Advanced Configuration

Obsidian requires some initial configuration parameters for database connection information and desired authentication mechanisms. The installer takes care of configuring these as provided. For your reference should you wish to manually create/edit these, note the details below.

Configuration Details

The following sections show the available properties and sample values that can be used in the com.carfey.properties properties file. While properties format is shown, all the same configuration items apply to yaml support. See Properties/Yaml File for more details on this file.

Authentication Properties

# Comment out the native authenticator setup
#com.carfey.suite.security.Authenticator=com.carfey.suite.security.DBAuthenticator

LDAP Authentication Properties

#Set your LDAP info here
com.carfey.suite.security.Authenticator=com.carfey.suite.security.LdapAuthenticator
# You can specify the attribute type used in building up the distinguished name (dn). If unspecified, defaults to cn
com.carfey.suite.security.LdapAuthenticator.dn.attribute=uid
# As of Obsidian 4.5.0, you can provide a delimited list (delimiter is 3 tildes ~~~) of dn.bases to search.
com.carfey.suite.security.LdapAuthenticator.dn.base=ou=people,o=MyOrgHere
com.carfey.suite.security.LdapAuthenticator.url=ldap://localhost:10389
# You can specify the SECURITY_AUTHENTICATION. Defaults to simple.
com.carfey.suite.security.LdapAuthenticator.securityAuthentication=simple
# Any necessary additional information such as Provider, Principal and Host will need to be handled in your custom class extending LdapAuthenticator.

# You can login via an LDAP attribute that is not part of the dn. A matching entry is found in the LDAP Directory (using anonymous or a fixed lookup account)
# after which the dn attribute above is retrieved to perform the user's authentication. The following 5 attributes are only used for this type of lookup and authentication.
com.carfey.suite.security.LdapAuthenticator.lookupDnAttribute=false
# This is the attribute name that is being searched for in the LDAP directory to build the dn for eventual authentication.
com.carfey.suite.security.LdapAuthenticator.loginAttribute=sAMAccountName
# This determines if these lookups will be done anonymously (without a session authenticated by user/password)
com.carfey.suite.security.LdapAuthenticator.anonymousEnabled=false
# If anonymous lookups are not permitted or desired, provide the dn and password to be used for lookups. Typically, a read-only account with
# read rights to the LDAP entries and attributes in question is sufficient.
com.carfey.suite.security.LdapAuthenticator.searchUserFullDn=cn=ObsidianLDAPReadOnly,ou=people,o=MyOrgHere
com.carfey.suite.security.LdapAuthenticator.searchPassword=password
# As of Obsidian 4.5.1, an alternate search base configuration parameter is used for the searchUser
com.carfey.suite.security.LdapAuthenticator.searchUserDnBase=ou=people,o=MyOrgHere
# As of Obsidian 4.7.1, you may specify one or more additional group membership attributes beyond the defaults
com.carfey.suite.security.LdapAuthenticator.groupMembershipAttribute=businessGroup~~~departmentName

# Configure who may access the web app, based on LDAP group membership
# As of Obsidian 4.5.0, you can provide a delimited list (delimiter is 3 tildes ~~~) of groups to search.
com.carfey.suite.security.LdapAuthenticator.accessDN=cn=SchedulerAccess,ou=groups,o=MyOrgHere

# Configure the Write role used in the admin web app, based on LDAP group membership (by default, users may only read)
# As of Obsidian 4.5.0, you can provide a delimited list (delimiter is 3 tildes ~~~) of groups to search.
com.carfey.suite.security.LdapAuthenticator.role.write.dn=cn=SchedulerWrite,ou=groups,o=MyOrgHere
# No need to alter this
com.carfey.suite.security.LdapAuthenticator.role.write.roleName=Write

# Configure the Admin role used in the admin web app, based on LDAP group membership (users may configure system parameters, etc).
# As of Obsidian 4.5.0, you can provide a delimited list (delimiter is 3 tildes ~~~) of groups to search.
com.carfey.suite.security.LdapAuthenticator.role.admin.dn=cn=SchedulerAdmin,ou=groups,o=MyOrgHere
# No need to alter this
com.carfey.suite.security.LdapAuthenticator.role.admin.roleName=Admin

# Configure the LimitedRead role used in the admin web app, based on LDAP group membership (by default, users may only read)
# As of Obsidian 4.5.0, you can provide a delimited list (delimiter is 3 tildes ~~~) of groups to search.
com.carfey.suite.security.LdapAuthenticator.role.limitedRead.dn=cn=SchedulerLimitedRead,ou=groups,o=MyOrgHere
# No need to alter this
com.carfey.suite.security.LdapAuthenticator.role.limitedRead.roleName=LimitedRead

# Configure the APIrole used by the REST API, based on LDAP group membership
# As of Obsidian 4.5.0, you can provide a delimited list (delimiter is 3 tildes ~~~) of groups to search.
com.carfey.suite.security.LdapAuthenticator.role.api.dn=cn=SchedulerAPI,ou=groups,o=MyOrgHere
# No need to alter this
com.carfey.suite.security.LdapAuthenticator.role.api.roleName=API

OAuth / OIDC Authentication Properties

To use OAuth / OIDC SSO, set the Authenticator property to com.carfey.suite.security.OAuthAuthenticator and add the properties below. All properties are prefixed with com.carfey.suite.security.OAuthAuthenticator. (shown without prefix in the table for brevity).

