Defines how connections to the database are obtained.

JDBC Connection Pool

The name of the database table containing the credential data (and often also user data).

medusa_user, medusa_token

The name of the database column with the username. This column is used to search the credential given the user's name.

username

An SQL query that returns a primary key for the user table given the user name.
Such a query is useful if the username (used on the login page) is not part of the user table.
The query must be such that - given the username - it returns one value that can be used as primary key in the user table. The query must contain one question mark (?) which will be substituted by the username (a string).

If the query returns no records, it results in the user not being found.
If the query returns more than one record, it results in the username being ambiguous.

If this property is not defined, the username itself is used as primary key in the user table (the usual and efficient way).

Note: If this property is defined credential insertion by this plugin is no more possible.

SELECT u.id FROM user u, person p WHERE p.id = u.person_id and p.contractId = ?

The name of the database column with the current credential data's binary credential data. This database field must be able to store the appropriate amount of binary data (depending on the credential). The data type of this column is expected to be BYTE or VARBYTE.
The presence of this property indicates that the credential data is stored in binary form and not in string form. If this property is set, this class returns (and expects) instances of CredentialBean returning false in method "CredentialBean.isCredentialDataStringType()".
You cannot specify both this property and property "col-string-credential-type".

tokenSeed

tanHashes

token_list

The name of the database column with the current credential data's string type credential data. This database field must be able to store the appropriate amount of string data (depending on the credential). The data type of this column is expected to be VARCHAR or CHAR.
The presence of this property indicates that the credential data is stored as string and not in binary form. If this property is set, this class returns (and expects) instances of CredentialBean returning true in method "CredentialBean.isCredentialDataStringType()".
You cannot specify both this property and property "col-binary-credential-type".

mtan_number, cert_subject_cn, oathotp_data, securid_user

The name of the database column with the current credential data's serial number. This database field must be able to store the appropriate amount of string data (depending on the credential). The data type of this column is expected to be VARCHAR or CHAR.

cert_serial, oathotp_serial, securid_serial

The name of the database column indicating the point in time after which the current credential is considered no more active. The type of this column either DATETIME or TIMESTAMP.

active_until

tokenExpiryDate

The name of the database column indicating the point in time prior to which the current credential is considered active yet. The type of this column either DATETIME or TIMESTAMP.

tokenActivationDate

valid_since

The name of the database column with the date and time of the latest credential delivery. This column type is either DATETIME or TIMESTAMP

mtan_del_date, cert_del_date, oathotp_del_date

The name of the database column with the date and time of the latest credential generation or assignment. This column type is either DATETIME or TIMESTAMP

mtan_ass_date, cert_ass_date, oathotp_gen_date

The name of the database column with the next credential data's binary credential data. This database field must be able to store the appropriate amount of binary data (depending on the credential). The data type of this column is expected to be BYTE or VARBYTE.
The presence of this property indicates that the credential data is stored in binary form and not in string form. If this property is set, this class returns (and expects) instances of CredentialBean returning false in method "CredentialBean.isCredentialDataStringType()".
You cannot specify both this property and property "col-string-credential-type".

tokenSeed

tanHashes

token_list

The name of the database column with the next credential data's string type credential data. This database field must be able to store the appropriate amount of string data (depending on the credential). The data type of this column is expected to be VARCHAR or CHAR.
The presence of this property indicates that the credential data is stored as string and not in binary form. If this property is set, this class returns (and expects) instances of CredentialBean returning true in method "CredentialBean.isCredentialDataStringType()".
You cannot specify both this property and property "col-binary-credential-type".

tokenUserInAce

bas64TanHash

The name of the database column with the next credential data's serial number. This database field must be able to store the appropriate amount of string data (depending on the credential). The data type of this column is expected to be VARCHAR or CHAR.

serial

token_serial

The name of the database column indicating the point in time after which the next credential is considered no more active. The type of this column either DATETIME or TIMESTAMP.

active_until

tokenExpiryDate

The name of the database column indicating the point in time prior to which the next credential is considered active yet. The type of this column either DATETIME or TIMESTAMP.

tokenActivationDate

valid_since

The name of the database column with the date and time of the (latest) delivery of the next credential item. This column type is either DATETIME or TIMESTAMP

latest_token_delivery

card_letter_delivery

The name of the database column with the date and time of the latest credential generation or assignment. This column type is either DATETIME or TIMESTAMP

matrix_letter_generation

card_assignment_date

The name of the database column with the flag indicating whether the credential is active or not. This field refers to the 'type' of credential for the user, not to a particular instance. If a current and a next credential data item exist for this credential type, deactivating this field concerns both credential data items. If only one credential data item should be deactivated, the fields not-active-before and not-active-after are required. Inactive credentials may not be used by the callers. This column type is either CHAR or NUMBER. The value "0" (zero) is treated as false, any other value is treated as true.
If the column is not specified, all credentials are considered to be active.

active

tokenActive

Comma-separated list of column names with the delivery dates of other credentials. This information may be used in order to delay the delivery time for credentials so no two credentials of the same user are delivered the same day.

password_delivery

password_delivery,iak_delivery

The name of the database column with the flag indicating whether a new credential should be generated or assigned for the user. This column type is either CHAR or NUMBER. The value "0" is treated as false, any other value is treated as true.

mtan_order_new, cert_order_new, oathotp_order_new

The name of the database column with the user by whom the new credential was ordered to be generated or assigned for the user. This column type is either CHAR or VARCHAR.

mtan_order_user, cert_order_user, oathotp_order_user

The name of the database column with the date of when the new credential was ordered to be generated or assigned for the user. This column type is either DATETIME or TIMESTAMP.

mtan_order_date, cert_order_date, oathotp_order_date

Optional SQL query part that is added to the where clause when searching the credentials by user name.
The SQL query without an additional where clause is "SELECT * FROM credential-table WHERE colusername = 'username'"(real values for "credential-table", "colusername" are taken from the configuration and "username" is taken from the credential object).
The SQL query with an additional where clause "xyz" is: "SELECT * FROM credential-table WHERE colusername = 'username' AND xyz".

