthenticator.


# As of Obsidian 3.5.1, you can login via an LDAP attribute that is not part of the dn. A matching entry is found in the LDAP Directory (using anonymous or a fixed lookup account)  
# You can login via an LDAP attribute that is not part of the dn. A matching entry is found in the LDAP Directory (using anonymous or a fixed lookup account)
# after which the dn attribute above is retrieved to perform the user's authentication. The following 5 attributes are only used for this type of lookup and authentication.
# after which the dn attribute above is retrieved to perform the user's authentication. The following 5 attributes are only used for this type of lookup and authentication.
com.carfey.suite.security.LdapAuthenticator.lookupDnAttribute=false
com.carfey.suite.security.LdapAuthenticator.lookupDnAttribute=false
# As of Obsidian 3.5.1, this is the attribute name that is being searched for in the LDAP directory to build the dn for eventual authentication.
# This is the attribute name that is being searched for in the LDAP directory to build the dn for eventual authentication.
com.carfey.suite.security.LdapAuthenticator.loginAttribute=sAMAccountName
com.carfey.suite.security.LdapAuthenticator.loginAttribute=sAMAccountName
# As of Obsidian 3.5.1, this determines if these lookups will be done anonymously (without a session authenticated by user/password)
# This determines if these lookups will be done anonymously (without a session authenticated by user/password)
com.carfey.suite.security.LdapAuthenticator.anonymousEnabled=false
com.carfey.suite.security.LdapAuthenticator.anonymousEnabled=false
# As of Obsidian 3.5.1, if anonymous lookups are not permitted or desired, provide the dn and password to be used for lookups. Typically, a read-only account with  
# If anonymous lookups are not permitted or desired, provide the dn and password to be used for lookups. Typically, a read-only account with
# read rights to the LDAP entries and attributes in question is sufficient.
# read rights to the LDAP entries and attributes in question is sufficient.
com.carfey.suite.security.LdapAuthenticator.searchUserFullDn=cn=ObsidianLDAPReadOnly,ou=people,o=MyOrgHere
com.carfey.suite.security.LdapAuthenticator.searchUserFullDn=cn=ObsidianLDAPReadOnly,ou=people,o=MyOrgHere
Line 381: Line 381:




# As of Obsidian 2.5.0, we support JNDI lookups for email sessions. All other email properties can be excluded.
# We support JNDI lookups for email sessions. All other email properties can be excluded.
mail.session.jndi.path=java:comp/env/mail/session
mail.session.jndi.path=java:comp/env/mail/session
</pre>
</pre>
Line 409: Line 409:


# As of Obsidian 2.5.0, we support JNDI lookups for database connectivity.
# We support JNDI lookups for database connectivity.
com.carfey.obsidian.db.url=java:comp/env/jdbc/obsidian
com.carfey.obsidian.db.url=java:comp/env/jdbc/obsidian
com.carfey.obsidian.db.jndiType=mysql
com.carfey.obsidian.db.jndiType=mysql
Line 418: Line 418:
#com.carfey.obsidian.db.jndiType=sqlserver
#com.carfey.obsidian.db.jndiType=sqlserver


# Table prefix may be used to add a prefix to tables and related database objects. It must be 6 or fewer characters and can contain letters or underscores. Available as of version 2.0.
# Table prefix may be used to add a prefix to tables and related database objects. It must be 6 or fewer characters and can contain letters or underscores.
com.carfey.obsidian.db.tablePrefix=OBSDN_
com.carfey.obsidian.db.tablePrefix=OBSDN_


# For Oracle databases, when Obsidian's tables exist in a different schema from the user specified above, or if the user does not default to the schema matching its name, specify the target schema here. Available as of version 2.1.
# For Oracle databases, when Obsidian's tables exist in a different schema from the user specified above, or if the user does not default to the schema matching its name, specify the target schema here.
# For details on the required privileges to run with an alternate user, see https://wiki.obsidianscheduler.com/docs/Obsidian_Tables#Oracle_Privileges
# For details on the required privileges to run with an alternate user, see https://wiki.obsidianscheduler.com/docs/Obsidian_Tables#Oracle_Privileges
# This same configuration item can be used to configure the Postgresql schema. If unspecified, the default is public. Available as of Obsidian 2.1.1.  
# This same configuration item can be used to configure the Postgresql schema. If unspecified, the default is public.
# If using JNDI and Oracle/Postgresql, we recommend you set this value to ensure best performance.
# If using JNDI and Oracle/Postgresql, we recommend you set this value to ensure best performance.
com.carfey.obsidian.db.schema=obsidian
com.carfey.obsidian.db.schema=obsidian
Line 433: Line 433:
com.carfey.obsidian.db.connectionTimeout=2000
com.carfey.obsidian.db.connectionTimeout=2000


# As of 3.4.0, you can disable pooling of connections, which is suggested only if using another connection pool through JNDI. When true, maxConnections is ignored.  
# You can disable pooling of connections, which is suggested only if using another connection pool through JNDI. When true, maxConnections is ignored.
# When a JNDI data source is selected in the installer, this is set to true by default.
# When a JNDI data source is selected in the installer, this is set to true by default.
com.carfey.obsidian.db.disablePooling=true
com.carfey.obsidian.db.disablePooling=true
Line 465: Line 465:
com.carfey.obsidian.licence.name=licenceeName
com.carfey.obsidian.licence.name=licenceeName


# As of 2.8.0, if you have issues with classloading (e.g. in Grails or Spring), this flag enables usage of the context classloader .
# If you have issues with classloading (e.g. in Grails or Spring), this flag enables usage of the context classloader .
com.carfey.jdk.useContextClassLoader=true
com.carfey.jdk.useContextClassLoader=true


# As of 2.9.0, you can set the scheduler host designator name multiple times in the same JVM by using this parameter:
# You can set the scheduler host designator name multiple times in the same JVM by using this parameter:
com.carfey.obsidian.schedulerDesignation=obsidian-dev
com.carfey.obsidian.schedulerDesignation=obsidian-dev


# As of 3.0.0, Job Forking can be enabled and configured per node
# Job Forking can be enabled and configured per node
com.carfey.obsidian.jvmJobForkingEnabledOnThisNode=true
com.carfey.obsidian.jvmJobForkingEnabledOnThisNode=true
# This property is the location of the fork scripts. Obsidian is bundled with obsidianForkedJob.bat and obsidianForkedJob.sh. These are the expected script names.
# This property is the location of the fork scripts. Obsidian is bundled with obsidianForkedJob.bat and obsidianForkedJob.sh. These are the expected script names.
Line 481: Line 481:
# For example, you may need to do this if your configuration is done via System Property overrides or programmmatically in your embedded Obsidian instance.
# For example, you may need to do this if your configuration is done via System Property overrides or programmmatically in your embedded Obsidian instance.
#com.carfey.obsidian.jvmJobForkingIncludeDbSysParms=true
#com.carfey.obsidian.jvmJobForkingIncludeDbSysParms=true
# Obsolete as of 4.0.0. As of 3.4.0, the base URL used to resolve links in the Obsidian web app can be overridden. This is typically only required when a load balancer or proxy is used to access Obsidian.
com.carfey.obsidian.baseHrefUrl=http://myhost:8080/obsidian


# As of 4.3.0, description/parameter formatting is supported. Custom formatter (com.carfey.ops.job.config.formatter.Formatter) supported via this parameter.
# As of 4.3.0, description/parameter formatting is supported. Custom formatter (com.carfey.ops.job.config.formatter.Formatter) supported via this parameter.
Line 523: Line 520:


<pre>
<pre>
# Table prefix may be used to add a prefix to tables and related database objects. It must be 6 or fewer characters and can contain letters or underscores. Available as of version 2.0.
# Table prefix may be used to add a prefix to tables and related database objects. It must be 6 or fewer characters and can contain letters or underscores.
com.carfey.obsidian.db.tablePrefix=OBSDN_
com.carfey.obsidian.db.tablePrefix=OBSDN_
</pre>
</pre>
Line 529: Line 526:
== Properties/Yaml File ==
== Properties/Yaml File ==


The above configuration must reside in a properties file named <code>com.carfey.properties</code> or a yaml file named <code>com.carfey.yaml</code> found according to the rules of [http://docs.oracle.com/javase/6/docs/api/java/lang/ClassLoader.html#getResource(java.lang.String) ClassLoader.getResource].  If both yaml and properties files are found, yaml is loaded first and properties values will override. Some possibilities include <code>WEB-INF/classes/com.carfey.(properties/yaml)</code>, a <code>com.carfey.(properties/yaml)</code> file in a directory which is explicitly added to the classpath, or at the root of a jar file as is done in <code>obsidian-props.jar</code> for standalone deployments. Prior to Obsidian 3.6, this file had to exist on the classpath, even if only using the override options below to configure Obsidian.
The above configuration must reside in a properties file named <code>com.carfey.properties</code> or a yaml file named <code>com.carfey.yaml</code> found according to the rules of [http://docs.oracle.com/javase/6/docs/api/java/lang/ClassLoader.html#getResource(java.lang.String) ClassLoader.getResource].  If both yaml and properties files are found, yaml is loaded first and properties values will override. Some possibilities include <code>WEB-INF/classes/com.carfey.(properties/yaml)</code>, a <code>com.carfey.(properties/yaml)</code> file in a directory which is explicitly added to the classpath, or at the root of a jar file as is done in <code>obsidian-props.jar</code> for standalone deployments.


