# DDF Reference Guide

Version 2.31.0. Copyright (c) Codice Foundation

## 1. Application Reference

Installation and configuration details by application.

### 1.1. Admin Application Reference

The Admin Application contains components that are integral for the configuration of DDF applications. It contains various services and interfaces that allow administrators control over their systems and enhances administrative capabilities.

#### 1.1.1. Admin Application Prerequisites

None.

#### 1.1.2. Installing the Admin Application

Install the Admin application through the Admin Console.

1. Navigate to the Admin Console.

2. Select the System tab.

3. Select the Features tab.

4. Install the `admin-app` feature.

#### 1.1.3. Configuring the Admin Application

To configure the Admin Application:

1. Navigate to the Admin Console.

2. Select the Admin application.

3. Select the Configuration tab.

Table 1. Admin Available Configurations
Name | Property | Description
--- | --- | ---
Admin UI | org.codice.admin.ui.configuration | Admin UI configurations.
Admin Configuration Policy | org.codice.ddf.admin.config.policy.AdminConfigPolicy | Admin Configuration Policy configurations.

Table 2. Admin UI
Name | Id | Type | Description | Default Value | Required
--- | --- | --- | --- | --- | ---
Enable System Usage message | `systemUsageEnabled` | Boolean | Turns on a system usage message, which is shown when the Admin Application is opened. | false | true
System Usage Message Title | `systemUsageTitle` | String | A title for the system usage message when the application is opened. |  | true
System Usage Message | `systemUsageMessage` | String | A system usage message to be displayed to the user each time the user opens the application. |  | true
Show System Usage Message once per session | `systemUsageOncePerSession` | Boolean | With this selected,the system usage message is shown once for each browser session. Uncheck this to have the usage message appear every time the admin page is opened or refreshed. | true | true
Ignored Installer Applications | `disabledInstallerApps` | String | Comma delimited list (appName, appName2, …​appNameN) of applications that are disabled in the installer. | admin-app,platform-app | null

Table 3. Admin Configuration Policy
Name | Id | Type | Description | Default Value | Required
--- | --- | --- | --- | --- | ---
Feature and App Permissions | `featurePolicies` | String | When enabled, the desired features or apps are only modifiable and viewable to users with the set attributes. The entry should be the format of: `feature name/app name = "user attribute name=user attribute value"` |  | false
Configuration Permissions | `servicePolicies` | String | When enabled, the desired service is only modifiable and viewable to users with the set attributes. The entry should be the format of: `configuration ID = "user attribute name=user attribute value"` | null | false

### 1.2. Catalog Application Reference

The Catalog provides a framework for storing, searching, processing, and transforming information.

Clients typically perform create, read, update, and delete (CRUD) operations against the Catalog.

At the core of the Catalog functionality is the Catalog Framework, which routes all requests and responses through the system, invoking additional processing per the system configuration.

#### 1.2.1. Catalog Application Prerequisites

To use the Catalog Application, the following applications/features must be installed:

- Platform

#### 1.2.2. Installing the Catalog Application

Install the Catalog application through the Admin Console.

1. Navigate to the Admin Console.

2. Select the System tab.

3. Select the Features tab.

4. Install the `catalog-app` feature.

#### 1.2.3. Configuring the Catalog Application

To configure the Catalog Application:

