Security Configuration Reference
General
Defines whether Bondy allows the anonymous user.
WARNING
We strongly recommend disabling anonymous for production use or at least restrict the network locations from which an anonymous connection can be established. See Source API documentation reference.
Notice that disabling the anonymous disables the anonymous authentication method as an option for Authentication and Authorization.
Defines whether Bondy creates a new realm when a session wants to attach to a non existing realm.
WARNING
We strongly recommend to disable this option and only enable it for development or testing purposes.
Password options
Options used by those authentication methods based on password.
Defines the default password protocol to be used for new user password creation. Notice the user API allows a caller to define the protocol to be used. This default is used when the caller does not specify a protocol.
Controls whether a password protocol upgrade is performed during password migrations. A password migration occurs when Bondy changes the internal representation of the password object to accommodate new protocols, features or bug fixes. Normally some of this changes can be done without user input, but when these changes include a re-calculation of the salted hash they can only happened during authentication or when the user changes the password.
If this option is set to on, then Bondy will try to upgrade the password protocol of an existing password to the protocol defined by the security.password.protocol option using the default parameters defined in the security.password.{SelectedProtocol}.{Option} options.
Defines the minimum length for newly created passwords. The value should be at least 6 and at most 254.
Defines the maximum length for newly created passwords. The value should be at least 6 and at most 254.
Defines the default key derivation function (KDF) to be used with SCRAM.
Defines the default key derivation function (KDF) to be used with CRA. The only option is pbkdf2.
Defines the default number of iterations to be used with the pbkdf2 key derivation function. It should be an integer in the range 4096..65536.
Defines the default iterations to be used with the argon2id13 key derivation function. It should be an integer in the range 4096..4294967295 or one of the following named alias configuration:
interactive(2)moderate(3)sensitive(4)
Defines the default memory to be used with the argon2id13 key derivation function. It should be an integer in the range 8192..1073741824 or a named alias configuration:
interactive(64MB)moderate(256MB)sensitive(1GB)
Notice
The underlying library allows up to 4398046510080 (3.9 TB) but we have restricted this value to avoid a configuration error to enable a DoS attack.
Authentication: OAuth2
Authentication: Ticket
Defines the a comma separated list of authentication methods that a user can use to establish a session that is allowed to issue tickets to be used with 'ticket' authentication.
The possible values are the names of the authentication methods:
- "cryptosign"
- "password"
- "ticket"
- "tls"
- "trust"
- "wamp-scram"
- "wampcra"
The option also allows a single value "all" in which case all the methods above will be allowed.
Notice
"anonymous" and "oauth2" methods are NOT allowed in this list as they are incompatible with the idea of tickets.
Defines whether Bondy will allow a valid ticket to be used for authentication when a local copy of the ticket has not been found in storage. This might happen if the ticket data has not yet been synchronised to the node handling the authentication request.
The default expiration time on or after which authentication ticket MUST NOT be accepted for processing.
The maximum expiration time on or after which authentication ticket MUST NOT be accepted for processing.
Controls whether local scope tickets are persistent. If enabled the ticket will be stored in Bondy's database. Otherwise the ticket is not stored.
Controls whether SSO scope tickets are persistent. If enabled the ticket will be stored in Bondy's database. Otherwise the ticket is not stored.
Controls whether client-local scope tickets are persistent. If enabled the ticket will be stored in Bondy's database. Otherwise the ticket is not stored.
Controls whether client-SSO scope tickets are persistent. If enabled the ticket will be stored in Bondy's database. Otherwise the ticket is not stored.
Realm Static Configuration
The filename of a security JSON configuration file, which allows you to statically configure realms and its users, groups, sources and permissions.
Bondy Security can be completely configured dynamically via API, read more about this in the Security section.
This options is for those cases when you want to ensure a given configuration is applied every time Bondy restarts.
WARNING
Notice that every node will apply the security configuration on startup persisting it to the embedded replica of the database. Eventually, when joins a cluster this will trigger an actiove-anti entropy exchange, synchronising the data with peer nodes.
This is not a major problem when the configuration file has static data. However, the Realm object will generate signing keys if those are not provided in its definition, which means every new node will create new keys, effectively disabling the previous ones, this might trigger authentication tickets obtain in other nodes to be invalidated.
At the moment the way to avoid this is by either not this option and using dynamic configuration via HTTP or WAMP Admin APIs instead, or by configuring the signing keys in the Realm object, so that Bondy always applies the same keys.