Required properties

Property	Description
issuer	OIDC Issuer URL. Obsidian fetches <issuer>/.well-known/openid-configuration lazily on first use and caches it.
clientId	Client ID registered at the IdP.
clientSecret	Client secret. Keep out of version control.
redirectUri	Exact callback URL registered at the IdP (e.g. https://app.example.com/oauth/callback).
scopes	Space-separated OAuth scopes (e.g. openid profile email groups). Must include openid.
claim.groups	Name of the token claim that carries group memberships (e.g. groups).
role.<idx>.group	IdP group value for this mapping. <idx> is an arbitrary stable label (numeric or descriptive).
role.<idx>.roleName	Author|Operator)).

Optional properties

Property	Default	Description
displayName	(none)	Label on the SSO button: "Sign in with <displayName>". Defaults to "Sign in with SSO".
logout.mode	local	local: invalidates Obsidian session only. rp: RP-initiated logout via IdP end_session_endpoint.
postLogoutRedirectUri	(none)	Where to redirect after RP-initiated logout. Ignored when logout.mode=local.
claim.user	sub	Claim used as the internal user ID in audit logs. Strongly recommend keeping as sub.
claim.displayName	preferred_username	Claim shown in the Obsidian UI nav bar. Separate from claim.user.
claim.validateTyp	true	When true, rejects Bearer tokens where typ is present but not at+JWT. Set false only for legacy IdPs that omit typ.
clockSkewSeconds	60	Clock skew tolerance for exp/nbf validation (seconds).
metadata.ttlHours	24	OIDC discovery document cache TTL in hours.
expectedAccessTokenAudience	clientId	Expected aud for Bearer access tokens. See security note below.
claim.groupsSource	idtoken	Where to read groups during browser SSO: idtoken, accesstoken, or userinfo.
claim.groupsBearerSource	accesstoken	Where to read groups on the Bearer path: idtoken or accesstoken. userinfo is not permitted on the Bearer path.
claim.groupsValuePath	(none)	Sub-field name when groups is an array of objects (e.g. name).
claim.groupsStripPrefix	(none)	Prefix to strip from each group value (e.g. / for Keycloak full-path style).
claim.groupsUserinfoTimeout	5	HTTP timeout in seconds for the userinfo endpoint. Only used when claim.groupsSource=userinfo.
dynamicRole.prefix	(none)	Prefix for auto-generated folder-role group mappings. Requires dynamicRole.suffix. Map is rebuilt at startup; adding a new root folder requires a restart.
dynamicRole.suffix	(none)	Suffix for auto-generated folder-role group mappings. Requires dynamicRole.prefix.
requireRole	true	When true, browser SSO fails if IdP groups map to no Obsidian roles. Does not apply to REST Bearer tokens.

Security notes

expectedAccessTokenAudience and cross-JWT confusion

When expectedAccessTokenAudience is not set it defaults to clientId. In many OIDC configurations the id_token also carries aud=clientId, which could allow an id_token to be submitted as a Bearer token. The claim.validateTyp=true default mitigates this for compliant IdPs (access tokens carry typ=at+JWT; id_tokens carry typ=JWT).

For maximum defence, set expectedAccessTokenAudience to a distinct resource-server identifier if your IdP supports it.

If claim.validateTyp=false AND expectedAccessTokenAudience is not explicitly set, Obsidian logs a mandatory startup WARN advising you to set expectedAccessTokenAudience.

Keycloak example

com.carfey.suite.security.Authenticator=com.carfey.suite.security.OAuthAuthenticator
com.carfey.suite.security.OAuthAuthenticator.issuer=http://localhost:8081/realms/obsidian
com.carfey.suite.security.OAuthAuthenticator.clientId=obsidian-client
com.carfey.suite.security.OAuthAuthenticator.clientSecret=test-client-secret-local
com.carfey.suite.security.OAuthAuthenticator.redirectUri=http://localhost:8080/oauth/callback
com.carfey.suite.security.OAuthAuthenticator.scopes=openid profile email groups
com.carfey.suite.security.OAuthAuthenticator.claim.groups=groups
com.carfey.suite.security.OAuthAuthenticator.claim.groupsSource=idtoken
com.carfey.suite.security.OAuthAuthenticator.role.1.group=Obsidian-Admins
com.carfey.suite.security.OAuthAuthenticator.role.1.roleName=Admin
com.carfey.suite.security.OAuthAuthenticator.role.2.group=Obsidian-Write
com.carfey.suite.security.OAuthAuthenticator.role.2.roleName=Write
com.carfey.suite.security.OAuthAuthenticator.role.3.group=Obsidian-Read
com.carfey.suite.security.OAuthAuthenticator.role.3.roleName=LimitedRead
com.carfey.suite.security.OAuthAuthenticator.role.4.group=Obsidian-API
com.carfey.suite.security.OAuthAuthenticator.role.4.roleName=API
com.carfey.suite.security.OAuthAuthenticator.displayName=Keycloak
com.carfey.suite.security.OAuthAuthenticator.logout.mode=local
com.carfey.suite.security.OAuthAuthenticator.requireRole=true

Provider notes

Microsoft Entra ID: groups claim contains GUIDs by default; configure Optional Claims for display names. Accounts with 200+ groups trigger overage. Multi-tenant apps not supported in v1.