1. Navigate to the Admin Console.

2. Select the Catalog application.

3. Select the Configuration tab.

Table 4. Catalog Available Configurations
Name | Property | Description
--- | --- | ---
Catalog Metacard Ingest Network Plugin | org.codice.ddf.catalog.plugin.metacard.MetacardIngestNetworkPlugin | Catalog Metacard Ingest Network Plugin.
Confluence Federated Source | Confluence_Federated_Source | Confluence Federated Source.
Catalog Federation Strategy | ddf.catalog.federation.impl.CachingFederationStrategy | Catalog Federation Strategy.
CSW Connected Source | Csw_Connected_Source | CSW Connected Source.
Security Audit Plugin | org.codice.ddf.catalog.plugin.security.audit.SecurityAuditPlugin | Security Audit Plugin.
Metacard Attribute Security Policy Plugin | org.codice.ddf.catalog.security.policy.metacard.MetacardAttributeSecurityPolicyPlugin | Metacard Attribute Security Policy Plugin.
Catalog Preview | org.codice.ddf.transformer.preview | Allow Preview to be Extracted From Metadata.
Historian | ddf.catalog.history.Historian | Enables versioning of both metacards and content.
Resource Download Settings | Metacard_S3_Storage_Route | Resource Download Configuration.
Video Thumbnail Plugin | org.codice.ddf.catalog.content.plugin.video.VideoThumbnailPlugin | Video Thumbnail Plugin.
Content Directory Monitor | org.codice.ddf.catalog.content.monitor.ContentDirectoryMonitor | Content Directory Monitor configurations.
Resource Download Settings | ddf.catalog.resource.download.ReliableResourceDownloadManager | Resource Download configurations.
Tika Input Transformer | ddf.catalog.transformer.input.tika.TikaInputTransformer | Tika Input Transformer.
URL Resource Reader | ddf.catalog.resource.impl.URLResourceReader | URL Resource Reader
Catalog OpenSearch Federated Source | OpenSearchSource | Catalog OpenSearch Federated Source.
Xml Query Transformer | ddf.catalog.transformer.xml.XmlResponseQueueTransformer | Xml Response Query Transformer.
Metacard Backup File Storage Provider | Metacard_File_Storage_Route | Enable data backup of metacards using a configurable transformer.
PDF Input Transformer | ddf.catalog.transformer.input.pdf.PdfInputTransformer | PDF Input Transformer configurations.
Metacard Validation Filter Plugin | ddf.catalog.metacard.validation.MetacardValidityFilterPlugin | Metacard Validation Filter Plugin.
Expiration Date Pre-Ingest Plugin | org.codice.ddf.catalog.plugin.expiration.ExpirationDatePlugin | Catalog pre-ingest plugin to set an expiration date on metacards.
Resource URI Policy Plugin | org.codice.ddf.catalog.security.ResourceUriPolicy | Resource URI Policy Plugin.
Status Source Poller Runner | org.codice.ddf.catalog.sourcepoller.StatusSourcePollerRunner | Status Source Poller Runner.
XML Attribute Security Policy Plugin | org.codice.ddf.catalog.security.policy.xml.XmlAttributeSecurityPolicyPlugin | XML Attribute Security Policy Plugin.
Catalog Policy Plugin | org.codice.ddf.catalog.security.CatalogPolicy | Catalog Policy Plugin.
Schematron Validation Services | ddf.services.schematron.SchematronValidationService | Schematron Validation Services configurations.
Content File System Storage Provider | org.codice.ddf.catalog.content.impl.FileSystemStorageProvider | Content File System Storage Provider.
Metacard Validation Marker Plugin | ddf.catalog.metacard.validation.MetacardValidityMarkerPlugin | Metacard Validation Marker Plugin.
Catalog Standard Framework | ddf.catalog.CatalogFrameworkImpl | Catalog Standard Framework configurations.
Catalog Backup Plugin | ddf.catalog.backup.CatalogBackupPlugin | Catalog Backup Plugin configurations.

Table 5. Catalog Metacard Ingest Network Plugin
Name | Id | Type | Description | Default Value | Required | Criteria
--- | --- | --- | --- | --- | --- | ---
criteriaKey | String | Specifies the criteria for the test of equality; which value is tested? IP Address? Hostname? | remoteAddr | true | Expected Value | expectedValue
String | The value that the criteria must equate to for the attribute overrides to occur. |  | true | New Attributes | newAttributes | String"