Instead of using a classpath resource for properties, you can specify an external properties file using the Java system property <code>carfey.properties.file</code>. All expected properties must be specified in either the default <code>com.carfey.properties</code> file on the classpath or in the override file. Any properties found in both files will use the override file's values. Usage: <code>-Dcarfey.properties.file=/home/obsidian/obsidian.properties</code>.
Instead of using a classpath resource for properties, you can specify an external properties file using the Java system property <code>carfey.properties.file</code>. All expected properties must be specified in either the default <code>com.carfey.properties</code> file on the classpath or in the override file. Any properties found in both files will use the override file's values. Usage: <code>-Dcarfey.properties.file=/home/obsidian/obsidian.properties</code>.
Line 535: Line 532:
Instead of using a classpath resource for yaml, you can specify an external yaml file using the Java system property <code>carfey.yaml.file</code>. All expected configuration values must be specified in either the default <code>com.carfey.yaml</code> file on the classpath or in the override file. Any configuration values found in both files will use the override file's values. Usage: <code>-Dcarfey.yaml.file=/home/obsidian/obsidian.yaml</code>.
Instead of using a classpath resource for yaml, you can specify an external yaml file using the Java system property <code>carfey.yaml.file</code>. All expected configuration values must be specified in either the default <code>com.carfey.yaml</code> file on the classpath or in the override file. Any configuration values found in both files will use the override file's values. Usage: <code>-Dcarfey.yaml.file=/home/obsidian/obsidian.yaml</code>.


As of Obsidian 2.1, you may also use a programmatic properties override. Simply call <code>com.carfey.jdk.sys.Configurator.setOverride(Properties props)</code> as early as possible in the application startup.  To quote the javadoc of this method, ''For use as a programmatic properties override. This must be called before any classes are accessed either through invocation or class initialization that may require access to configuration done through properties. Best if done as early as possible in code, perhaps first in an entry point class that does little else and then hands-off to existing entry point.''
You may also use a programmatic properties override. Simply call <code>com.carfey.jdk.sys.Configurator.setOverride(Properties props)</code> as early as possible in the application startup.  To quote the javadoc of this method, ''For use as a programmatic properties override. This must be called before any classes are accessed either through invocation or class initialization that may require access to configuration done through properties. Best if done as early as possible in code, perhaps first in an entry point class that does little else and then hands-off to existing entry point.''


As of Obsidian 4.4, you may specify configuration values as System Properties or Environment Variables. Duplicated values are resolved as follows:
As of Obsidian 4.4, you may specify configuration values as System Properties or Environment Variables. Duplicated values are resolved as follows:
Line 568: Line 565:
== Dependent Libraries ==
== Dependent Libraries ==


Obsidian Scheduler requires a number of third party libraries, both for the web administration application and the scheduler itself.  Below is information on these libraries and how they are used. Unless otherwise noted, they are mandatory. As of Obsidian 2.5.0, our installer supports selective [[Installation_Guide#Configuring_3rd_Party_Library_Conflict_Management|conflict management]].
Obsidian requires a number of third-party libraries for the scheduler and the web administration application. Unless noted, libraries in a category are required for that deployment profile. The installer supports selective [[Installation_Guide#Configuring_3rd_Party_Library_Conflict_Management|conflict management]] and can omit unused optional stacks. License attribution for shipped artifacts is in the product <code>NOTICE</code>.


''Authentication (OAuth / OIDC)''
=== Overview ===
All libraries in this section are only required when OAuthAuthenticator is active. '''As of Obsidian 7.0.0'''


* oauth2-oidc-sdk-11.23.1.jar, nimbus-jose-jwt-10.0.2.jar. Nimbus OAuth 2.0 SDK with OpenID Connect extensions and JOSE+JWT support.
{| class="wikitable"
* content-type-2.3.jar, lang-tag-1.7.jar. Supporting libraries for the Nimbus SDK.
! Category !! Required when !! Notes
* json-smart-2.5.2.jar, accessors-smart-2.5.2.jar. JSON parsing for the Nimbus SDK.
|-
* jcip-annotations-1.0-1.jar. Concurrency annotations for the Nimbus SDK.
| Core || Always || Scheduler and shared runtime
* asm-9.7.1.jar. Bytecode manipulation library; transitive dependency of the Nimbus SDK.
|-
| Database drivers || Matching database engine || Unused drivers may be omitted at install
|-
| Mail || Email notifications enabled || Choose the javax '''or''' Jakarta stack
|-
| Scripting || Matching script job type || Groovy is modular (see Scripting table)
|-
| Web Admin || Web administration UI || Includes Markdown rendering (Flexmark)
|-
| Authentication (OAuth / OIDC) || ''OAuthAuthenticator'' active || Installer can remove when unused
|-
| Authentication (SAML 2.0) || ''SAMLAuthenticator'' active || Installer removes when SAML is not selected
|-
| Embedded Tomcat || Embedded Tomcat pack selected || Present under <code>embed-tomcat-lib/</code>
|}


''Authentication (SAML 2.0)''
=== Core ===
All libraries in this section are only required when SAMLAuthenticator is active; the installer removes them when SAML is not the selected authentication type. '''As of Obsidian 7.0.0'''


* opensaml-core-4.3.2.jar, opensaml-saml-api-4.3.2.jar, opensaml-saml-impl-4.3.2.jar, opensaml-security-api-4.3.2.jar, opensaml-security-impl-4.3.2.jar, opensaml-xmlsec-api-4.3.2.jar, opensaml-xmlsec-impl-4.3.2.jar, opensaml-messaging-api-4.3.2.jar, opensaml-profile-api-4.3.2.jar, opensaml-soap-api-4.3.2.jar, opensaml-soap-impl-4.3.2.jar, opensaml-storage-api-4.3.2.jar. OpenSAML 4 modules implementing SAML 2.0 messages, metadata and signature handling.
{| class="wikitable"
* java-support-8.4.2.jar. Shibboleth utility library required by OpenSAML.
! Component !! Artifacts !! Purpose
* xmlsec-2.3.4.jar. Apache Santuario XML Signature implementation.
|-
* cryptacular-1.2.5.jar, bcprov-jdk18on-1.85.jar, bcpkix-jdk18on-1.85.jar, bcutil-jdk18on-1.85.jar. Cryptographic providers used for assertion signature verification and SP key handling.
| Obsidian || <code>obsidian.jar</code> || Core library
* velocity-engine-core-2.3.jar. Template engine used by OpenSAML's message encoders.
|-
* commons-lang3-3.20.0.jar, commons-codec-1.15.jar. Apache Commons utilities required by OpenSAML.
| Gson || <code>gson-2.10.1.jar</code> || REST API and web administration JSON
* httpclient-4.5.14.jar, httpcore-4.4.16.jar. HTTP client used to retrieve IdP federation metadata.
|-
* guava-32.1.3-jre.jar, failureaccess-1.0.1.jar, listenablefuture-9999.0-empty-to-avoid-conflict-with-guava.jar. Guava collections and its companion placeholder artifacts, required by OpenSAML.
| JMustache || <code>jmustache-1.15.jar</code> || Email templating
* metrics-core-4.2.25.jar. Dropwizard Metrics, required by OpenSAML.
|-
* slf4j-api-2.0.12.jar, log4j-slf4j2-impl-2.26.0.jar. SLF4J API and its log4j2 binding, so OpenSAML's diagnostic logging is routed into Obsidian's log4j2 configuration.
| Log4j 2 || <code>log4j-api-2.26.0.jar</code>, <code>log4j-core-2.26.0.jar</code> || Logging (<code>log4j-slf4j2-impl-2.26.0.jar</code> ships with the SAML stack)
|-
| SnakeYAML || <code>snakeyaml-2.3.jar</code> || YAML configuration
|}


''Embedded Tomcat (Obsidian Embedded Tomcat JAR packs only)''
=== Database drivers ===


* tomcat-embed-core-10.1.39.jar, tomcat-embed-el-10.1.39.jar — Apache Tomcat embedded components (Apache License 2.0). Present in '''embed-tomcat-lib/''' when an Embedded Tomcat pack is selected.
{| class="wikitable"
! Component !! Artifacts !! Required when
|-
| H2 || <code>h2-1.4.200.jar</code> || Running against H2
|-
| MariaDB / MySQL || <code>mariadb-java-client-2.7.2.jar</code> || Running against MySQL or MariaDB
|-
| SQL Server || <code>mssql-jdbc-9.2.1.jre11.jar</code> || Running against SQL Server
|-
| Oracle || <code>ojdbc11-21.1.0.0.jar</code> || Running against Oracle
|-
| PostgreSQL || <code>postgresql-42.2.19.jar</code> || Running against PostgreSQL
|}


''Common''
=== Mail ===
* obsidian.jar.  Core Obsidian lib.
* gson-2.10.1. Supports REST API and web administration.
* jmustache-1.15.jar. Provides email templating.
* log4j-api-2.26.0.jar, log4j-core-2.26.0.jar.  Obsidian logging uses log4j2.
* snakeyaml-2.3.jar. Support for YAML configuration.


''Databases''
{| class="wikitable"
* h2-1.4.200.jar. H2 database and JDBC driver. Only required for running H2.
! Stack !! Artifacts !! Use
* mariadb-java-client-2.7.2.jar. MySQL JDBC driver. Only required for running against MySQL or MariaDB.
|-
* mssql-jdbc-9.2.1.jre11.jar. SQL Server JDBC driver.  Only required for running SQLServer.
| JavaMail (javax) || <code>activation-1.1.jar</code>, <code>javax.mail-1.6.2.jar</code> || Classic JavaMail notifications
* ojdbc11-21.1.0.0.jar. Oracle JDBC driver.  Only required for running Oracle.
|-
* postgresql-42.2.19.jar.  PostgreSQL JDBC driver.  Only required for running PostgreSQL.
| Jakarta Mail || <code>jakarta.activation-api-2.1.2.jar</code>, <code>jakarta.mail-api-2.1.2.jar</code>, optional <code>angus-activation-2.0.1.jar</code>, <code>angus-mail-2.0.2.jar</code> || Jakarta EE email notifications
|}


''Mail''
=== Scripting ===
* activation-1.1.jar, javax.mail-1.6.2.jar. Used for javamail (javax) email notifications.
* angus-activation-2.0.1.jar, angus-mail-2.0.2.jar. Optionally used with Jakarta EE email notifications.
* jakarta.activation-api-2.1.2.jar, jakarta.mail-api-2.1.2.jar. Used for Jakarta EE email notifications.


