This guide describes how to set up default CloudBeaver preferences through the configuration files.

Packages are mapped as follows in the configuration file:

• core-ui
  (package name) ->
  ui
  (name in config)
• plugin-notifications
  (package name) ->
  notifications
  (name in config)

Here is a structural example:

{

  core: {

    [core package name]: {

      [property name]: [property value]

    },

    ...

  },

  plugin: {

    [plugin package name]: {

      [property name]: [property value]

    },

    ...

  }

}

The following JSON provides an example of how global properties and plugin-specific settings are defined:

{

    // Global properties

    core: {

        authentication: {

            baseAuthProvider: 'local',

            primaryAuthProvider: 'local'

        },

        browser: {

            'cookies.disabled': false

        },

        theming: {

            defaultTheme: 'light'

        },

        localization: {

            defaultLanguage: 'en'

        },

        'navigation-tree': {

            childrenLimit: 500,

            editing: true,

            deleting: true

        }

    },

    plugin: {

        'sql-editor': {

            maxFileSize: 100

        },

        notifications: {

            notificationsPool: 5,

            maxPersistentAllow: 5

        },

        'data-spreadsheet': {

            hidden: false

        },

        'data-viewer': {

            disableEdit: false

        },

        'log-viewer': {

            refreshTimeout: 3000,

            maxLogRecords: 1000,

            logBatchSize: 2000,

            maxFailedRequests: 3

        },

        'data-export': {

            disabled: false

        },

        'erd-viewer': {

            maxColumnsToDisplay: 15000

        }

    }

}

Config below is equivalent to example config for plugins: ‘log-viewer’, ‘data-export’, ‘erd-viewer’

{

  ...

  'plugin.log-viewer.refreshTimeout': 3000,

  'plugin.log-viewer.maxLogRecords': 1000,

  'plugin.log-viewer.logBatchSize': 2000,

  'plugin.log-viewer.maxFailedRequests': 3,

  'plugin.data-export.disabled': false,

  'plugin.erd-viewer.maxColumnsToDisplay': false

}

The configuration files for the application are located in different directories based on their scope and usage. Below are the paths where these files can be found, listed in the order of their priority:

1. workspace/.data/.cloudbeaver.runtime.conf
   – Runtime configuration, highest priority.
2. conf/product.conf
   – Server configuration.
3. webapp/packages/product-default/src/config.json5
   – Web application configuration.

If you want to disable the data export functionality and increase the refresh timeout for the Log Viewer you can modify the settings in the

1. Open the
   .cloudbeaver.runtime.conf
   file
2. Paste the following code:

{

  plugin: {

    'log-viewer': {

      refreshTimeout: 7000

    },

    'data-export': {

      disabled: false

    }

  }

}

Product configuration parameters

Product configuration parameters

Product configuration parameters

Note: This article has been updated and its content is now available in a revised form at a new location. Refer to the CloudBeaver localization article for the most current information.

This document provides guidelines for configuring the password policy in CloudBeaver. Administrators can define rules for user passwords to enhance security and comply with organizational requirements. These settings, applied globally, ensure passwords meet the specified standards during creation and update processes.

For more details on configuration, see the CloudBeaver server configuration.

The Password Policy configuration is located under the

sm: {

    enableBruteForceProtection: "${CLOUDBEAVER_BRUTE_FORCE_PROTECTION_ENABLED:true}",

    expiredAuthAttemptInfoTtl: "${CLOUDBEAVER_EXPIRED_AUTH_ATTEMPT_INFO_TTL:60}",

    maxFailedLogin: "${CLOUDBEAVER_MAX_FAILED_LOGINS:10}",

    minimumLoginTimeout: "${CLOUDBEAVER_MINIMUM_LOGIN_TIMEOUT:1}",

    blockLoginPeriod: "${CLOUDBEAVER_BLOCK_PERIOD:300}",

    passwordPolicy: {

        minLength: "${CLOUDBEAVER_POLICY_MIN_LENGTH:8}",

        requireMixedCase: "${CLOUDBEAVER_POLICY_REQUIRE_MIXED_CASE:true}",

        minNumberCount: "${CLOUDBEAVER_POLICY_MIN_NUMBER_COUNT:1}",

        minSymbolCount: "${CLOUDBEAVER_POLICY_MIN_SYMBOL_COUNT:0}"

    }

}

The configured password policy will be applied during password create and change processes. The CloudBeaver will check the entered passwords against the defined policy, and users will be prompted to update their passwords if they do not meet the specified requirements.

Note: This feature is available in Enterprise, AWS, Team editions only.

Microsoft Entra ID (formerly Azure AD) is a cloud-based identity and access management solution. It secures user authentication, enforces access policies, and enables single sign-on (SSO) for CloudBeaver.

For details, see the Microsoft Entra ID documentation.

Make sure you have:

• An active Azure account with the appropriate permissions.

• Access to the Microsoft Entra admin center.