Table 6. Confluence Federated Source
Name | Property | Type | Description | Default Value | Required
--- | --- | --- | --- | --- | ---
Source Name | `shortname` | String |  |  | Yes
Confluence Rest URL | `endpointUrl` | String | The Confluence Rest API endpoint URL. Example: https://{FQDN}:{PORT}/rest/api/content |  | Yes
Authentication Type | `authenticationType` | String | The Discovery URL where the metadata of the OAuth Provider protecting the source is hosted. Required if OAuth 2.0 authentication type is selected. | saml | true
Username | `username` | String | Username for WFS Service. Required if basic authentication type is selected. | null | false
Password | `password` | Password | Password for WFS Service. Required if basic authentication type is selected. | null | false
Include Page Contents In Results | `includePageContent` | Boolean | Flag indicating if Confluence page contents should be included in the returned results. | false | No
Include Archived Spaces | `includeArchivedSpaces` | Boolean | Flag indicating if archived confluence spaces should be included in search results. | false | No
Exclude Confluence Spaces | `excludeSpaces` | Boolean | Flag indicating if the list of Confluence Spaces should be excluded from searches instead of included. | false | No
Confluence Spaces | `confluenceSpaces` | String cardinality=1000 | The confluence spaces to include/exclude from searches. If no spaces are specified, all visible spaces are searched. |  | No
Attribute Overrides | `additionalAttributes` | String cardinality=100 | Attribute Overrides - Optional: Metacard attribute overrides (Key-Value pairs) that can be set on the results comming from this source. If an attribute is specified here, it overwrites the metacard’s attribute that was created from the Confluence source. The format should be 'key=value'. The maximum allowed size of an attribute override is 65,535 bytes. All attributes in the catalog taxonomy tables are injected into all metacards by default and can be overridden. |  | No
Availability Poll Interval | `availabilityPollInterval` | Long | Availability polling interval in milliseconds. | 60000 | No

Table 7. Catalog Federation Strategy
Name | Id | Type | Description | Default Value | Required
--- | --- | --- | --- | --- | ---
Maximum start index | `maxStartIndex` | Integer | Sets a limit on the number of results this sorted federation strategy can handle from each federated source. A large start index in conjunction with several federated sources could yield a large result set, which the sorted federation strategy has a limited ability to do. The admin can make a rough calculation to decide what maximum start index to use based on the amount of memory in the system, the amount of federated sources, the number of threads, and the expected amount of query results requested ( (average # of threads) * (maximum # of federated sources) * (maxStartIndex + maximumQueryResults) ) must fit into the allocated memory of the running distribution. This field may be deprecated and removed when sorted federation strategy has the ability to sort a larger amount of results. | 50000 | true
Expiration Interval | `expirationIntervalInMinutes` | Long | Interval that Solr Cache checks for expired documents to remove. | 10 | true
Expiration Age | `expirationAgeInMinutes` | Long | The number of minutes a document remains in the cache before it expires . Default is 7 days. | 10080 | true
Query Result Cache Strategy | `cacheStrategy` | String | Strategy for caching query results. Valid entries are ALL, FEDERATED, and NONE. | ALL | true
Cache Remote Ingests | `cacheRemoteIngests` | Boolean | Cache remote ingest results | false | true

Table 8. CSW Connected Source
Name | Id | Type | Description | Default Value | Required
--- | --- | --- | --- | --- | ---
Source ID | `id` | String | The unique name of the Source. | CSW | true
CSW URL | `cswUrl` | String | URL to the endpoint implementing the Catalogue Service for Web (CSW) spec. | null | true
Event Service Address | `eventServiceAddress` | String | DDF Event Service endpoint. Do NOT include .wsdl or ?wsdl. | null | false
Register for Events | `registerForEvents` | Boolean | Check to register for events from this connected source. | false | false
Authentication Type | `authenticationType` | String | Authentication type to use when federating. | saml | true
Username | `username` | String | Username for CSW Service. Required if basic authentication type is selected. | null | false
Password | `password` | String | Password for CSW Service. Required if basic authentication type is selected. | null | false
Disable CN Check | `disableCnCheck` | Boolean | Disable CN check for the server certificate. This should only be used when testing. | false | true
Force Longitude/Latitude coordinate order | `isLonLatOrder` | Boolean | Force Longitude/Latitude coordinate order. | false | true
Use posList in LinearRing | `usePosList` | Boolean | Use a <posList> element rather than a series of <pos> elements when issuing geospatial queries containing a LinearRing. | false | false
Metacard Mappings | `metacardMappings` | String | Mapping of the Metacard Attribute names to their CSW property names. The format should be `'title=dc:title'`. | effective=created, created=dateSubmitted, modified=modified, thumbnail=references, content-type=type, id=identifier, resource-uri=source | false
Poll Interval | `pollInterval` | Integer | Poll Interval to Check if the Source is available (in minutes - minimum 1). | 5 | true
Connection Timeout | `connectionTimeout` | Integer | Amount of time to attempt to establish a connection before timing out, in milliseconds. | 30000 | true
Receive Timeout | `receiveTimeout` | Integer | Amount of time to wait for a response before timing out, in milliseconds. | 60000 | true
Output Schema | `outputSchema` | String | Output Schema | http://www.opengis.net/cat/csw/2.0.2 | true
Query Type Name | `queryTypeName` | String | Qualified Name for the Query Type used in the CSW GetRecords request. | csw:Record | true
Query Type Namespace | `queryTypeNamespace` | String | Namespace prefix for the Query Type used in the CSW GetRecords request. | http://www.opengis.net/cat/csw/2.0.2 | true
Force CQL Text as the Query Language | `isCqlForced` | Boolean | Force CQL Text. | false | true
Forced Spatial Filter Type | `forceSpatialFilter` | String | Force only the selected Spatial Filter Type as the only available Spatial Filter. | NO_FILTER | false