''Scripts''
{| class="wikitable"
* bsh-2.0b5.jar.  Support for our Bean Shell script execution. (http://www.beanshell.org).  Only required for BeanShellJob usage.
! Component !! Artifacts !! Purpose
* jruby-9.2.17.0.jar. Support for Ruby script execution (https://www.jruby.org/). Only required for RubyJob usage.
|-
* jython-standalone-2.7.2.jar. Support for Python script execution (https://www.jython.org/).  Only required for PythonJob usage.
| BeanShell || <code>bsh-2.0b5.jar</code> || BeanShellJob only
|-
| JRuby || <code>jruby-9.2.17.0.jar</code> || RubyJob only
|-
| Jython || <code>jython-standalone-2.7.2.jar</code> || PythonJob only
|-
| Groovy 4 || Modular set (17 JARs) — see list below || GroovyJob; all omitted when Groovy is disabled at install
|}


'''Scripts - Prior to Obsidian 7.0.0:'''
Groovy modular artifacts (13 runtime modules + 4 owned transitives):
Groovy scripting shipped as a single uber archive: apache-groovy-all-4.0.24.jar


'''Scripts - As of Obsidian 7.0.0:'''
<code>groovy-4.0.24.jar</code>, <code>groovy-astbuilder-4.0.24.jar</code>, <code>groovy-datetime-4.0.24.jar</code>, <code>groovy-dateutil-4.0.24.jar</code>, <code>groovy-json-4.0.24.jar</code>, <code>groovy-jsr223-4.0.24.jar</code>, <code>groovy-macro-4.0.24.jar</code>, <code>groovy-macro-library-4.0.24.jar</code>, <code>groovy-nio-4.0.24.jar</code>, <code>groovy-sql-4.0.24.jar</code>, <code>groovy-templates-4.0.24.jar</code>, <code>groovy-typecheckers-4.0.24.jar</code>, <code>groovy-xml-4.0.24.jar</code>, <code>asm-analysis-9.7.1.jar</code>, <code>asm-tree-9.7.1.jar</code>, <code>asm-util-9.7.1.jar</code>, <code>javaparser-core-3.26.2.jar</code>
Groovy scripting ships as 13 modular JARs: groovy-4.0.24.jar, groovy-astbuilder-4.0.24.jar, groovy-datetime-4.0.24.jar, groovy-dateutil-4.0.24.jar, groovy-json-4.0.24.jar, groovy-jsr223-4.0.24.jar, groovy-macro-4.0.24.jar, groovy-macro-library-4.0.24.jar, groovy-nio-4.0.24.jar, groovy-sql-4.0.24.jar, groovy-templates-4.0.24.jar, groovy-typecheckers-4.0.24.jar, groovy-xml-4.0.24.jar.
Plus four owned transitives (included when Groovy is enabled): asm-analysis-9.7.1.jar, asm-tree-9.7.1.jar, asm-util-9.7.1.jar, javaparser-core-3.26.2.jar
All 17 JARs above are excluded when Groovy scripting is disabled at install time.


''Web Admin''
=== Web Admin ===
* dom4j-2.1.3.jar.  XML utilities.
* flexmark-0.62.2.jar, flexmark-util-0.62.2.jar. Markdown formatting for Description and Parameter job annotations.
* jxl-2.6.12.jar. Excel file format utilities. Only required in web administration.
* opencsv-5.4.jar. Support for CSV downloads in UI.


'''Web Admin - As of Obsidian 7.0.0:'''
{| class="wikitable"
Markdown rendering for job and parameter descriptions ships as 12 modular JARs:
! Component !! Artifacts !! Purpose
flexmark-0.62.2.jar, flexmark-util-ast-0.62.2.jar, flexmark-util-builder-0.62.2.jar, flexmark-util-collection-0.62.2.jar, flexmark-util-data-0.62.2.jar, flexmark-util-dependency-0.62.2.jar, flexmark-util-format-0.62.2.jar, flexmark-util-html-0.62.2.jar, flexmark-util-misc-0.62.2.jar, flexmark-util-options-0.62.2.jar, flexmark-util-sequence-0.62.2.jar, flexmark-util-visitor-0.62.2.jar
|-
| dom4j || <code>dom4j-2.1.3.jar</code> || XML utilities
|-
| Flexmark || Modular set (12 JARs) — see list below || Markdown for job and parameter descriptions
|-
| JXL || <code>jxl-2.6.12.jar</code> || Excel utilities (web administration)
|-
| OpenCSV || <code>opencsv-5.4.jar</code> || CSV downloads in the UI
|}


'''As of Obsidian 7.0.0''', the following changes were made:
Flexmark modular artifacts:
* '''log4j upgraded''': log4j-api and log4j-core updated from 2.17.1 to 2.26.0.
* '''Modular Flexmark libraries''': Obsidian no longer ships '''flexmark-util-0.62.2.jar'''. Markdown rendering for job and parameter descriptions now uses 12 modular Flexmark JARs (see ''Web Admin'' above).
* * '''Modular Flexmark libraries''': Obsidian no longer ships '''flexmark-util-0.62.2.jar'''. Web Admin UI rendering now uses 12 modular Flexmark JARs (see ''Scripts'' above).
* '''OAuth / OIDC authentication libraries''' added (Nimbus OAuth 2.0 SDK and transitive dependencies). Required only when OAuthAuthenticator is configured. See [[Advanced_Configuration#OAuth_/_OIDC_Authentication_Properties|Authentication (OAuth/OIDC)]] above.
* '''SAML 2.0 authentication libraries''' added (OpenSAML 4 and its transitive dependencies, plus the SLF4J-to-log4j2 binding). Required only when SAMLAuthenticator is configured. See [[Advanced_Configuration#SAML_Authentication_Properties|Authentication (SAML 2.0)]] above.
* Embedded Tomcat runtime added (tomcat-embed-core-10.1.39.jar, tomcat-embed-el-10.1.39.jar). Present only when an Embedded Tomcat pack is selected. Replaces the Jetty quick-start distribution which has been removed.


'''Prior to Obsidian 7.0.0''', the following libraries were in use.
<code>flexmark-0.62.2.jar</code>, <code>flexmark-util-ast-0.62.2.jar</code>, <code>flexmark-util-builder-0.62.2.jar</code>, <code>flexmark-util-collection-0.62.2.jar</code>, <code>flexmark-util-data-0.62.2.jar</code>, <code>flexmark-util-dependency-0.62.2.jar</code>, <code>flexmark-util-format-0.62.2.jar</code>, <code>flexmark-util-html-0.62.2.jar</code>, <code>flexmark-util-misc-0.62.2.jar</code>, <code>flexmark-util-options-0.62.2.jar</code>, <code>flexmark-util-sequence-0.62.2.jar</code>, <code>flexmark-util-visitor-0.62.2.jar</code>
* log4j-api-2.17.1.jar, log4j-core-2.17.1.jar. Obsidian logging uses log4j2.


'''Prior to Obsidian 6.0.0''', the following library was in use.
=== Authentication (OAuth / OIDC) ===
* groovy-all-3.0.7.jar. Support for Groovy script execution (https://groovy-lang.org/).  Only required for GroovyJob usage.


'''Prior to Obsidian 5.4.0''', the following library was in use.
Required only when ''OAuthAuthenticator'' is active.
* gson-2.8.6.jar. Supports REST API and web administration.


'''Prior to Obsidian 5.2.0''', the following library was in use.
{| class="wikitable"
* jakarta.activation-1.2.1.jar. Used for email notifications.
! Component !! Artifacts !! Purpose
|-
| Nimbus OAuth / OIDC || <code>oauth2-oidc-sdk-11.23.1.jar</code>, <code>nimbus-jose-jwt-10.0.2.jar</code>, <code>content-type-2.3.jar</code>, <code>lang-tag-1.7.jar</code>, <code>json-smart-2.5.2.jar</code>, <code>accessors-smart-2.5.2.jar</code>, <code>jcip-annotations-1.0-1.jar</code>, <code>asm-9.7.1.jar</code> || OIDC SSO and JOSE+JWT (ASM is also used by Groovy when scripting is enabled)
|}


'''Prior to Obsidian 5.0.3''', the following older libraries were in use.
=== Authentication (SAML 2.0) ===
* ''Obsidian 5.0.2'' log4j-api-2.16.0.jar, log4j-core-2.16.0.jar. 
* ''Obsidian 5.0.1'' log4j-api-2.15.0.jar, log4j-core-2.15.0.jar. 
* ''Obsidian 5.0.0'' log4j-api-2.14.1.jar, log4j-core-2.14.1.jar.


'''Prior to Obsidian 5.0.0''', the following older libraries were in use.
Required only when ''SAMLAuthenticator'' is active. The installer removes this stack when SAML is not the selected authentication type.
* activation-1.1.jar, javax.mail-1.5.5.jar.  Used for email notifications.
* dom4j-1.6.1.jar. XML utilities.
* gson-2.7.jar. Supports REST API and web administration.
* bsh-2.0b4.jar.  Support for our Bean Shell script execution. (http://www.beanshell.org).  Only required for BeanShellJob usage.
* groovy-all-2.4.14.jar. Support for Groovy script execution (https://groovy-lang.org/).  Only required for GroovyJob usage.
* jython-standalone-2.7.0.jar. Support for Python script execution (https://www.jython.org/).  Only required for PythonJob usage.
* jruby-complete-9.2.7.0.jar. Support for Ruby script execution (https://www.jruby.org/). Only required for RubyJob usage.
* jmustache-1.12.jar. Provides email templating.
* h2-1.4.192.  H2 database and JDBC driver.  Only required for running H2.
* log4j-1.2.9.jar.  Obsidian logging uses log4j.
* mariadb-java-client-1.4.5.jar.  MySQL JDBC driver. Only required for running against MySQL or MariaDB.
* jtds-1.3.1.jar. SQL Server JDBC driver.  Only required for running SQLServer.
* ojdbc7-12.1.0.1.jar.  Oracle JDBC driver.  Only required for running Oracle.
* postgresql-9.4.1208.jre7.jar. PostgreSQL JDBC driver.  Only required for running PostgreSQL.
* opencsv-3.8.jar. Support for CSV downloads in UI.
* flexmark-0.19.6.jar, flexmark-util-0.19.6.jar (as of 4.3.0). Markdown formatting for Description and Parameter job annotations.