Auth0: opaque access tokens (Auth0 default) are not supported on the Bearer path. Configure a custom API audience to get JWT access tokens.

Okta: use the Custom Authorization Server URL, not the Org Authorization Server.

v1 limitations

• Opaque access tokens not supported on the REST/Bearer path.
• No jti replay protection.
• Microsoft Entra multi-tenant apps not supported.
• No post-login IdP session validity check.
• Dynamic role map requires restart for new root folders.
• Installer UI supports up to 10 static role pairs; runtime supports unlimited.

SAML Authentication Properties

To use SAML 2.0 SSO, set the Authenticator property to com.carfey.suite.security.saml.SAMLAuthenticator and add the properties below. All properties are prefixed with com.carfey.suite.security.saml.SAMLAuthenticator. (shown without prefix in the table for brevity). Note the .saml. package segment in both values.

Obsidian acts as a SAML Service Provider and supports SP-initiated browser login only. See Authenticator — SAMLAuthenticator for how the login and logout flows behave and for the list of /saml endpoints.

Required properties

Property	Description
entityId	SP entity ID registered at the IdP (e.g. https://app.example.com/obsidian). Obsidian also requires this value to appear in the assertion's AudienceRestriction when the IdP sends one.
assertionConsumerServiceUrl	Exact ACS URL where the IdP posts responses. This must be Obsidian's callback endpoint, e.g. https://app.example.com/obsidian/saml/callback.
idpMetadataUrl or idpMetadataFile	Source of the IdP federation metadata: an HTTP(S) URL, or an absolute path to a local XML file. Set exactly one of the two.
attribute.groups	Name of the assertion attribute carrying group memberships (e.g. groups). Required unless dynamicRole.prefix is set instead.
role.<idx>.group	IdP group value for this mapping. <idx> is an arbitrary stable label (numeric or descriptive). Not needed if all roles come from dynamicRole.
role.<idx>.roleName	Author|Operator)). The API role has no effect on a SAML install, because the REST API is unavailable.

Because signRequests defaults to enabled, a default configuration also requires the three keystore properties below. Disable signRequests only if your IdP does not require signed authentication requests.

Optional properties

Property	Default	Description
displayName	(none)	Label on the SSO button: "Sign in with <displayName>". Defaults to "Sign in with SSO".
signRequests	true	Signs the outbound AuthnRequest and SP LogoutRequest. Requires the three keystore properties.
keystore.path	(none)	Path to the keystore holding the SP signing key. Required when signRequests is enabled.
keystore.password	(none)	Keystore password. Keep out of version control.
keystore.alias	(none)	Alias of the SP signing key within the keystore.
wantAssertionsSigned	true	Requires the IdP to sign assertions, verified against the signing certificate in the IdP metadata.
singleLogoutServiceUrl	(none)	SP single logout URL. When set it is published in Obsidian's SP metadata and is matched against the Destination of an incoming LogoutRequest.
logout.mode	local	local: invalidates the Obsidian session only. slo: SP-initiated single logout via the IdP's HTTP-Redirect SingleLogoutService.
postLogoutRedirectUri	(none)	Where to redirect after the IdP's LogoutResponse. When blank the browser returns to /.
nameIdFormat	urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified	NameIDPolicy format requested from the IdP. A transient format logs a startup warning, because transient NameIDs cannot serve as stable user IDs.
attribute.user	nameId	Assertion attribute used as the internal user ID in audit logs. Strongly recommend keeping as nameId; any other value logs a startup warning.
attribute.displayName	(none)	Attribute shown in the Obsidian UI nav bar. Separate from attribute.user.
attribute.groups.friendlyName	(none)	Match the groups attribute on its FriendlyName instead of its Name.
attribute.groups.valuePath	(none)	Sub-field name when the groups attribute holds structured values.
attribute.groups.stripPrefix	(none)	Prefix to strip from each group value (e.g. / for Keycloak full-path style).
metadata.ttlHours	24	IdP federation metadata cache TTL in hours. A failed refresh falls back to the cached copy with a warning.
clockSkewSeconds	60	Clock skew tolerance for NotBefore / NotOnOrAfter validation (seconds).
forceAuthn	false	Sets ForceAuthn="true" on the AuthnRequest, asking the IdP to reauthenticate the user.
authnContextClassRef	(none)	Requests a specific RequestedAuthnContext. A differing context in the response is logged as a warning, not rejected.
dynamicRole.prefix	(none)	Prefix for auto-generated folder-role group mappings. Usable on its own. The map is built at startup, so adding a new root job folder requires a restart.
dynamicRole.suffix	(none)	Optional suffix for auto-generated folder-role group mappings. Requires dynamicRole.prefix.
requireRole	true	When true, browser SSO fails if the user's group attributes map to no Obsidian roles.