Table 9. Security Audit Plugin
Name | Id | Type | Description | Default Value | Required
--- | --- | --- | --- | --- | ---
Security attributes to audit | `auditAttributes` | String | List of security attributes to audit when modified | security.access-groups,security.access-individuals | true

Table 10. Metacard Attribute Security Policy Plugin
Name | Id | Type | Description | Default Value | Required
--- | --- | --- | --- | --- | ---
Metacard Intersect Attributes: | `intersectMetacardAttributes` | List of rules | Each line item in the configuration is a rule. The format of a rule is the name of a single source attribute, followed by an equals sign, followed by the destination attribute. For example: source_attribute1=destination_attribute. The plugin gathers the source attributes that have a common destination. It takes the combined values of the source attributes and makes them the values of a (new) metacard attribute, the destination attribute. The strategy for combining the values is intersection, which means only the values common to all source attribute are added to the destination attribute. Note: Do not use the same destination attributes in both the Intersect and Union rule sets. The plugin behaves unpredictably. | none | false
Metacard Union Attributes: | `unionMetacardAttributes` | List of rules | Each line item in the configuration is a rule. The format of a rule is the name of a single source attribute, followed by an equals sign, followed by the destination attribute. For example: source_attribute1=destination_attribute. The plugin gathers the source attributes that have a common destination. It takes the combined values of the source attributes and makes them the values of a (new) metacard attribute, the destination attribute. The strategy for combining the values is union, which means only all the values of the source attribute are added to the destination attribute (excluding duplicates) Note: Do not use the same destination attributes in both the Intersect and Union rule sets. The plugin behaves unpredictably. | none | false

Table 11. Catalog Preview
Name | Id | Type | Description | Default Value | Required
--- | --- | --- | --- | --- | ---
Preview From Metadata | `previewFromMetadata` | Boolean | Allow Preview to be Extracted From Metadata. | false | true
Element Names to Preview | `previewElements` | String | Specify element names to preview from XML. Takes the text content of the first available element for preview. Note: This list is not used unless Preview From Metadata is enabled. | text,TEXT | true

Table 12. Historian
Name | Id | Type | Description | Default Value | Required
--- | --- | --- | --- | --- | ---
Enable Versioning | `historyEnabled` | Boolean | Enables versioning of both metacards and content. | true | true