Example: If the value of this configuration setting is "GROUP = 'a' AND COD = 1" the resulting query is "SELECT * FROM credential-table WHERE colusername = 'username' AND GROUP = 'a' AND COD = 1"

deleted = 0

group = 'remoteUsers' AND verified = 1

A way to limit the set of valid credential records with an arbitrary SQL query. (See also configuration property "additional-where-clause": it offers a different, slightly more efficient but less powerful way to limit the set of valid credential records).

After the credential has been found by username (and matching the optional additional where clause as specified by configuration property "additional-where-clause") the query specified by this configuration property is executed.
If the result of the query is "true" or "1", the credential record is considered valid. In all other cases, the credential record is not valid, i.e. the behaviour is as if the record did not exist.

The value of this configuration property can be empty (no effect) or any valid SQL query. You can use values of the user record (Record selected from table specified by configuration property "user-table-name" by user name and optionally additional where clause) in the query as follows: ${xxx} references the field (column) "xxx" from the selected user record.

Example:
In our example the selected user record has the following values (column name = value): user_id = 'freddy', person_no = 13, ... Further, there is a different database table "PERSON" which is referenced by the user table. The table "PERSON" has a column of type boolean called "valid" which indicates whether a person record is valid or not.
Consider the following value for this configuration property: SELECT p.valid FROM PERSON p WHERE p.person_no = ${person_no} Thus, when looking for the user record (given the username and the matching the optional additonal where part), the above query is executed where ${person_no} is substituted by the value 13 of field "person_no" of the selected user record.

SELECT p.valid FROM PERSON p WHERE p.person_no = ${person_no}

Same as property "additional-where-clause" except that it is used as where part when iterating over the credentials.

deleted = 0

group = 'remoteUsers' AND verified = 1

This query is used to get all user ids (or all matching user ids) instead of the default generated query defined by the user table, the username column and the context data fields.

Specifying such a query is only necessary if the username cannot be used as primary key in the user table (this only if property "user-name-resolve-query" is specified).

The query must be such that it returns one-column records one username (userid) per row.

Note that his query is used both when returning all user ids and when returning only matching user ids (filtered by the user). Thus, the query must be such that LIKE-clauses against context data columns work. This usually means that you must join the result with the user table (even if the user id is not read from the usertable) so the LIKE-clauses can access the context data of the user table. Failing to do so will result in runtime SQL syntax exceptions!

Note: If this property is specified, additional-iterator-clauses and the deleted flag is ignored. They must be part of the query itself!

SELECT p.id from PERSON p, User u where u.person_id = p.id

A list of context data items that are fetched and returned to the caller together with the credential.

Boolean Context Data Item Date And Time Context Data Item Date Context Data Item Integer Context Data Item Legacy Context Data Item String Context Data Item

This selector allows to read context data from other tables by executing the specified query. The selector of this configuration property specifies the name of the context data variable to be read. The value of this configuration property may be empty (no effect) or any valid SQL query. You can use the values of the user record (Record selected from table specified by property user-table-name by user name) in the query as follows: ${xxx} refers to the field (column) xxx from the selected user record.

Note: These context data values are read only! When fetching credential records, the query will be executed for each credential and the values will be added to the context data container. Modified, new or deleted values will not be written when credential records are updated.

Also note that context data fields defined in configuration property context-data-columns override corresponding entries in this property.

Example:
SELECT p.mobile_no FROM person p WHERE p.person_no = ${person_no}

Additional Context Data

The name of a binary column that marks a record as deleted. A record that has been marked as deleted is no more found by the persister.
Note: If a credential is deleted and this property is defined, the record is marked as deleted and not really removed from the database! If this property is not defined and a credential is deleted, the record is deleted from the database. The type of this column is either CHAR or NUMBER. The value "0" is treated as not deleted, any other value is treated as deleted.

deleted

Name of a database column containing a numerical version id that is automatically incremented by one when a record is changed.
Such a technical column is used by some applications or libraries (such as Hibernate) to implement optimistic locking.

Note that this plugin still uses its own data-based optimistic locking mechanism. It just increments the value within a transaction in order to be compliant with other components' locking mechanisms.

The column must be of an integer type. Usually a long type is used.

rowVersionId

Name of a database column with the date and time this record was modified. The timestamp is written by this plugin at the time the record is modified by this plugin.

The type of the column must be compatible with a timestamp.

Note that - if configured (see separate property) - user information may also be written to the database at the same time.

rowUpdateDate

Name of a database column with the name of the system that modified the record. The name is determined by configuration property "record-modification-user" and is written by this plugin at the time the record is modified by this plugin.

Note that - if configured (see separate property) - the modification date may also be written to the database at the same time.

rowUpdateUser

Specifies a string (typically the name associated with the system using this plugin) that is written to the database fields specified by properties "col-record-insertion-user" and "col-record-modification-user" when this plugin creates or modifies a user record.

AirlockIAM