Security notes

Encrypted assertions are not supported

Obsidian requires signed, unencrypted assertions. If your SP metadata carries no signing key material, Obsidian logs a startup warning: IdPs such as AD FS may then choose to encrypt the assertion, which this release cannot process. Configure the SP keystore and register the generated metadata so the IdP sees a signing KeyDescriptor.

Do not disable both signature settings

Setting signRequests and wantAssertionsSigned both to false is accepted but logs a startup warning. In that state assertions are neither signed nor verified, which is not safe for production.

SP-initiated flows and replay

Obsidian issues an AuthnRequest and tracks its ID in the browser session for five minutes. When the IdP's response carries InResponseTo, it must match one of those pending IDs and is consumed on use, so the same response cannot be replayed. There is no persistent store of processed assertion IDs, so keep assertion lifetimes short at the IdP.

Clustered deployments and IdP-initiated logout

An IdP-initiated LogoutRequest can only end the Obsidian session on the node that receives it. Use sticky sessions if you rely on single logout across a cluster.

Keycloak example

com.carfey.suite.security.Authenticator=com.carfey.suite.security.saml.SAMLAuthenticator
com.carfey.suite.security.saml.SAMLAuthenticator.entityId=https://app.example.com/obsidian
com.carfey.suite.security.saml.SAMLAuthenticator.assertionConsumerServiceUrl=https://app.example.com/obsidian/saml/callback
com.carfey.suite.security.saml.SAMLAuthenticator.idpMetadataUrl=https://keycloak.example.com/realms/obsidian/protocol/saml/descriptor
com.carfey.suite.security.saml.SAMLAuthenticator.keystore.path=/opt/obsidian/saml-sp.p12
com.carfey.suite.security.saml.SAMLAuthenticator.keystore.password=changeit
com.carfey.suite.security.saml.SAMLAuthenticator.keystore.alias=obsidian-sp
com.carfey.suite.security.saml.SAMLAuthenticator.attribute.groups=groups
com.carfey.suite.security.saml.SAMLAuthenticator.role.1.group=Obsidian-Admins
com.carfey.suite.security.saml.SAMLAuthenticator.role.1.roleName=Admin
com.carfey.suite.security.saml.SAMLAuthenticator.role.2.group=Obsidian-Write
com.carfey.suite.security.saml.SAMLAuthenticator.role.2.roleName=Write
com.carfey.suite.security.saml.SAMLAuthenticator.role.3.group=Obsidian-Read
com.carfey.suite.security.saml.SAMLAuthenticator.role.3.roleName=LimitedRead
com.carfey.suite.security.saml.SAMLAuthenticator.displayName=Keycloak
com.carfey.suite.security.saml.SAMLAuthenticator.logout.mode=local
com.carfey.suite.security.saml.SAMLAuthenticator.requireRole=true

Provider notes

Microsoft Entra ID: group claims are omitted from SAML assertions once an account belongs to roughly 150 groups. Filter the groups sent to the application, or map app roles instead. Note this threshold differs from the OIDC one described above.

AD FS: the federation metadata document is normally at /FederationMetadata/2007-06/FederationMetadata.xml. Register signing-capable SP metadata so AD FS does not encrypt the assertion, which Obsidian cannot decrypt.

Okta: use the application's SAML metadata URL for idpMetadataUrl. Okta's logout endpoints may be POST-only; if no HTTP-Redirect SingleLogoutService is advertised, logout.mode=slo falls back to local logout.

Auth0: federation metadata is served at samlp/metadata/<client-id>. Group memberships must be added to the assertion with an Auth0 Action or rule.

Keycloak and other generic IdPs: Keycloak publishes a SAML descriptor at /realms/<realm>/protocol/saml/descriptor. Any IdP that publishes SAML 2.0 metadata with an HTTP-POST AssertionConsumerService target and a signing certificate will work.

v1 limitations

• The REST API is unavailable while SAMLAuthenticator is active — there is no Bearer or JWT equivalent.
• SP-initiated login only.
• Encrypted assertions are not supported.
• No persistent assertion replay store beyond the single-use InResponseTo match and the assertion time window.
• Dynamic role map (dynamicRole.prefix/suffix) requires a server restart when new root job folders are added.
• Installer UI supports up to 10 static role pairs; the runtime supports unlimited.