Table 13. Metacard Backup S3 Storage Provider
Name | Id | Type | Description | Default Value | Required
--- | --- | --- | --- | --- | ---
Keep Deleted Metacard | `keepDeletedMetacards` | Boolean | Should backups for deleted metacards be kept or removed. | false | true
Metacard Transformer Id | `metacardTransformerId` | String | ID of the metacard transformer to use to serialize metacard for backup. | metacard | true
Backup Invalid Metacards | `keepDeletedMetacards` | Boolean | Keep backups for metacards that fail validation with warnings or errors. | true | true
Metacard Tags | `backupMetacardTags` | String | Backup only metacards with one of the tags specified. | resource | true
S3 Access Key | `s3AccessKey` | String | The access key to use for S3. Leave blank if on an EC2 host with roles assigned. | "" | true
S3 Secret Key | `s3SecretKey` | Password | The secret key to use for S3. Leave blank if on an EC2 host with roles assigned. |  | true
S3 Bucket | `s3Bucket` | String | The S3 Bucket in which to store the backed up metacard data. |  | true
S3 Endpoint | `s3Endpoint` | String | The endpoint for the region in which the bucket is located. |  | true
Object Template | `objectTemplate` | String | Template specifying the S3 object key for the metacard data. The template uses handlebars syntax. Use [] to reference dotted attributes, as in {{[attribute.name]}}. If you wish to include date, you would use {{dateFormat created yyyy-MM-dd}} | data/backup/metacard/{{substring id 0 3}}/{{substring id 3 6}}/{Metacard_S3_Storage_Route}.xml | true

Table 14. Video Thumbnail Plugin
Name | Property | Type | Description | Default Value | Required
--- | --- | --- | --- | --- | ---
Maximum video file size to process (Megabytes) | `maxFileSizeMB` | Long | Maximum video file size in Megabytes for which to create a thumbnail. Default is 120 Megabytes. Processing large videos may affect system performance. | 120 | false

Table 15. Catalog Content Directory Monitor
Name | Id | Type | Description | Default Value | Required
--- | --- | --- | --- | --- | ---
Directory Path | `monitoredDirectoryPath` | String | "Specifies the directory to be monitored, can be a filesystem path or webdav address (only supported for Monitor in place)" | false | true
Maximum Concurrent Files | `numThreads` | Integer | Specifies the maximum number of concurrent files to be processed within a directory (maximum of 8). If this number exceeds 8, 8 is used in order to preserve system resources. Make sure that your system has enough memory to support the number of concurrent processing threads across all directory monitors. | 1 | true
ReadLock Time Interval | `readLockIntervalMilliseconds` | Integer | Specifies the time to wait (in milliseconds) before acquiring a lock on a file in the monitored directory. This interval is used for sleeping between attempts to acquire the read lock on a file to be ingested. The default value of 100 milliseconds is recommended. | 100 | true
Processing Mechanism | `processingMechanism` | String | Choose what happens to the content item after it is ingested. Delete removes the original file after storing it in the content store. Move stores the item in the content store, and a copy under ./ingested, then removes the original file. (NOTE: this doubles the amount of disk space used.) Monitor in place indexes the file and serves it from its original location. If in place is used, then the URLResourceReader root resource directories configuration must be updated to allow downloading from the monitored directory (See URL Resource Reader). | in_place | false
Attribute Overrides | `attributeOverrides` | String | Optional: Metacard attribute overrides (Key-Value pairs) that can be set on the content monitor. If an attribute is specified here, it overwrites the metacard’s attribute that was created from the content directory. The format should be 'key=value'. The maximum allowed size of an attribute override is 65,535 bytes. All attributes in the catalog taxonomy tables are injected into all metacards by default and can be overridden. | null | false

Table 16. Resource Download Settings
Name | Property | Type | Description | Default Value | Required
--- | --- | --- | --- | --- | ---
Product Cache Directory | `productCacheDirectory` | String | Directory where retrieved products are cached for faster, future retrieval. If a directory path is specified with directories that do not exist, Product Download feature attempts to create those directories. Without configuration, the product cache directory is <DDF_HOME>/data/product-cache. If a relative path is provided it must be relative to the <DDF_HOME>. It is recommended to enter an absolute directory path such as /opt/product-cache in Linux or C:\product-cache in Windows. |  | false
Enable Product Caching | `cacheEnabled` | Boolean | Check to enable caching of retrieved products. | true | false
Delay (in seconds) between product retrieval retry attempts | `delayBetweenRetryAttempts` | Integer | The time to wait (in seconds) between attempting to retry retrieving a product. | 10 | false
Max product retrieval retry attempts | `maxRetryAttempts` | Integer | The maximum number of attempts to retry retrieving a product. | 3 | false
Product Retrieval Monitor Period | `retrievalMonitorPeriod` | Integer | How many seconds to wait and not receive product data before retrying to retrieve a product. | 5 | false
Always Cache Product | `cacheWhenCanceled` | Boolean | Check to enable caching of retrieved products even if client cancels the download. Note: this has no effect if product caching is disabled. | false | false