'''Prior to Obsidian 4.5.1''', the following older libraries were in use.
{| class="wikitable"
* groovy-all-2.4.7.jar. Support for Groovy script execution (https://groovy-lang.org/). Only required for GroovyJob usage.
! Component !! Artifacts !! Purpose
|-
| OpenSAML 4 || Modular set — see list below || SAML 2.0 messages, metadata, and signatures
|-
| Supporting stack || <code>java-support-8.4.2.jar</code>, <code>xmlsec-2.3.4.jar</code>, <code>cryptacular-1.2.5.jar</code>, <code>bcprov-jdk18on-1.85.jar</code>, <code>bcpkix-jdk18on-1.85.jar</code>, <code>bcutil-jdk18on-1.85.jar</code>, <code>velocity-engine-core-2.3.jar</code>, <code>commons-lang3-3.20.0.jar</code>, <code>commons-codec-1.15.jar</code>, <code>httpclient-4.5.14.jar</code>, <code>httpcore-4.4.16.jar</code>, <code>guava-32.1.3-jre.jar</code>, <code>failureaccess-1.0.1.jar</code>, <code>listenablefuture-9999.0-empty-to-avoid-conflict-with-guava.jar</code>, <code>metrics-core-4.2.25.jar</code>, <code>slf4j-api-2.0.12.jar</code>, <code>log4j-slf4j2-impl-2.26.0.jar</code> || Crypto, HTTP metadata fetch, Guava, metrics, and SLF4J→log4j2 bridge for OpenSAML diagnostics
|}


'''Prior to Obsidian 4.0.0''', the following older libraries were in use.
OpenSAML modules:
* javax.mail-1.5.2.jar.  Used for email notifications.
* jstl.jar, standard.jar.  Web utilities. Only required in web administration.
* gson-2.2.2.jar. Supports REST API and web administration.
* groovy-all-2.1.8.jar.  Support for Groovy script execution (https://groovy-lang.org/).  Only required for GroovyJob usage.
* jython-standalone-2.5.3.jar.  Support for Python script execution (https://www.jython.org/).  Only required for PythonJob usage.
* jmustache-1.8.jar. Provides email templating.
* h2-1.3.154. H2 database and JDBC driver.  Only required for running H2.
* mariadb-java-client-1.1.5.jar. MySQL JDBC driver. Only required for running against MySQL or MariaDB.
* jtds-1.2.8.jar. SQL Server JDBC driver.  Only required for running SQLServer.
* ojdbc6-11.2.0.3.jar. Oracle JDBC driver.  Only required for running Oracle.
* postgresql-9.0-801.jdbc4.jar.  PostgreSQL JDBC driver.  Only required for running PostgreSQL.


'''Prior to Obsidian 2.9.1''', the following redundant library was in included in the Obsidian packaging.
<code>opensaml-core-4.3.2.jar</code>, <code>opensaml-saml-api-4.3.2.jar</code>, <code>opensaml-saml-impl-4.3.2.jar</code>, <code>opensaml-security-api-4.3.2.jar</code>, <code>opensaml-security-impl-4.3.2.jar</code>, <code>opensaml-xmlsec-api-4.3.2.jar</code>, <code>opensaml-xmlsec-impl-4.3.2.jar</code>, <code>opensaml-messaging-api-4.3.2.jar</code>, <code>opensaml-profile-api-4.3.2.jar</code>, <code>opensaml-soap-api-4.3.2.jar</code>, <code>opensaml-soap-impl-4.3.2.jar</code>, <code>opensaml-storage-api-4.3.2.jar</code>
* smtp.jar. Used for email notifications.


'''Prior to Obsidian 2.2.0''', the following older libraries were in use.
=== Embedded Tomcat ===
* groovy-all-1.7.6.jar
* jython.jar (version 2.5.2rc2)


'''Prior to Obsidian 2.1.1''', the following libraries were also included.
Present only when an Embedded Tomcat pack is selected (<code>embed-tomcat-lib/</code>).
* carfey-date-1.2.jar or carfey-date-1.1.jar.  Date math/manipulation.
* jdk-gen.jar, jdk.jar, suite-gen.jar, suite.jar.  Core Obsidian libs.


'''Prior to Obsidian 2.1.0''', the following older libraries were in use.
{| class="wikitable"
* ojdbc14.jar Oracle JDBC driver.  Only required for running Oracle.
! Component !! Artifacts !! Purpose
|-
| Apache Tomcat embed || <code>tomcat-embed-core-10.1.39.jar</code>, <code>tomcat-embed-el-10.1.39.jar</code> || Embedded servlet runtime (Apache License 2.0)
|}


'''Prior to Obsidian 1.5''', the following older libraries were in use.
=== Embedded API classpath ===
* gson-1.5.jar. Supports REST API and web administration.


=== Required Libraries for Embedded API ===
To use the [[Embedded_API|Embedded API]], import the resources below (newer compatible versions already on your application classpath may be used). JARs are typically under the <code>standalone</code> directory. The <code>com.carfey.properties</code> / <code>com.carfey.yaml</code> file can be taken from <code>obsidian-properties-configuration.jar</code> / <code>obsidian-yaml-configuration.jar</code>, or from an Obsidian WAR under <code>WEB-INF/classes</code>.


To use the [[Embedded_API|Embedded API]], the following resources should be imported. If you have newer versions of the same JARs in your application, feel free to use the newer version. The JAR files below can generally be found in the ''standalone'' directory if your installation. The <code>com.carfey.properties</code>/<code>com.carfey.yaml</code> file can be extracted from the <code>obsidian-properties-configuration.jar</code>/<code>obsidian-yaml-configuration.jar</code> in the ''standalone'' directory, or from an Obsidian WAR file under <code>WEB-INF/classes</code>.
{| class="wikitable"
! Needed for !! Artifacts
|-
| Always || Configuration file (or configuration JAR); <code>obsidian.jar</code>; <code>dom4j-2.1.3.jar</code>; Flexmark modular set (see Web Admin); <code>gson-2.10.1.jar</code>; <code>log4j-api-2.26.0.jar</code>, <code>log4j-core-2.26.0.jar</code>; appropriate JDBC driver
|-
| Notifications || <code>jmustache-1.15.jar</code> plus the javax '''or''' Jakarta mail stack from the Mail table
|-
| Scripting jobs || BeanShell, JRuby, Jython, and/or Groovy modular set as used by your jobs
|}


* com.carfey.properties/com.carfey.yaml (configuration file), or obsidian-properties-configuration.jar/obsidian-yaml-configuration.jar, which contains the configuration file
=== Library coordinates in Obsidian 5.x and 6.x ===
* obsidian.jar
* dom4j-2.1.3.jar
* flexmark-0.62.2.jar plus the modular Flexmark JARs listed under ''Web Admin'' above
* gson-2.10.1
* log4j-api-2.26.0.jar, log4j-core-2.26.0.jar
* Appropriate JDBC JAR (e.g. mariadb-java-client-2.7.2.jar for MySQL or MariaDB)


In addition, the following resources should be included if you wish to have notification support enabled when using the API:
Current coordinates are listed above. The table below records notable library coordinates used in Obsidian 5.x and 6.x before they were replaced. Pre-5.0.0 history is not kept on this page (see page history if needed).
* jmustache-1.15.jar
** jakarta.activation-api-2.1.2.jar, jakarta.mail-api-2.1.2.jar. Used for Jakarta EE email notifications.
** angus-activation-2.0.1.jar, angus-mail-2.0.2.jar. Optionally used with Jakarta EE email notifications.
** activation-1.1.jar, javax.mail-1.6.2.jar. Used for javamail (javax) email notifications.


Finally, if you need to configure scripting jobs from the API, you will need to include any applicable JARs from the following list:
{| class="wikitable"
* apache-groovy-all-4.0.24.jar
! Replaced in !! Component !! Artifacts then in use
* bsh-2.0b5.jar
|-
* jruby-9.2.17.0.jar
| 7.0.0 || Log4j || <code>log4j-api-2.17.1.jar</code>, <code>log4j-core-2.17.1.jar</code>. Within 5.0.x patch releases before 5.0.3: 2.14.1 (5.0.0), 2.15.0 (5.0.1), 2.16.0 (5.0.2)
* jython-standalone-2.7.2.jar
|-
| 7.0.0 || Groovy || <code>apache-groovy-all-4.0.24.jar</code> (6.x). Before 6.0.0: <code>groovy-all-3.0.7.jar</code>
|-
| 7.0.0 || Flexmark || <code>flexmark-0.62.2.jar</code>, <code>flexmark-util-0.62.2.jar</code> (uber util JAR)
|-
| 7.0.0 || OAuth / OIDC, SAML 2.0, Embedded Tomcat || Not shipped before 7.0.0
|-
| 5.4.0 || Gson || <code>gson-2.8.6.jar</code>
|-
| 5.2.0 || Jakarta Activation || <code>jakarta.activation-1.2.1.jar</code>
|-
| 5.0.0 || Mail, scripting, JDBC, and related || Baseline 5.0.0 set included <code>javax.mail-1.5.5.jar</code>, <code>dom4j-1.6.1.jar</code>, <code>gson-2.7.jar</code>, <code>bsh-2.0b4.jar</code>, <code>groovy-all-2.4.14.jar</code>, <code>jython-standalone-2.7.0.jar</code>, <code>jruby-complete-9.2.7.0.jar</code>, <code>jmustache-1.12.jar</code>, <code>h2-1.4.192.jar</code>, <code>log4j-1.2.9.jar</code>, <code>mariadb-java-client-1.4.5.jar</code>, <code>jtds-1.3.1.jar</code>, <code>ojdbc7-12.1.0.1.jar</code>, <code>postgresql-9.4.1208.jre7.jar</code>, <code>opencsv-3.8.jar</code>, and (from 4.3.0) Flexmark 0.19.6
|}


== Disabling Job Execution & Scheduling in the Web Application ==
== Disabling Job Execution & Scheduling in the Web Application ==

Latest revision as of 17:15, 31 July 2026

Obsidian requires some initial configuration parameters for database connection information and desired authentication mechanisms. The installer takes care of configuring these as provided. For your reference should you wish to manually create/edit these, note the details below.