SMTP Mail Properties

# Email configuration for notifications, if desired
#for straight up open relay, just specify the host using
mail.smtp.host=smtp.myopenrelayhost.com
mail.smtp.port=port 
#(standard ports are 25, 465 for SSL, 587 for TLS)

#for using TLS and SSL, provide these as necessary
mail.smtp.socketFactory.port=port
mail.smtp.socketFactory.class=javax.net.ssl.SSLSocketFactory
mail.smtp.auth=true
[email protected]
mail.smtp.password=PASSWORD


# We support JNDI lookups for email sessions. All other email properties can be excluded.
mail.session.jndi.path=java:comp/env/mail/session

Database Properties

# Database configuration
com.carfey.obsidian.db.url=jdbc:mysql://localhost/obsidian
com.carfey.obsidian.db.userId=user
com.carfey.obsidian.db.password=pass

# Sample JDBC URL formats for all platforms
#com.carfey.obsidian.db.url=jdbc:mysql://localhost:3306/obsidian
#com.carfey.obsidian.db.url=jdbc:h2:C:/dev/workspace/obsidian;MVCC=TRUE
#com.carfey.obsidian.db.url=jdbc:oracle:thin:@localhost:1521:obsidian
#com.carfey.obsidian.db.url=jdbc:postgresql://localhost:5432/obsidian
#com.carfey.obsidian.db.url=jdbc:sqlserver://localhost:1433;databaseName=obsidian

# As of Obsidian 6.3.0, we support constructing simple JDBC urls from component properties
# Only supports basic URL formats noted above and does not support H2
#com.carfey.obsidian.db.host=localhost
#com.carfey.obsidian.db.port=3306
#com.carfey.obsidian.db.databaseName=obsidianDB
#com.carfey.obsidian.db.dbType=mariadb/mysql/oracle/postgresql/sqlserver
#com.carfey.obsidian.db.oracleSid=SIDORCL
	

# We support JNDI lookups for database connectivity.
com.carfey.obsidian.db.url=java:comp/env/jdbc/obsidian
com.carfey.obsidian.db.jndiType=mysql
#com.carfey.obsidian.db.jndiType=mysql is also used for MariaDB
#com.carfey.obsidian.db.jndiType=oracle
#com.carfey.obsidian.db.jndiType=postgresql
#com.carfey.obsidian.db.jndiType=h2
#com.carfey.obsidian.db.jndiType=sqlserver

# Table prefix may be used to add a prefix to tables and related database objects. It must be 6 or fewer characters and can contain letters or underscores.
com.carfey.obsidian.db.tablePrefix=OBSDN_

# For Oracle databases, when Obsidian's tables exist in a different schema from the user specified above, or if the user does not default to the schema matching its name, specify the target schema here.
# For details on the required privileges to run with an alternate user, see https://wiki.obsidianscheduler.com/docs/Obsidian_Tables#Oracle_Privileges
# This same configuration item can be used to configure the Postgresql schema. If unspecified, the default is public.
# If using JNDI and Oracle/Postgresql, we recommend you set this value to ensure best performance.
com.carfey.obsidian.db.schema=obsidian

#default max connections per pool if not specified is 50
com.carfey.obsidian.db.maxConnections=40

#default millis timeout to retrieve available connection from pool if not specified is 2000
com.carfey.obsidian.db.connectionTimeout=2000

# You can disable pooling of connections, which is suggested only if using another connection pool through JNDI. When true, maxConnections is ignored.
# When a JNDI data source is selected in the installer, this is set to true by default.
com.carfey.obsidian.db.disablePooling=true

# As of 4.3.0, Oracle database supports configured wait time.
com.carfey.obsidian.db.timedLockWaitEnabled=true (default)
com.carfey.obsidian.db.timedLockWaitSeconds=1 (default, prior to 4.3.0, indefinite wait)

Logging Properties

As of Obsidian 5.0.0

Please see Log4j2 configuration

Before Obsidian 5.0.0

Please see Log4j Configuration

Miscellaneous Properties

# If you wish to change the tokens used to reference global parameters in your job configuration, use the following two values:
global.param.start.token={{
global.param.end.token=}}

# Populated by the installer, these values can be used to initialize licence key information into the database.
com.carfey.obsidian.licence.key=licenceKey
# Name is only required for hardware-linked or site licenses. Use the name exactly as provided by Carfey Software Corporation in your license email.
com.carfey.obsidian.licence.name=licenceeName

# If you have issues with classloading (e.g. in Grails or Spring), this flag enables usage of the context classloader .
com.carfey.jdk.useContextClassLoader=true

# You can set the scheduler host designator name multiple times in the same JVM by using this parameter:
com.carfey.obsidian.schedulerDesignation=obsidian-dev

# Job Forking can be enabled and configured per node
com.carfey.obsidian.jvmJobForkingEnabledOnThisNode=true
# This property is the location of the fork scripts. Obsidian is bundled with obsidianForkedJob.bat and obsidianForkedJob.sh. These are the expected script names.
com.carfey.obsidian.forkedJobScriptLocation=/Obsidian-3.0.0
# Use the following optional property if you need to override the default classpath that is built using the contents of the standalone directory.
# This allows for job forking support in embedded and even webapp deployments. Use the classpath format supported by your operating system.
#com.carfey.obsidian.forkedJobscriptClasspathOverride=
# Use the following optional property if you wish to include database configuration parameters as arguments passed to the forking scripts and the target forked Obsidian class.
# For example, you may need to do this if your configuration is done via System Property overrides or programmmatically in your embedded Obsidian instance.
#com.carfey.obsidian.jvmJobForkingIncludeDbSysParms=true