Table 17. Tika Input Transformer
Name | Id | Type | Description | Default Value | Required
--- | --- | --- | --- | --- | ---
Use Resource Title | `useResourceTitleAsTitle` | Boolean | Use the resource’s metadata to determine the metacard title. If this is not enabled, the metacard title is the file name. | false | true

Table 18. URL Resource Reader
Name | Property | Type | Description | Default Value
--- | --- | --- | --- | ---
Follow Server Redirects | `followRedirects` | Boolean | Check the box if you want the Resource Reader to automatically follow server issued redirects (HTTP Response Code 300 series). | true
Root Resource Directories | `rootResourceDirectories` | String | List of root resource directories. A relative path is relative to <DDF_HOME>. Specifies the only directories the URLResourceReader has access to when attempting to download resources linked using file-based URLs. | data/products

Table 19. Catalog OpenSearch Federated Source
Name | Id | Type | Description | Default Value | Required
--- | --- | --- | --- | --- | ---
Source Name | `shortname` | String | null | DDF-OS | true
OpenSearch service URL | `endpointUrl` | String | The OpenSearch endpoint URL or DDF’s OpenSearch endpoint (https://{FQDN}:{PORT}/services/catalog/query) | ${org.codice.ddf.system.protocol}${org.codice.ddf.system.hostname}:${org.codice.ddf.system.port}${org.codice.ddf.system.rootContext}/catalog/query | true
Authentication Type | `authenticationType` | String | Authentication type to use when federating. | saml | true
Username | `username` | String | Username to use with HTTP Basic Authentication. Required if basic authentication type is selected. |  | false
Password | `password` | Password | Password to use with HTTP Basic Authentication. Required if basic authentication type is selected. |  | false
OAuth Discovery Url | `oauthDiscoveryUrl` | String | The Discovery URL where the metadata of the OAuth Provider protecting the source is hosted. Required if OAuth 2.0 authentication type is selected. | https://localhost:8443/auth/realms/master/.well-known/openid-configuration | false
OAuth Client ID | `oauthClientId` | String | Client ID registered with the OAuth provider. Required if OAuth 2.0 authentication type is selected. | ddf-client | false
OAuth Client Secret | `oauthClientSecret` | String | Client Secret registered with the OAuth provider. Required if OAuth 2.0 authentication type is selected. | secret | false
OAuth Flow | `oauthFlow` | String | The OAuth flow to use when federating. Required if OAuth 2.0 authentication type is selected. | code | false
OpenSearch query parameters | `parameters` | String | Query parameters to use with the OpenSearch connection. | q,src,mr,start,count,mt,dn,lat,lon,radius,bbox,geometry,polygon,dtstart,dtend,dateName,filter,sort | true
Always perform local query | `localQueryOnly` | Boolean | When federating with other DDFs, keep this checked. If checked, this source performs a local query on the remote site (by setting src=local in endpoint URL), as opposed to an enterprise search. | true | true
Convert to BBox | shouldConvertToBBox | Boolean | Converts Polygon and Point-Radius searches to a Bounding Box for compatibility with older interfaces. Generated bounding box is a very rough representation of the input geometry. | true | true
Multi Point-Radius polygon approximation vertices | numMultiPointRadiusVertices | Integer | When performing a multi point-radius search, increase this value for more accurate polygon approximation. Minimum value is 4, maximum value is 32. | 32 | true
Point radius polygon simplification distance tolerance | distanceTolerance | Integer | The maximum distance (in meters) from the original vertices a reduced vertex may lie on a simplified circular polygon. | 1 | true
Disable CN Check | disableCnCheck | Boolean | Disable CN check for the server certificate. This should only be used when testing. | false | true
Connection Timeout | connectionTimeout | Integer | Amount of time to attempt to establish a connection before timing out, in milliseconds. | 30000 | true
Receive Timeout | receiveTimeout | Integer | Amount of time to wait for a response before timing out, in milliseconds. | 60000 | true
Entry XML Element | markUpSet | String | XML Element from the Response Entry to transform into a Metacard. |  | false