Configuration Details

The following sections show the available properties and sample values that can be used in the com.carfey.properties properties file. While properties format is shown, all the same configuration items apply to yaml support. See Properties/Yaml File for more details on this file.

Authentication Properties

# Comment out the native authenticator setup
#com.carfey.suite.security.Authenticator=com.carfey.suite.security.DBAuthenticator

LDAP Authentication Properties

#Set your LDAP info here
com.carfey.suite.security.Authenticator=com.carfey.suite.security.LdapAuthenticator
# You can specify the attribute type used in building up the distinguished name (dn). If unspecified, defaults to cn
com.carfey.suite.security.LdapAuthenticator.dn.attribute=uid
# As of Obsidian 4.5.0, you can provide a delimited list (delimiter is 3 tildes ~~~) of dn.bases to search.
com.carfey.suite.security.LdapAuthenticator.dn.base=ou=people,o=MyOrgHere
com.carfey.suite.security.LdapAuthenticator.url=ldap://localhost:10389
# You can specify the SECURITY_AUTHENTICATION. Defaults to simple.
com.carfey.suite.security.LdapAuthenticator.securityAuthentication=simple
# Any necessary additional information such as Provider, Principal and Host will need to be handled in your custom class extending LdapAuthenticator.

# You can login via an LDAP attribute that is not part of the dn. A matching entry is found in the LDAP Directory (using anonymous or a fixed lookup account)
# after which the dn attribute above is retrieved to perform the user's authentication. The following 5 attributes are only used for this type of lookup and authentication.
com.carfey.suite.security.LdapAuthenticator.lookupDnAttribute=false
# This is the attribute name that is being searched for in the LDAP directory to build the dn for eventual authentication.
com.carfey.suite.security.LdapAuthenticator.loginAttribute=sAMAccountName
# This determines if these lookups will be done anonymously (without a session authenticated by user/password)
com.carfey.suite.security.LdapAuthenticator.anonymousEnabled=false
# If anonymous lookups are not permitted or desired, provide the dn and password to be used for lookups. Typically, a read-only account with
# read rights to the LDAP entries and attributes in question is sufficient.
com.carfey.suite.security.LdapAuthenticator.searchUserFullDn=cn=ObsidianLDAPReadOnly,ou=people,o=MyOrgHere
com.carfey.suite.security.LdapAuthenticator.searchPassword=password
# As of Obsidian 4.5.1, an alternate search base configuration parameter is used for the searchUser
com.carfey.suite.security.LdapAuthenticator.searchUserDnBase=ou=people,o=MyOrgHere
# As of Obsidian 4.7.1, you may specify one or more additional group membership attributes beyond the defaults
com.carfey.suite.security.LdapAuthenticator.groupMembershipAttribute=businessGroup~~~departmentName

# Configure who may access the web app, based on LDAP group membership
# As of Obsidian 4.5.0, you can provide a delimited list (delimiter is 3 tildes ~~~) of groups to search.
com.carfey.suite.security.LdapAuthenticator.accessDN=cn=SchedulerAccess,ou=groups,o=MyOrgHere

# Configure the Write role used in the admin web app, based on LDAP group membership (by default, users may only read)
# As of Obsidian 4.5.0, you can provide a delimited list (delimiter is 3 tildes ~~~) of groups to search.
com.carfey.suite.security.LdapAuthenticator.role.write.dn=cn=SchedulerWrite,ou=groups,o=MyOrgHere
# No need to alter this
com.carfey.suite.security.LdapAuthenticator.role.write.roleName=Write

# Configure the Admin role used in the admin web app, based on LDAP group membership (users may configure system parameters, etc).
# As of Obsidian 4.5.0, you can provide a delimited list (delimiter is 3 tildes ~~~) of groups to search.
com.carfey.suite.security.LdapAuthenticator.role.admin.dn=cn=SchedulerAdmin,ou=groups,o=MyOrgHere
# No need to alter this
com.carfey.suite.security.LdapAuthenticator.role.admin.roleName=Admin

# Configure the LimitedRead role used in the admin web app, based on LDAP group membership (by default, users may only read)
# As of Obsidian 4.5.0, you can provide a delimited list (delimiter is 3 tildes ~~~) of groups to search.
com.carfey.suite.security.LdapAuthenticator.role.limitedRead.dn=cn=SchedulerLimitedRead,ou=groups,o=MyOrgHere
# No need to alter this
com.carfey.suite.security.LdapAuthenticator.role.limitedRead.roleName=LimitedRead

# Configure the APIrole used by the REST API, based on LDAP group membership
# As of Obsidian 4.5.0, you can provide a delimited list (delimiter is 3 tildes ~~~) of groups to search.
com.carfey.suite.security.LdapAuthenticator.role.api.dn=cn=SchedulerAPI,ou=groups,o=MyOrgHere
# No need to alter this
com.carfey.suite.security.LdapAuthenticator.role.api.roleName=API

OAuth / OIDC Authentication Properties

To use OAuth / OIDC SSO, set the Authenticator property to com.carfey.suite.security.OAuthAuthenticator and add the properties below. All properties are prefixed with com.carfey.suite.security.OAuthAuthenticator. (shown without prefix in the table for brevity).

Required properties
Property Description
issuer OIDC Issuer URL. Obsidian fetches <issuer>/.well-known/openid-configuration lazily on first use and caches it.
clientId Client ID registered at the IdP.
clientSecret Client secret. Keep out of version control.
redirectUri Exact callback URL registered at the IdP (e.g. https://app.example.com/oauth/callback).
scopes Space-separated OAuth scopes (e.g. openid profile email groups). Must include openid.
claim.groups Name of the token claim that carries group memberships (e.g. groups).
role.<idx>.group IdP group value for this mapping. <idx> is an arbitrary stable label (numeric or descriptive).
role.<idx>.roleName Author|Operator)).
Optional properties
Property Default Description
displayName (none) Label on the SSO button: "Sign in with <displayName>". Defaults to "Sign in with SSO".
logout.mode local local: invalidates Obsidian session only. rp: RP-initiated logout via IdP end_session_endpoint.
postLogoutRedirectUri (none) Where to redirect after RP-initiated logout. Ignored when logout.mode=local.
claim.user sub Claim used as the internal user ID in audit logs. Strongly recommend keeping as sub.
claim.displayName preferred_username Claim shown in the Obsidian UI nav bar. Separate from claim.user.
claim.validateTyp true When true, rejects Bearer tokens where typ is present but not at+JWT. Set false only for legacy IdPs that omit typ.
clockSkewSeconds 60 Clock skew tolerance for exp/nbf validation (seconds).
metadata.ttlHours 24 OIDC discovery document cache TTL in hours.
expectedAccessTokenAudience clientId Expected aud for Bearer access tokens. See security note below.
claim.groupsSource idtoken Where to read groups during browser SSO: idtoken, accesstoken, or userinfo.
claim.groupsBearerSource accesstoken Where to read groups on the Bearer path: idtoken or accesstoken. userinfo is not permitted on the Bearer path.
claim.groupsValuePath (none) Sub-field name when groups is an array of objects (e.g. name).
claim.groupsStripPrefix (none) Prefix to strip from each group value (e.g. / for Keycloak full-path style).
claim.groupsUserinfoTimeout 5 HTTP timeout in seconds for the userinfo endpoint. Only used when claim.groupsSource=userinfo.
dynamicRole.prefix (none) Prefix for auto-generated folder-role group mappings. Requires dynamicRole.suffix. Map is rebuilt at startup; adding a new root folder requires a restart.
dynamicRole.suffix (none) Suffix for auto-generated folder-role group mappings. Requires dynamicRole.prefix.
requireRole true When true, browser SSO fails if IdP groups map to no Obsidian roles. Does not apply to REST Bearer tokens.
Security notes

expectedAccessTokenAudience and cross-JWT confusion

When expectedAccessTokenAudience is not set it defaults to clientId. In many OIDC configurations the id_token also carries aud=clientId, which could allow an id_token to be submitted as a Bearer token. The claim.validateTyp=true default mitigates this for compliant IdPs (access tokens carry typ=at+JWT; id_tokens carry typ=JWT).

For maximum defence, set expectedAccessTokenAudience to a distinct resource-server identifier if your IdP supports it.

If claim.validateTyp=false AND expectedAccessTokenAudience is not explicitly set, Obsidian logs a mandatory startup WARN advising you to set expectedAccessTokenAudience.

Keycloak example
com.carfey.suite.security.Authenticator=com.carfey.suite.security.OAuthAuthenticator
com.carfey.suite.security.OAuthAuthenticator.issuer=http://localhost:8081/realms/obsidian
com.carfey.suite.security.OAuthAuthenticator.clientId=obsidian-client
com.carfey.suite.security.OAuthAuthenticator.clientSecret=test-client-secret-local
com.carfey.suite.security.OAuthAuthenticator.redirectUri=http://localhost:8080/oauth/callback
com.carfey.suite.security.OAuthAuthenticator.scopes=openid profile email groups
com.carfey.suite.security.OAuthAuthenticator.claim.groups=groups
com.carfey.suite.security.OAuthAuthenticator.claim.groupsSource=idtoken
com.carfey.suite.security.OAuthAuthenticator.role.1.group=Obsidian-Admins
com.carfey.suite.security.OAuthAuthenticator.role.1.roleName=Admin
com.carfey.suite.security.OAuthAuthenticator.role.2.group=Obsidian-Write
com.carfey.suite.security.OAuthAuthenticator.role.2.roleName=Write
com.carfey.suite.security.OAuthAuthenticator.role.3.group=Obsidian-Read
com.carfey.suite.security.OAuthAuthenticator.role.3.roleName=LimitedRead
com.carfey.suite.security.OAuthAuthenticator.role.4.group=Obsidian-API
com.carfey.suite.security.OAuthAuthenticator.role.4.roleName=API
com.carfey.suite.security.OAuthAuthenticator.displayName=Keycloak
com.carfey.suite.security.OAuthAuthenticator.logout.mode=local
com.carfey.suite.security.OAuthAuthenticator.requireRole=true
Provider notes

Microsoft Entra ID: groups claim contains GUIDs by default; configure Optional Claims for display names. Accounts with 200+ groups trigger overage. Multi-tenant apps not supported in v1.