# As of 4.3.0, description/parameter formatting is supported. Custom formatter (com.carfey.ops.job.config.formatter.Formatter) supported via this parameter.
com.carfey.obsidian.formatterClass=com.carfey.ops.job.config.formatter.MarkdownFormatter (default)

# As of 4.4.0, support for running DDL outside Obsidian and applying only the data portion of upgrades. May require incremental upgrades. Contact support for assistance. Enabled with the following:
com.carfey.obsidian.runner.skipDDL=true

# As of 4.5.0, Slack notifications can be automatically configured for FATAL, ERROR and WARN events by setting this property with a Slack incoming web hook URL. The user name property is optional and defaults to Obsidian Scheduler
com.carfey.obsidian.slack.webhookUrl=https://hooks.slack.com/services/XXXXXXX/YYYYYYYY/ZZZZZZZZZZ
com.carfey.obsidian.slack.userName=Obsidian Scheduler (prod)

# As of 4.6.0, Obsidian supports starting a node in paused state. This can also be set as a System property.
com.carfey.obsidian.schedulerPausedOnStartup=true

# As of 4.10.0, Obsidian supports disabling script engine jobs selectively.
com.carfey.ops.job.script.BeanShellJob.enabled=true
com.carfey.ops.job.script.GroovyJob.enabled=true
com.carfey.ops.job.script.RubyJob.enabled=true
com.carfey.ops.job.script.PythonJob.enabled=true
com.carfey.ops.job.script.JavaScriptJob.enabled=true

# As of 5.0.0, Signal interrupt (supported as of 4.5.1) is disabled by default. Use configuration to enable.
com.carfey.obsidian.signalHandlerActiveForScheduler=true

# As of 5.2.0, you can send Obsidian events to a REST endpoint via an out-of-the-box Event Hook. The basicAuthorization property is optional, the sample showing its use for myusername:mypassword. The "Basic " prefix is added by Obsidian.
com.carfey.obsidian.restfulEventHook.url=https://myendpoint.com:1234/rest/obsidian_events
com.carfey.obsidian.restfulEventHook.basicAuthorization=bXl1c2VybmFtZTpteXBhc3N3b3Jk

# As of 5.2.1, maintenance jobs are automatically scheduled for new installations. Set the following property to disable this behaviour.
com.carfey.obsidian.skipMaintenanceJobInitialization=true

# As of 5.2.1, you can send Obsidian events to standard output and error streams using an out-of-the-box Event Hook. You can enable the default behaviour and auto-register it by adding the following configuration.
com.carfey.obsidian.standardOutputStreamsEventHook.enabled=true

Table Prefixes

As shown in full configuration reference, a table name prefix may be specified to create Obsidian tables with names beginning with a specified string.

# Table prefix may be used to add a prefix to tables and related database objects. It must be 6 or fewer characters and can contain letters or underscores.
com.carfey.obsidian.db.tablePrefix=OBSDN_

Properties/Yaml File

The above configuration must reside in a properties file named com.carfey.properties or a yaml file named com.carfey.yaml found according to the rules of ClassLoader.getResource. If both yaml and properties files are found, yaml is loaded first and properties values will override. Some possibilities include WEB-INF/classes/com.carfey.(properties/yaml), a com.carfey.(properties/yaml) file in a directory which is explicitly added to the classpath, or at the root of a jar file as is done in obsidian-props.jar for standalone deployments.

Instead of using a classpath resource for properties, you can specify an external properties file using the Java system property carfey.properties.file. All expected properties must be specified in either the default com.carfey.properties file on the classpath or in the override file. Any properties found in both files will use the override file's values. Usage: -Dcarfey.properties.file=/home/obsidian/obsidian.properties.

Instead of using a classpath resource for yaml, you can specify an external yaml file using the Java system property carfey.yaml.file. All expected configuration values must be specified in either the default com.carfey.yaml file on the classpath or in the override file. Any configuration values found in both files will use the override file's values. Usage: -Dcarfey.yaml.file=/home/obsidian/obsidian.yaml.

You may also use a programmatic properties override. Simply call com.carfey.jdk.sys.Configurator.setOverride(Properties props) as early as possible in the application startup. To quote the javadoc of this method, For use as a programmatic properties override. This must be called before any classes are accessed either through invocation or class initialization that may require access to configuration done through properties. Best if done as early as possible in code, perhaps first in an entry point class that does little else and then hands-off to existing entry point.

As of Obsidian 4.4, you may specify configuration values as System Properties or Environment Variables. Duplicated values are resolved as follows:

1. System Property
2. Environment Variable - overridden by System Property
3. Properties - overridden by Environment Variable and System Property

Notifications Configuration

Sending notifications requires SMTP configuration to be defined in the Obsidian properties file. The properties file reference at the beginning of this page includes SMTP configuration details.

In addition to the properties file, you can configure some Notifications settings to tweak how your emails are sent. These values are configurable under the Dispatch category of the scheduler settings screen. Defaults are provided, but you can update them appropriately for your needs.

Notification sender address and DMARC

The notificationFromEmail scheduler setting controls the From address used for notification emails. It is available under:

Scheduler Settings → Dispatch → notificationFromEmail

Set this to an address belonging to your organization and authorized by the SMTP service configured for your Obsidian installation.

