Security

Key	Description	Default
lenses.access.control.allow.methods	HTTP verbs allowed in cross-origin HTTP requests	GET,POST,PUT,DELETE,OPTIONS
lenses.access.control.allow.origin	Allowed hosts for cross-origin HTTP requests	*
lenses.allow.weak.ssl	Allow `https://` with self-signed certificates	false
lenses.ssl.keystore.location	The full path to the keystore file used to enable TLS on Lenses port
lenses.ssl.keystore.password	Password for the keystore file
lenses.ssl.key.password	Password for the ssl certificate used
lenses.ssl.enabled.protocols	Version of TLS protocol to use	`TLSv1.2`
lenses.ssl.algorithm	X509 or PKIX algorithm to use for TLS termination	`SunX509`
lenses.ssl.cipher.suites	Comma separated list of ciphers allowed for TLS negotiation

LDAP settings

LDAP or AD connectivity is optional. All settings are string.

Key	Description	Default
lenses.security.ldap.url	LDAP server URL (TLS, StartTLS and unencrypted supported)
lenses.security.ldap.user	LDAP user account. Must be able to list users and their groups. The distinguished name (DN) must be used
lenses.security.ldap.password	LDAP account password
lenses.security.ldap.base	LDAP base path for querying user accounts. All user accounts that will be able to access Lenses should be under this path
lenses.security.ldap.filter	LDAP query filter for matching users. Lenses will request all entries under the base path that satisfy this filter. The result should be unique	(&(objectClass=person)(sAMAccountName=))
lenses.security.ldap.plugin.class	Full classpath that implements the LDAP query for the user’s groups. You can use the implementation that comes with Lenses if your LDAP setup is supported
lenses.security.ldap.plugin.memberof.key	LDAP user attribute that provides memberOf information. In most implementations the attribute has the same name, so you don’t have to set anything. Used by the default plugin	memberOf
lenses.security.ldap.plugin.group.extract.regex	A regular expression to extract a part of the user’s groups. If this part matches a Lenses group, the user will be granted all the permissions of this group. Lenses checks against the list of memberOf attribute values and uses the first regex group that is returned	(?i)CN=(\w+),ou=Groups.*
lenses.security.ldap.plugin.person.name.key	This key is used by the included LDAP plugin class LdapMemberOfUserGroupPlugin. It expects the LDAP user attribute that provides the full name of the user	sn

And additional configuration setting lenses.security.ldap.use.service.user.search when set to true will use the lenses.security.ldap.user account to read the groups of the current logged user. The default behaviour (false) uses the current logged user to read group memberships.

SSO SAML settings

Key	Description	Default
lenses.security.saml.base.url	Lenses HTTPS URL that matches the Service Provider (SP) and part of the Identity Provider (IdP) SAML handshake i.e. `https://lenses-dev.example.com`
lenses.security.saml.sp.entityid	SAML Service Provider (SP) Entity ID for Lenses, used as part of the SAML handshake protocol.
lenses.security.saml.idp.provider	The Identity Provider (IdP) type: `azure`, `google`, `keycloak`, `okta`, `onelogin`
lenses.security.saml.idp.metadata.file	Path to XML file provided by the Identity Provider. e.g. /path/to/saml-idp.xml
lenses.security.saml.idp.session.lifetime.max	The maximum “duration since login” to accept from IdP. A SAML safety measure that is usually not used. See the duration syntax .	100days
lenses.security.saml.keystore.location	Location for the Java keystore file to be used for SAML crypto i.e. `/path/to/keystore.jks`
lenses.security.saml.keystore.password	Password for accessing the keystore
lenses.security.saml.key.alias	Alias to use for the private key within the keystore (only required when the keystore has multiple keys)
lenses.security.saml.key.password	Password for accessing the private key within the keystore

Kerberos settings

Key	Description	Default
lenses.security.kerberos.service.principal	The Kerberos principal for Lenses to use in the SPNEGO form: `HTTP/lenses.address@REALM.COM`
lenses.security.kerberos.keytab	Path to Kerberos keytab with the service principal. It should not be password protected
lenses.security.kerberos.debug	Enable Java’s JAAS debugging information	`false`