Auth0: opaque access tokens (Auth0 default) are not supported on the Bearer path. Configure a custom API audience to get JWT access tokens.

Okta: use the Custom Authorization Server URL, not the Org Authorization Server.

v1 limitations
  • Opaque access tokens not supported on the REST/Bearer path.
  • No jti replay protection.
  • Microsoft Entra multi-tenant apps not supported.
  • No post-login IdP session validity check.
  • Dynamic role map requires restart for new root folders.
  • Installer UI supports up to 10 static role pairs; runtime supports unlimited.

SAML Authentication Properties

To use SAML 2.0 SSO, set the Authenticator property to com.carfey.suite.security.saml.SAMLAuthenticator and add the properties below. All properties are prefixed with com.carfey.suite.security.saml.SAMLAuthenticator. (shown without prefix in the table for brevity). Note the .saml. package segment in both values.

Obsidian acts as a SAML Service Provider and supports SP-initiated browser login only. See Authenticator — SAMLAuthenticator for how the login and logout flows behave and for the list of /saml endpoints.

Required properties
Property Description
entityId SP entity ID registered at the IdP (e.g. https://app.example.com/obsidian). Obsidian also requires this value to appear in the assertion's AudienceRestriction when the IdP sends one.
assertionConsumerServiceUrl Exact ACS URL where the IdP posts responses. This must be Obsidian's callback endpoint, e.g. https://app.example.com/obsidian/saml/callback.
idpMetadataUrl or idpMetadataFile Source of the IdP federation metadata: an HTTP(S) URL, or an absolute path to a local XML file. Set exactly one of the two.
attribute.groups Name of the assertion attribute carrying group memberships (e.g. groups). Required unless dynamicRole.prefix is set instead.
role.<idx>.group IdP group value for this mapping. <idx> is an arbitrary stable label (numeric or descriptive). Not needed if all roles come from dynamicRole.
role.<idx>.roleName Author|Operator)). The API role has no effect on a SAML install, because the REST API is unavailable.

Because signRequests defaults to enabled, a default configuration also requires the three keystore properties below. Disable signRequests only if your IdP does not require signed authentication requests.

Optional properties
Property Default Description
displayName (none) Label on the SSO button: "Sign in with <displayName>". Defaults to "Sign in with SSO".
signRequests true Signs the outbound AuthnRequest and SP LogoutRequest. Requires the three keystore properties.
keystore.path (none) Path to the keystore holding the SP signing key. Required when signRequests is enabled.
keystore.password (none) Keystore password. Keep out of version control.
keystore.alias (none) Alias of the SP signing key within the keystore.
wantAssertionsSigned true Requires the IdP to sign assertions, verified against the signing certificate in the IdP metadata.
singleLogoutServiceUrl (none) SP single logout URL. When set it is published in Obsidian's SP metadata and is matched against the Destination of an incoming LogoutRequest.
logout.mode local local: invalidates the Obsidian session only. slo: SP-initiated single logout via the IdP's HTTP-Redirect SingleLogoutService.
postLogoutRedirectUri (none) Where to redirect after the IdP's LogoutResponse. When blank the browser returns to /.
nameIdFormat urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified NameIDPolicy format requested from the IdP. A transient format logs a startup warning, because transient NameIDs cannot serve as stable user IDs.
attribute.user nameId Assertion attribute used as the internal user ID in audit logs. Strongly recommend keeping as nameId; any other value logs a startup warning.
attribute.displayName (none) Attribute shown in the Obsidian UI nav bar. Separate from attribute.user.
attribute.groups.friendlyName (none) Match the groups attribute on its FriendlyName instead of its Name.
attribute.groups.valuePath (none) Sub-field name when the groups attribute holds structured values.
attribute.groups.stripPrefix (none) Prefix to strip from each group value (e.g. / for Keycloak full-path style).
metadata.ttlHours 24 IdP federation metadata cache TTL in hours. A failed refresh falls back to the cached copy with a warning.
clockSkewSeconds 60 Clock skew tolerance for NotBefore / NotOnOrAfter validation (seconds).
forceAuthn false Sets ForceAuthn="true" on the AuthnRequest, asking the IdP to reauthenticate the user.
authnContextClassRef (none) Requests a specific RequestedAuthnContext. A differing context in the response is logged as a warning, not rejected.
dynamicRole.prefix (none) Prefix for auto-generated folder-role group mappings. Usable on its own. The map is built at startup, so adding a new root job folder requires a restart.
dynamicRole.suffix (none) Optional suffix for auto-generated folder-role group mappings. Requires dynamicRole.prefix.
requireRole true When true, browser SSO fails if the user's group attributes map to no Obsidian roles.
Security notes

Encrypted assertions are not supported

Obsidian requires signed, unencrypted assertions. If your SP metadata carries no signing key material, Obsidian logs a startup warning: IdPs such as AD FS may then choose to encrypt the assertion, which this release cannot process. Configure the SP keystore and register the generated metadata so the IdP sees a signing KeyDescriptor.

Do not disable both signature settings

Setting signRequests and wantAssertionsSigned both to false is accepted but logs a startup warning. In that state assertions are neither signed nor verified, which is not safe for production.

SP-initiated flows and replay

Obsidian issues an AuthnRequest and tracks its ID in the browser session for five minutes. When the IdP's response carries InResponseTo, it must match one of those pending IDs and is consumed on use, so the same response cannot be replayed. There is no persistent store of processed assertion IDs, so keep assertion lifetimes short at the IdP.

Clustered deployments and IdP-initiated logout

An IdP-initiated LogoutRequest can only end the Obsidian session on the node that receives it. Use sticky sessions if you rely on single logout across a cluster.

Keycloak example
com.carfey.suite.security.Authenticator=com.carfey.suite.security.saml.SAMLAuthenticator
com.carfey.suite.security.saml.SAMLAuthenticator.entityId=https://app.example.com/obsidian
com.carfey.suite.security.saml.SAMLAuthenticator.assertionConsumerServiceUrl=https://app.example.com/obsidian/saml/callback
com.carfey.suite.security.saml.SAMLAuthenticator.idpMetadataUrl=https://keycloak.example.com/realms/obsidian/protocol/saml/descriptor
com.carfey.suite.security.saml.SAMLAuthenticator.keystore.path=/opt/obsidian/saml-sp.p12
com.carfey.suite.security.saml.SAMLAuthenticator.keystore.password=changeit
com.carfey.suite.security.saml.SAMLAuthenticator.keystore.alias=obsidian-sp
com.carfey.suite.security.saml.SAMLAuthenticator.attribute.groups=groups
com.carfey.suite.security.saml.SAMLAuthenticator.role.1.group=Obsidian-Admins
com.carfey.suite.security.saml.SAMLAuthenticator.role.1.roleName=Admin
com.carfey.suite.security.saml.SAMLAuthenticator.role.2.group=Obsidian-Write
com.carfey.suite.security.saml.SAMLAuthenticator.role.2.roleName=Write
com.carfey.suite.security.saml.SAMLAuthenticator.role.3.group=Obsidian-Read
com.carfey.suite.security.saml.SAMLAuthenticator.role.3.roleName=LimitedRead
com.carfey.suite.security.saml.SAMLAuthenticator.displayName=Keycloak
com.carfey.suite.security.saml.SAMLAuthenticator.logout.mode=local
com.carfey.suite.security.saml.SAMLAuthenticator.requireRole=true
Provider notes

Microsoft Entra ID: group claims are omitted from SAML assertions once an account belongs to roughly 150 groups. Filter the groups sent to the application, or map app roles instead. Note this threshold differs from the OIDC one described above.

AD FS: the federation metadata document is normally at /FederationMetadata/2007-06/FederationMetadata.xml. Register signing-capable SP metadata so AD FS does not encrypt the assertion, which Obsidian cannot decrypt.

Okta: use the application's SAML metadata URL for idpMetadataUrl. Okta's logout endpoints may be POST-only; if no HTTP-Redirect SingleLogoutService is advertised, logout.mode=slo falls back to local logout.

Auth0: federation metadata is served at samlp/metadata/<client-id>. Group memberships must be added to the assertion with an Auth0 Action or rule.

Keycloak and other generic IdPs: Keycloak publishes a SAML descriptor at /realms/<realm>/protocol/saml/descriptor. Any IdP that publishes SAML 2.0 metadata with an HTTP-POST AssertionConsumerService target and a signing certificate will work.

v1 limitations
  • The REST API is unavailable while SAMLAuthenticator is active — there is no Bearer or JWT equivalent.
  • SP-initiated login only.
  • Encrypted assertions are not supported.
  • No persistent assertion replay store beyond the single-use InResponseTo match and the assertion time window.
  • Dynamic role map (dynamicRole.prefix/suffix) requires a server restart when new root job folders are added.
  • Installer UI supports up to 10 static role pairs; the runtime supports unlimited.