Table 20. Xml Query Transformer
Name | Id | Type | Description | Default Value | Required
--- | --- | --- | --- | --- | ---
Parallel Marhsalling Threshold | `threshold` | Integer | Response size threshold above which marshalling is run in parallel | 50 | true

Table 21. Metacard Backup File Storage Provider
Name | Id | Type | Description | Default Value | Required
--- | --- | --- | --- | --- | ---
Keep Deleted Metacard | `keepDeletedMetacards` | Boolean | Should backups for deleted metacards be kept or removed. | false | true
Metacard Transformer Id | `metacardTransformerId` | String | ID of the metacard transformer to use to serialize metacard for backup. | metacard | true
Backup Invalid Metacards | `keepDeletedMetacards` | Boolean | Keep backups for metacards that fail validation with warnings or errors. | true | true
Metacard Backup Output Providers | `metacardOutputProviderIds` | Comma delimited list of metacard output provider IDs. | Metacard Backup Provider IDs to use for this backup plugin. | fileStorageProvider | true

Table 22. PDF Input Transformer
Name | Id | Type | Description | Default Value | Required
--- | --- | --- | --- | --- | ---
Use PDF Title | `usePdfTitleAsTitle` | Boolean | Use the PDF’s metadata to determine the metacard title. If this is not enabled, the metacard title is the file name. | false | true
Maximum text extraction length (bytes) | `previewMaxLength` | Integer | The maximum length of text to be extracted. | 30000 | true
Maximum xml metadata length (bytes) | `metadataMaxLength` | Integer | The maximum length of xml metadata to be extracted. | 5000000 | true

Table 23. Metacard Validation Filter Plugin
Name | Id | Type | Description | Default Value | Required
--- | --- | --- | --- | --- | ---
Attribute map | `attributeMap` | String | Mapping of Metacard SECURITY attribute to user attribute. Users with this role always receive metacards with errors and/or warnings. | invalid-state=localhost-data-manager | false
Filter errors | `filterErrors` | Boolean | Sets whether metacards with validation errors are filtered for users without the configured user attribute. | true | false
Filter warnings | `filterWarnings` | Boolean | Sets whether metacards with validation warnings are filtered for users without the configured user attribute. | false | false

Table 24. Expiration Date Pre-Ingest Plugin
Name | Id | Type | Description | Default Value | Required
--- | --- | --- | --- | --- | ---
Overwrite If Empty | `overwriteIfBlank` | Boolean | If this is checked, overwrite all blank expiration dates in metacards. If this is not checked, leave metacards with blank expiration dates as-is. | false | true
Overwrite If Exists | `overwriteIfExists` | Boolean | If this is checked, overwrite all existing non-empty expiration dates in metacards with a new date. If this is not checked, leave metacards with an existing expiration date. | false | true
Offset from Created Date (in days) | `offsetFromCreatedDate` | Integer | A metacard’s new expiration date is calculated by adding this value (in days) to its created date. | 30 | true

Table 25. Resource URI Policy Plugin
Name | Id | Type | Description | Default Value | Required
--- | --- | --- | --- | --- | ---
Permit Resource URI on Creation | `createPermissions` | String | Allow users to provide a resource URI when creating a metacard | http://schemas.xmlsoap.org/ws/2005/05/identity/claims/role=guest | true
Permit Resource URI on Update | `updatePermissions` | String | Allow users to provide a resource URI when updating a metacard | http://schemas.xmlsoap.org/ws/2005/05/identity/claims/role=guest | true

Table 26. Status Source Poller Runner
Name | Id | Type | Description | Default Value | Required
--- | --- | --- | --- | --- | ---
Poll Interval (minutes) | `pollIntervalMinutes` | Integer | The interval (in minutes) at which to recheck the availability of all sources. Must be at least 1 minute.
Warning | There is a maximum delay of 2*`pollIntervalMinutes` for the Source Poller to be updated after the availability of a source changes or a source is created/modified/deleted. Currently the Standard Catalog Framework and the Catalog REST Endpoint use the Source Poller to get source availabilities. The `pollIntervalMinutes` should not be set to value a which results in an unacceptable maximum delay.
| 1 | true