Do not use [email protected] when sending through your own SMTP infrastructure. Your SMTP server normally cannot authenticate mail for the obsidianscheduler.com domain. This can cause SPF, DKIM, and DMARC failures and may result in notifications being quarantined or rejected.

Example:

[email protected]

After updating the value, trigger a test notification and confirm successful receipt.

Dependent Libraries

Obsidian requires a number of third-party libraries for the scheduler and the web administration application. Unless noted, libraries in a category are required for that deployment profile. The installer supports selective conflict management and can omit unused optional stacks. License attribution for shipped artifacts is in the product NOTICE.

Overview

Category	Required when	Notes
Core	Always	Scheduler and shared runtime
Database drivers	Matching database engine	Unused drivers may be omitted at install
Mail	Email notifications enabled	Choose the javax or Jakarta stack
Scripting	Matching script job type	Groovy is modular (see Scripting table)
Web Admin	Web administration UI	Includes Markdown rendering (Flexmark)
Authentication (OAuth / OIDC)	OAuthAuthenticator active	Installer can remove when unused
Authentication (SAML 2.0)	SAMLAuthenticator active	Installer removes when SAML is not selected
Embedded Tomcat	Embedded Tomcat pack selected	Present under embed-tomcat-lib/

Core

Component	Artifacts	Purpose
Obsidian	obsidian.jar	Core library
Gson	gson-2.10.1.jar	REST API and web administration JSON
JMustache	jmustache-1.15.jar	Email templating
Log4j 2	log4j-api-2.26.0.jar, log4j-core-2.26.0.jar	Logging (log4j-slf4j2-impl-2.26.0.jar ships with the SAML stack)
SnakeYAML	snakeyaml-2.3.jar	YAML configuration

Database drivers

Component	Artifacts	Required when
H2	h2-1.4.200.jar	Running against H2
MariaDB / MySQL	mariadb-java-client-2.7.2.jar	Running against MySQL or MariaDB
SQL Server	mssql-jdbc-9.2.1.jre11.jar	Running against SQL Server
Oracle	ojdbc11-21.1.0.0.jar	Running against Oracle
PostgreSQL	postgresql-42.2.19.jar	Running against PostgreSQL

Mail

Stack	Artifacts	Use
JavaMail (javax)	activation-1.1.jar, javax.mail-1.6.2.jar	Classic JavaMail notifications
Jakarta Mail	jakarta.activation-api-2.1.2.jar, jakarta.mail-api-2.1.2.jar, optional angus-activation-2.0.1.jar, angus-mail-2.0.2.jar	Jakarta EE email notifications

Scripting

Component	Artifacts	Purpose
BeanShell	bsh-2.0b5.jar	BeanShellJob only
JRuby	jruby-9.2.17.0.jar	RubyJob only
Jython	jython-standalone-2.7.2.jar	PythonJob only
Groovy 4	Modular set (17 JARs) — see list below	GroovyJob; all omitted when Groovy is disabled at install

Groovy modular artifacts (13 runtime modules + 4 owned transitives):

groovy-4.0.24.jar, groovy-astbuilder-4.0.24.jar, groovy-datetime-4.0.24.jar, groovy-dateutil-4.0.24.jar, groovy-json-4.0.24.jar, groovy-jsr223-4.0.24.jar, groovy-macro-4.0.24.jar, groovy-macro-library-4.0.24.jar, groovy-nio-4.0.24.jar, groovy-sql-4.0.24.jar, groovy-templates-4.0.24.jar, groovy-typecheckers-4.0.24.jar, groovy-xml-4.0.24.jar, asm-analysis-9.7.1.jar, asm-tree-9.7.1.jar, asm-util-9.7.1.jar, javaparser-core-3.26.2.jar

Web Admin

Component	Artifacts	Purpose
dom4j	dom4j-2.1.3.jar	XML utilities
Flexmark	Modular set (12 JARs) — see list below	Markdown for job and parameter descriptions
JXL	jxl-2.6.12.jar	Excel utilities (web administration)
OpenCSV	opencsv-5.4.jar	CSV downloads in the UI

Flexmark modular artifacts:

flexmark-0.62.2.jar, flexmark-util-ast-0.62.2.jar, flexmark-util-builder-0.62.2.jar, flexmark-util-collection-0.62.2.jar, flexmark-util-data-0.62.2.jar, flexmark-util-dependency-0.62.2.jar, flexmark-util-format-0.62.2.jar, flexmark-util-html-0.62.2.jar, flexmark-util-misc-0.62.2.jar, flexmark-util-options-0.62.2.jar, flexmark-util-sequence-0.62.2.jar, flexmark-util-visitor-0.62.2.jar

Authentication (OAuth / OIDC)

Required only when OAuthAuthenticator is active.