SMTP Mail Properties

# Email configuration for notifications, if desired
#for straight up open relay, just specify the host using
mail.smtp.host=smtp.myopenrelayhost.com
mail.smtp.port=port 
#(standard ports are 25, 465 for SSL, 587 for TLS)

#for using TLS and SSL, provide these as necessary
mail.smtp.socketFactory.port=port
mail.smtp.socketFactory.class=javax.net.ssl.SSLSocketFactory
mail.smtp.auth=true
[email protected]
mail.smtp.password=PASSWORD


# We support JNDI lookups for email sessions. All other email properties can be excluded.
mail.session.jndi.path=java:comp/env/mail/session

Database Properties

# Database configuration
com.carfey.obsidian.db.url=jdbc:mysql://localhost/obsidian
com.carfey.obsidian.db.userId=user
com.carfey.obsidian.db.password=pass

# Sample JDBC URL formats for all platforms
#com.carfey.obsidian.db.url=jdbc:mysql://localhost:3306/obsidian
#com.carfey.obsidian.db.url=jdbc:h2:C:/dev/workspace/obsidian;MVCC=TRUE
#com.carfey.obsidian.db.url=jdbc:oracle:thin:@localhost:1521:obsidian
#com.carfey.obsidian.db.url=jdbc:postgresql://localhost:5432/obsidian
#com.carfey.obsidian.db.url=jdbc:sqlserver://localhost:1433;databaseName=obsidian

# As of Obsidian 6.3.0, we support constructing simple JDBC urls from component properties
# Only supports basic URL formats noted above and does not support H2
#com.carfey.obsidian.db.host=localhost
#com.carfey.obsidian.db.port=3306
#com.carfey.obsidian.db.databaseName=obsidianDB
#com.carfey.obsidian.db.dbType=mariadb/mysql/oracle/postgresql/sqlserver
#com.carfey.obsidian.db.oracleSid=SIDORCL
	

# We support JNDI lookups for database connectivity.
com.carfey.obsidian.db.url=java:comp/env/jdbc/obsidian
com.carfey.obsidian.db.jndiType=mysql
#com.carfey.obsidian.db.jndiType=mysql is also used for MariaDB
#com.carfey.obsidian.db.jndiType=oracle
#com.carfey.obsidian.db.jndiType=postgresql
#com.carfey.obsidian.db.jndiType=h2
#com.carfey.obsidian.db.jndiType=sqlserver

# Table prefix may be used to add a prefix to tables and related database objects. It must be 6 or fewer characters and can contain letters or underscores.
com.carfey.obsidian.db.tablePrefix=OBSDN_

# For Oracle databases, when Obsidian's tables exist in a different schema from the user specified above, or if the user does not default to the schema matching its name, specify the target schema here.
# For details on the required privileges to run with an alternate user, see https://wiki.obsidianscheduler.com/docs/Obsidian_Tables#Oracle_Privileges
# This same configuration item can be used to configure the Postgresql schema. If unspecified, the default is public.
# If using JNDI and Oracle/Postgresql, we recommend you set this value to ensure best performance.
com.carfey.obsidian.db.schema=obsidian

#default max connections per pool if not specified is 50
com.carfey.obsidian.db.maxConnections=40

#default millis timeout to retrieve available connection from pool if not specified is 2000
com.carfey.obsidian.db.connectionTimeout=2000

# You can disable pooling of connections, which is suggested only if using another connection pool through JNDI. When true, maxConnections is ignored.
# When a JNDI data source is selected in the installer, this is set to true by default.
com.carfey.obsidian.db.disablePooling=true

# As of 4.3.0, Oracle database supports configured wait time.
com.carfey.obsidian.db.timedLockWaitEnabled=true (default)
com.carfey.obsidian.db.timedLockWaitSeconds=1 (default, prior to 4.3.0, indefinite wait)

Logging Properties

As of Obsidian 5.0.0

Please see Log4j2 configuration

Before Obsidian 5.0.0

Please see Log4j Configuration


Miscellaneous Properties

# If you wish to change the tokens used to reference global parameters in your job configuration, use the following two values:
global.param.start.token={{
global.param.end.token=}}

# Populated by the installer, these values can be used to initialize licence key information into the database.
com.carfey.obsidian.licence.key=licenceKey
# Name is only required for hardware-linked or site licenses. Use the name exactly as provided by Carfey Software Corporation in your license email.
com.carfey.obsidian.licence.name=licenceeName

# If you have issues with classloading (e.g. in Grails or Spring), this flag enables usage of the context classloader .
com.carfey.jdk.useContextClassLoader=true

# You can set the scheduler host designator name multiple times in the same JVM by using this parameter:
com.carfey.obsidian.schedulerDesignation=obsidian-dev

# Job Forking can be enabled and configured per node
com.carfey.obsidian.jvmJobForkingEnabledOnThisNode=true
# This property is the location of the fork scripts. Obsidian is bundled with obsidianForkedJob.bat and obsidianForkedJob.sh. These are the expected script names.
com.carfey.obsidian.forkedJobScriptLocation=/Obsidian-3.0.0
# Use the following optional property if you need to override the default classpath that is built using the contents of the standalone directory.
# This allows for job forking support in embedded and even webapp deployments. Use the classpath format supported by your operating system.
#com.carfey.obsidian.forkedJobscriptClasspathOverride=
# Use the following optional property if you wish to include database configuration parameters as arguments passed to the forking scripts and the target forked Obsidian class.
# For example, you may need to do this if your configuration is done via System Property overrides or programmmatically in your embedded Obsidian instance.
#com.carfey.obsidian.jvmJobForkingIncludeDbSysParms=true

# As of 4.3.0, description/parameter formatting is supported. Custom formatter (com.carfey.ops.job.config.formatter.Formatter) supported via this parameter.
com.carfey.obsidian.formatterClass=com.carfey.ops.job.config.formatter.MarkdownFormatter (default)

# As of 4.4.0, support for running DDL outside Obsidian and applying only the data portion of upgrades. May require incremental upgrades. Contact support for assistance. Enabled with the following:
com.carfey.obsidian.runner.skipDDL=true

# As of 4.5.0, Slack notifications can be automatically configured for FATAL, ERROR and WARN events by setting this property with a Slack incoming web hook URL. The user name property is optional and defaults to Obsidian Scheduler
com.carfey.obsidian.slack.webhookUrl=https://hooks.slack.com/services/XXXXXXX/YYYYYYYY/ZZZZZZZZZZ
com.carfey.obsidian.slack.userName=Obsidian Scheduler (prod)

# As of 4.6.0, Obsidian supports starting a node in paused state. This can also be set as a System property.
com.carfey.obsidian.schedulerPausedOnStartup=true

# As of 4.10.0, Obsidian supports disabling script engine jobs selectively.
com.carfey.ops.job.script.BeanShellJob.enabled=true
com.carfey.ops.job.script.GroovyJob.enabled=true
com.carfey.ops.job.script.RubyJob.enabled=true
com.carfey.ops.job.script.PythonJob.enabled=true
com.carfey.ops.job.script.JavaScriptJob.enabled=true

# As of 5.0.0, Signal interrupt (supported as of 4.5.1) is disabled by default. Use configuration to enable.
com.carfey.obsidian.signalHandlerActiveForScheduler=true

# As of 5.2.0, you can send Obsidian events to a REST endpoint via an out-of-the-box Event Hook. The basicAuthorization property is optional, the sample showing its use for myusername:mypassword. The "Basic " prefix is added by Obsidian.
com.carfey.obsidian.restfulEventHook.url=https://myendpoint.com:1234/rest/obsidian_events
com.carfey.obsidian.restfulEventHook.basicAuthorization=bXl1c2VybmFtZTpteXBhc3N3b3Jk

# As of 5.2.1, maintenance jobs are automatically scheduled for new installations. Set the following property to disable this behaviour.
com.carfey.obsidian.skipMaintenanceJobInitialization=true

# As of 5.2.1, you can send Obsidian events to standard output and error streams using an out-of-the-box Event Hook. You can enable the default behaviour and auto-register it by adding the following configuration.
com.carfey.obsidian.standardOutputStreamsEventHook.enabled=true

Table Prefixes

As shown in full configuration reference, a table name prefix may be specified to create Obsidian tables with names beginning with a specified string. 

# Table prefix may be used to add a prefix to tables and related database objects. It must be 6 or fewer characters and can contain letters or underscores.
com.carfey.obsidian.db.tablePrefix=OBSDN_

Properties/Yaml File

The above configuration must reside in a properties file named com.carfey.properties or a yaml file named com.carfey.yaml found according to the rules of ClassLoader.getResource. If both yaml and properties files are found, yaml is loaded first and properties values will override. Some possibilities include WEB-INF/classes/com.carfey.(properties/yaml), a com.carfey.(properties/yaml) file in a directory which is explicitly added to the classpath, or at the root of a jar file as is done in obsidian-props.jar for standalone deployments.

Instead of using a classpath resource for properties, you can specify an external properties file using the Java system property carfey.properties.file. All expected properties must be specified in either the default com.carfey.properties file on the classpath or in the override file. Any properties found in both files will use the override file's values. Usage: -Dcarfey.properties.file=/home/obsidian/obsidian.properties.

Instead of using a classpath resource for yaml, you can specify an external yaml file using the Java system property carfey.yaml.file. All expected configuration values must be specified in either the default com.carfey.yaml file on the classpath or in the override file. Any configuration values found in both files will use the override file's values. Usage: -Dcarfey.yaml.file=/home/obsidian/obsidian.yaml.

You may also use a programmatic properties override. Simply call com.carfey.jdk.sys.Configurator.setOverride(Properties props) as early as possible in the application startup. To quote the javadoc of this method, For use as a programmatic properties override. This must be called before any classes are accessed either through invocation or class initialization that may require access to configuration done through properties. Best if done as early as possible in code, perhaps first in an entry point class that does little else and then hands-off to existing entry point.

As of Obsidian 4.4, you may specify configuration values as System Properties or Environment Variables. Duplicated values are resolved as follows:

  1. System Property
  2. Environment Variable - overridden by System Property
  3. Properties - overridden by Environment Variable and System Property

Notifications Configuration

Sending notifications requires SMTP configuration to be defined in the Obsidian properties file. The properties file reference at the beginning of this page includes SMTP configuration details.

In addition to the properties file, you can configure some Notifications settings to tweak how your emails are sent. These values are configurable under the Dispatch category of the scheduler settings screen. Defaults are provided, but you can update them appropriately for your needs.