1. As an administrator, go to Settings -> Server Configuration.

2. Find and activate the Microsoft Entra ID option in the Configuration section.

   

Tip: For more information on Server Configuration, see Server configuration administration

To enable authorization with the Microsoft platform, you need a registered application in Azure. If one doesn’t exist, create and configure it as follows:

1. Register an application
   Create a new enterprise application in Microsoft Entra by following the steps in the official Microsoft documentation.

2. Configure application secrets CloudBeaver uses the OpenID Connect protocol for authorization with Microsoft Entra ID. To enable this, configure application secrets. Detailed instructions are available in the official Microsoft documentation.

   Important: Record the value of the client secret immediately after creating it. It can only be viewed once. If you miss this step, you’ll need to create a new secret.

To enhance functionality, CloudBeaver can read and display the user’s first and last name from the OpenID token. To enable this, add the family_name and given_name fields to the response token.

Follow the steps in the official Microsoft documentation to configure optional claims.

Tip: Adding these fields ensures a more personalized user experience by displaying the full name in the application.

1. As an administrator, navigate to Settings -> Identity Providers.

2. Click on the + Add button.

3. Fill in the following fields:

   

Tip: Ensure you have configured the application with the required permissions in Microsoft Entra to retrieve user information and group details. For additional details, see the Microsoft Entra ID documentation.

4. Click on the Create button.

5. Copy Redirect link:

   1. Enter the newly created identity provider.
   2. Copy the Redirect link.
   3. Add a Redirect link to the application in Microsoft Entra (select Web as platform) – official Microsoft documentation

1. Once the Microsoft Entra ID configuration is complete, navigate to the login screen to test authentication.

2. Select the Federated authentication method, labeled with the Configuration name you specified.

   

3. Verify the integration of Microsoft Entra ID

   1. Once logged in, click on your username in CloudBeaver and navigate to the User Info tab.
   2. Here, you should see tokens. Their presence indicates that the integration of Microsoft Entra ID has been successfully completed, and CloudBeaver has access to the necessary credentials.

   

Note: This feature is available in Enterprise, AWS, Team editions only.

NTLM (NT LAN Manager) Authentication is a protocol used by Microsoft to authenticate users and provide secure network communications. NTLM uses a challenge-response mechanism for authentication, where the user credentials are never sent over the network directly. For detailed setup and configuration of NTLM, refer to the official NTLM documentation.

1. As an administrator, go to Settings -> Server Configuration.

2. Find and activate the NTLM option in the Configuration section.

   

3. Save the changes.

1. As an administrator, navigate to Settings -> Identity Providers.

2. Click on the + Add button.

3. Fill in the following fields:

   

4. Click on the Create button.

1. With the NTLM configuration now established, proceed to the login screen.

2. Select the NTLM authentication method, labeled with the Configuration name you specified.

   

3. Fill in your User name and User password to log in.

Note: This feature is available in Enterprise, AWS, Team editions only.

Okta OpenID Authentication utilizes Okta as an identity provider to authenticate users in applications through OpenID Connect. It simplifies user access control by providing a centralized authentication mechanism, thereby reducing the need for separate account and password management. For detailed setup and configuration instructions for Okta OpenID Connect, refer to the official Okta documentation.

1. As an administrator, go to Settings -> Server Configuration.

2. Find the Okta OpenID option in the Authentication Settings section and activate this setting to enable Okta OpenID authentication.

   

3. Save the changes.

1. As an administrator, navigate to Settings -> Identity Providers.

2. Click on the + Add button.

3. Fill in the following fields:

   

   Field	Description
   Provider	Select Okta OpenID from the dropdown menu.
   ID	Enter a unique identifier for the configuration.
   Configuration name	Enter a descriptive name for this configuration.
   Description	Provide a brief description of this identity provider configuration.
   Icon URL	Enter the URL of an icon to represent this provider.
   Disabled	Leave unchecked to enable this identity provider.
   Client ID	The client identifier provided by the OpenID Connect provider.
   Client Secret	A secret key associated with the client ID for authentication.
   Okta Domain	Organization domain in Okta.
   Read Okta group information	If checked than Active Directory user group information will be claimed. May be required for Okta permissions integration.
   Read user info	Read user profile data, using userinfo endpoint URL.
   Custom scopes	The custom scopes. Use with ; delimiter.
   Name of an AWS role claim	Name of the AWS role claim that contains the name of the AWS role.

4. Click on the Create button.

5. Copy Redirect and Sign out Links:

   1. Enter the newly created identity provider.
   2. Copy the Redirect link and the Sign out link.

   

6. Update Redirect URIs in Okta:

   1. In your Okta application, navigate to General -> Login.
   2. Under Sign-in redirect URIs, paste the copied Redirect link.
   3. In the same section, locate Sign-out redirect URIs and paste the Sign out link there.
   4. Click Save in Okta to finalize these configurations.

   

1. With the Okta OpenID configuration now established, proceed to the login screen.

2. Select the Federated authentication method, labeled with the Configuration name you specified.

   

3. Clicking on this authentication method will redirect you to the Okta page.

4. After filling your username and password of the Okta account, you will be automatically redirected and logged into the CloudBeaver.