Component	Artifacts	Purpose
Nimbus OAuth / OIDC	oauth2-oidc-sdk-11.23.1.jar, nimbus-jose-jwt-10.0.2.jar, content-type-2.3.jar, lang-tag-1.7.jar, json-smart-2.5.2.jar, accessors-smart-2.5.2.jar, jcip-annotations-1.0-1.jar, asm-9.7.1.jar	OIDC SSO and JOSE+JWT (ASM is also used by Groovy when scripting is enabled)

Authentication (SAML 2.0)

Required only when SAMLAuthenticator is active. The installer removes this stack when SAML is not the selected authentication type.

Component	Artifacts	Purpose
OpenSAML 4	Modular set — see list below	SAML 2.0 messages, metadata, and signatures
Supporting stack	java-support-8.4.2.jar, xmlsec-2.3.4.jar, cryptacular-1.2.5.jar, bcprov-jdk18on-1.85.jar, bcpkix-jdk18on-1.85.jar, bcutil-jdk18on-1.85.jar, velocity-engine-core-2.3.jar, commons-lang3-3.20.0.jar, commons-codec-1.15.jar, httpclient-4.5.14.jar, httpcore-4.4.16.jar, guava-32.1.3-jre.jar, failureaccess-1.0.1.jar, listenablefuture-9999.0-empty-to-avoid-conflict-with-guava.jar, metrics-core-4.2.25.jar, slf4j-api-2.0.12.jar, log4j-slf4j2-impl-2.26.0.jar	Crypto, HTTP metadata fetch, Guava, metrics, and SLF4J→log4j2 bridge for OpenSAML diagnostics

OpenSAML modules:

opensaml-core-4.3.2.jar, opensaml-saml-api-4.3.2.jar, opensaml-saml-impl-4.3.2.jar, opensaml-security-api-4.3.2.jar, opensaml-security-impl-4.3.2.jar, opensaml-xmlsec-api-4.3.2.jar, opensaml-xmlsec-impl-4.3.2.jar, opensaml-messaging-api-4.3.2.jar, opensaml-profile-api-4.3.2.jar, opensaml-soap-api-4.3.2.jar, opensaml-soap-impl-4.3.2.jar, opensaml-storage-api-4.3.2.jar

Embedded Tomcat

Present only when an Embedded Tomcat pack is selected (embed-tomcat-lib/).

Component	Artifacts	Purpose
Apache Tomcat embed	tomcat-embed-core-10.1.39.jar, tomcat-embed-el-10.1.39.jar	Embedded servlet runtime (Apache License 2.0)

Embedded API classpath

To use the Embedded API, import the resources below (newer compatible versions already on your application classpath may be used). JARs are typically under the standalone directory. The com.carfey.properties / com.carfey.yaml file can be taken from obsidian-properties-configuration.jar / obsidian-yaml-configuration.jar, or from an Obsidian WAR under WEB-INF/classes.

Needed for	Artifacts
Always	Configuration file (or configuration JAR); obsidian.jar; dom4j-2.1.3.jar; Flexmark modular set (see Web Admin); gson-2.10.1.jar; log4j-api-2.26.0.jar, log4j-core-2.26.0.jar; appropriate JDBC driver
Notifications	jmustache-1.15.jar plus the javax or Jakarta mail stack from the Mail table
Scripting jobs	BeanShell, JRuby, Jython, and/or Groovy modular set as used by your jobs

Library coordinates in Obsidian 5.x and 6.x

Current coordinates are listed above. The table below records notable library coordinates used in Obsidian 5.x and 6.x before they were replaced. Pre-5.0.0 history is not kept on this page (see page history if needed).

Replaced in	Component	Artifacts then in use
7.0.0	Log4j	log4j-api-2.17.1.jar, log4j-core-2.17.1.jar. Within 5.0.x patch releases before 5.0.3: 2.14.1 (5.0.0), 2.15.0 (5.0.1), 2.16.0 (5.0.2)
7.0.0	Groovy	apache-groovy-all-4.0.24.jar (6.x). Before 6.0.0: groovy-all-3.0.7.jar
7.0.0	Flexmark	flexmark-0.62.2.jar, flexmark-util-0.62.2.jar (uber util JAR)
7.0.0	OAuth / OIDC, SAML 2.0, Embedded Tomcat	Not shipped before 7.0.0
5.4.0	Gson	gson-2.8.6.jar
5.2.0	Jakarta Activation	jakarta.activation-1.2.1.jar
5.0.0	Mail, scripting, JDBC, and related	Baseline 5.0.0 set included javax.mail-1.5.5.jar, dom4j-1.6.1.jar, gson-2.7.jar, bsh-2.0b4.jar, groovy-all-2.4.14.jar, jython-standalone-2.7.0.jar, jruby-complete-9.2.7.0.jar, jmustache-1.12.jar, h2-1.4.192.jar, log4j-1.2.9.jar, mariadb-java-client-1.4.5.jar, jtds-1.3.1.jar, ojdbc7-12.1.0.1.jar, postgresql-9.4.1208.jre7.jar, opencsv-3.8.jar, and (from 4.3.0) Flexmark 0.19.6

Disabling Job Execution & Scheduling in the Web Application

See the instructions within the Getting Started Guide.

Disabling Automatic Database Updates

See the instructions within the Getting Started Guide.