Notification sender address and DMARC

The notificationFromEmail scheduler setting controls the From address used for notification emails. It is available under:

Scheduler Settings → Dispatch → notificationFromEmail

Set this to an address belonging to your organization and authorized by the SMTP service configured for your Obsidian installation.

Do not use [email protected] when sending through your own SMTP infrastructure. Your SMTP server normally cannot authenticate mail for the obsidianscheduler.com domain. This can cause SPF, DKIM, and DMARC failures and may result in notifications being quarantined or rejected.

Example:

[email protected]

After updating the value, trigger a test notification and confirm successful receipt.

Dependent Libraries

Obsidian requires a number of third-party libraries for the scheduler and the web administration application. Unless noted, libraries in a category are required for that deployment profile. The installer supports selective conflict management and can omit unused optional stacks. License attribution for shipped artifacts is in the product NOTICE.

Overview

Category Required when Notes
Core Always Scheduler and shared runtime
Database drivers Matching database engine Unused drivers may be omitted at install
Mail Email notifications enabled Choose the javax or Jakarta stack
Scripting Matching script job type Groovy is modular (see Scripting table)
Web Admin Web administration UI Includes Markdown rendering (Flexmark)
Authentication (OAuth / OIDC) OAuthAuthenticator active Installer can remove when unused
Authentication (SAML 2.0) SAMLAuthenticator active Installer removes when SAML is not selected
Embedded Tomcat Embedded Tomcat pack selected Present under embed-tomcat-lib/

Core

Component Artifacts Purpose
Obsidian obsidian.jar Core library
Gson gson-2.10.1.jar REST API and web administration JSON
JMustache jmustache-1.15.jar Email templating
Log4j 2 log4j-api-2.26.0.jar, log4j-core-2.26.0.jar Logging (log4j-slf4j2-impl-2.26.0.jar ships with the SAML stack)
SnakeYAML snakeyaml-2.3.jar YAML configuration

Database drivers

Component Artifacts Required when
H2 h2-1.4.200.jar Running against H2
MariaDB / MySQL mariadb-java-client-2.7.2.jar Running against MySQL or MariaDB
SQL Server mssql-jdbc-9.2.1.jre11.jar Running against SQL Server
Oracle ojdbc11-21.1.0.0.jar Running against Oracle
PostgreSQL postgresql-42.2.19.jar Running against PostgreSQL

Mail

Stack Artifacts Use
JavaMail (javax) activation-1.1.jar, javax.mail-1.6.2.jar Classic JavaMail notifications
Jakarta Mail jakarta.activation-api-2.1.2.jar, jakarta.mail-api-2.1.2.jar, optional angus-activation-2.0.1.jar, angus-mail-2.0.2.jar Jakarta EE email notifications

Scripting

Component Artifacts Purpose
BeanShell bsh-2.0b5.jar BeanShellJob only
JRuby jruby-9.2.17.0.jar RubyJob only
Jython jython-standalone-2.7.2.jar PythonJob only
Groovy 4 Modular set (17 JARs) — see list below GroovyJob; all omitted when Groovy is disabled at install

Groovy modular artifacts (13 runtime modules + 4 owned transitives):

groovy-4.0.24.jar, groovy-astbuilder-4.0.24.jar, groovy-datetime-4.0.24.jar, groovy-dateutil-4.0.24.jar, groovy-json-4.0.24.jar, groovy-jsr223-4.0.24.jar, groovy-macro-4.0.24.jar, groovy-macro-library-4.0.24.jar, groovy-nio-4.0.24.jar, groovy-sql-4.0.24.jar, groovy-templates-4.0.24.jar, groovy-typecheckers-4.0.24.jar, groovy-xml-4.0.24.jar, asm-analysis-9.7.1.jar, asm-tree-9.7.1.jar, asm-util-9.7.1.jar, javaparser-core-3.26.2.jar

Web Admin

Component Artifacts Purpose
dom4j dom4j-2.1.3.jar XML utilities
Flexmark Modular set (12 JARs) — see list below Markdown for job and parameter descriptions
JXL jxl-2.6.12.jar Excel utilities (web administration)
OpenCSV opencsv-5.4.jar CSV downloads in the UI

Flexmark modular artifacts:

flexmark-0.62.2.jar, flexmark-util-ast-0.62.2.jar, flexmark-util-builder-0.62.2.jar, flexmark-util-collection-0.62.2.jar, flexmark-util-data-0.62.2.jar, flexmark-util-dependency-0.62.2.jar, flexmark-util-format-0.62.2.jar, flexmark-util-html-0.62.2.jar, flexmark-util-misc-0.62.2.jar, flexmark-util-options-0.62.2.jar, flexmark-util-sequence-0.62.2.jar, flexmark-util-visitor-0.62.2.jar

Authentication (OAuth / OIDC)

Required only when OAuthAuthenticator is active.

Component Artifacts Purpose
Nimbus OAuth / OIDC oauth2-oidc-sdk-11.23.1.jar, nimbus-jose-jwt-10.0.2.jar, content-type-2.3.jar, lang-tag-1.7.jar, json-smart-2.5.2.jar, accessors-smart-2.5.2.jar, jcip-annotations-1.0-1.jar, asm-9.7.1.jar OIDC SSO and JOSE+JWT (ASM is also used by Groovy when scripting is enabled)

Authentication (SAML 2.0)

Required only when SAMLAuthenticator is active. The installer removes this stack when SAML is not the selected authentication type.

Component Artifacts Purpose
OpenSAML 4 Modular set — see list below SAML 2.0 messages, metadata, and signatures
Supporting stack java-support-8.4.2.jar, xmlsec-2.3.4.jar, cryptacular-1.2.5.jar, bcprov-jdk18on-1.85.jar, bcpkix-jdk18on-1.85.jar, bcutil-jdk18on-1.85.jar, velocity-engine-core-2.3.jar, commons-lang3-3.20.0.jar, commons-codec-1.15.jar, httpclient-4.5.14.jar, httpcore-4.4.16.jar, guava-32.1.3-jre.jar, failureaccess-1.0.1.jar, listenablefuture-9999.0-empty-to-avoid-conflict-with-guava.jar, metrics-core-4.2.25.jar, slf4j-api-2.0.12.jar, log4j-slf4j2-impl-2.26.0.jar Crypto, HTTP metadata fetch, Guava, metrics, and SLF4J→log4j2 bridge for OpenSAML diagnostics

OpenSAML modules:

opensaml-core-4.3.2.jar, opensaml-saml-api-4.3.2.jar, opensaml-saml-impl-4.3.2.jar, opensaml-security-api-4.3.2.jar, opensaml-security-impl-4.3.2.jar, opensaml-xmlsec-api-4.3.2.jar, opensaml-xmlsec-impl-4.3.2.jar, opensaml-messaging-api-4.3.2.jar, opensaml-profile-api-4.3.2.jar, opensaml-soap-api-4.3.2.jar, opensaml-soap-impl-4.3.2.jar, opensaml-storage-api-4.3.2.jar

Embedded Tomcat

Present only when an Embedded Tomcat pack is selected (embed-tomcat-lib/).

Component Artifacts Purpose
Apache Tomcat embed tomcat-embed-core-10.1.39.jar, tomcat-embed-el-10.1.39.jar Embedded servlet runtime (Apache License 2.0)

Embedded API classpath

To use the Embedded API, import the resources below (newer compatible versions already on your application classpath may be used). JARs are typically under the standalone directory. The com.carfey.properties / com.carfey.yaml file can be taken from obsidian-properties-configuration.jar / obsidian-yaml-configuration.jar, or from an Obsidian WAR under WEB-INF/classes.

Needed for Artifacts
Always Configuration file (or configuration JAR); obsidian.jar; dom4j-2.1.3.jar; Flexmark modular set (see Web Admin); gson-2.10.1.jar; log4j-api-2.26.0.jar, log4j-core-2.26.0.jar; appropriate JDBC driver
Notifications jmustache-1.15.jar plus the javax or Jakarta mail stack from the Mail table
Scripting jobs BeanShell, JRuby, Jython, and/or Groovy modular set as used by your jobs

Library coordinates in Obsidian 5.x and 6.x

Current coordinates are listed above. The table below records notable library coordinates used in Obsidian 5.x and 6.x before they were replaced. Pre-5.0.0 history is not kept on this page (see page history if needed).

Replaced in Component Artifacts then in use
7.0.0 Log4j log4j-api-2.17.1.jar, log4j-core-2.17.1.jar. Within 5.0.x patch releases before 5.0.3: 2.14.1 (5.0.0), 2.15.0 (5.0.1), 2.16.0 (5.0.2)
7.0.0 Groovy apache-groovy-all-4.0.24.jar (6.x). Before 6.0.0: groovy-all-3.0.7.jar
7.0.0 Flexmark flexmark-0.62.2.jar, flexmark-util-0.62.2.jar (uber util JAR)
7.0.0 OAuth / OIDC, SAML 2.0, Embedded Tomcat Not shipped before 7.0.0
5.4.0 Gson gson-2.8.6.jar
5.2.0 Jakarta Activation jakarta.activation-1.2.1.jar
5.0.0 Mail, scripting, JDBC, and related Baseline 5.0.0 set included javax.mail-1.5.5.jar, dom4j-1.6.1.jar, gson-2.7.jar, bsh-2.0b4.jar, groovy-all-2.4.14.jar, jython-standalone-2.7.0.jar, jruby-complete-9.2.7.0.jar, jmustache-1.12.jar, h2-1.4.192.jar, log4j-1.2.9.jar, mariadb-java-client-1.4.5.jar, jtds-1.3.1.jar, ojdbc7-12.1.0.1.jar, postgresql-9.4.1208.jre7.jar, opencsv-3.8.jar, and (from 4.3.0) Flexmark 0.19.6

Disabling Job Execution & Scheduling in the Web Application

See the instructions within the Getting Started Guide.

Disabling Automatic Database Updates

See the instructions within the Getting Started Guide.

Retrieved from "https://wiki.obsidianscheduler.com/doc/index.php?title=Advanced_Configuration&oldid=4168"