Table 27. XML Attribute Security Policy Plugin
Name | Id | Type | Description | Default Value | Required
--- | --- | --- | --- | --- | ---
XML Elements: | `xmlElements` | String | XML elements within the metadata that are searched for security attributes. If these elements contain matching attributes, the values of the attributes are combined. |  | true
Security Attributes (union): | `securityAttributeUnions` | String | Security Attributes. These attributes, if they exist on any of the XML elements listed above, have their values extracted and the union of all of the values is saved to the metacard. For example: if element1 and element2 both contain the attribute 'attr' and that attribute has values X,Y and X,Z, respectively, then the final result is the union of those values: X,Y,Z. The X,Y,Z value is the value that is placed within the security attribute on the metacard. |  | false
Security Attributes (intersection): | `securityAttributeIntersections` | String | Security Attributes. These attributes, if they exist on any of the XML elements listed above, have their values extracted and the intersection of all of the values is saved to the metacard. For example: if element1 and element2 both contain the attribute 'attr' and that attribute has values X,Y and X,Z, respectively, then the final result is the intersection of those values: X. The X value is the value that is placed within the security attribute on the metacard. | null | false

Table 28. Catalog Policy Plugin
Name | Id | Type | Description | Default Value | Required
--- | --- | --- | --- | --- | ---
Create Required Attributes | `createPermissions` | String | Roles/attributes required for the create operations. Example: role=role1,role2 | http://schemas.xmlsoap.org/ws/2005/05/identity/claims/role=guest | true
Update Required Attributes | `updatePermissions` | String | Roles/attributes required for the update operation. Example: role=role1,role2 | http://schemas.xmlsoap.org/ws/2005/05/identity/claims/role=guest | true
Delete Required Attributes | `deletePermissions` | String | Roles/attributes required for the delete operation. Example: role=role1,role2 | http://schemas.xmlsoap.org/ws/2005/05/identity/claims/role=guest | true
Read Required Attributes | `readPermissions` | String | Roles/attributes required for the read operations (query and resource). Example: role=role1,role2 | http://schemas.xmlsoap.org/ws/2005/05/identity/claims/role=guest | true

Table 29. Schematron Validation Services
Name | Id | Type | Description | Default Value | Required
--- | --- | --- | --- | --- | ---
Ruleset Name | `id` | String | Give this ruleset a name | null | true
Root Namespace | `namespace` | String | The root namespace of the XML | null | true
Schematron File Names | `schematronFileNames` | String | Names of schematron files (*.sch) against which to validate metadata ingested into the Catalog. Absolute paths or relative paths may be specified. Relative paths are assumed to be relative to `<DDF_HOME>/schematron`. | null | true

Table 30. Content File System Storage Provider
Name | Id | Type | Description | Default Value | Required
--- | --- | --- | --- | --- | ---
Content Repository File Path | `baseContentDirectory` | String | Specifies the directory to use for the content repository. A shutdown of the server is necessary for this property to take effect. If a filepath is provided with directories that don’t exist, File System Provider attempts to create them. | <DDF_HOME>/data/content/store | true

Table 31. Metacard Validation Marker Plugin
Name | Id | Type | Description | Default Value | Required
--- | --- | --- | --- | --- | ---
Enforced Validators | `enforcedMetacardValidators` | String | ID of Metacard Validator to enforce. Metacards that fail these validators are NOT ingested. | false | Enforce errors
enforceErrors | `Boolean` | Sets whether validation errors are enforced. This prevents ingest if errors are present. | true | true | Enforce warnings

Table 32. Catalog Standard Framework
Name | Id | Type | Description | Default Value | Required
--- | --- | --- | --- | --- | ---
Enable Fanout Proxy | `fanoutEnabled` | Boolean | When enabled the Framework acts as a proxy, federating requests to all available sources. All requests are executed as federated queries and resource retrievals, allowing the framework to be the sole component exposing the functionality of all of its Federated Sources. | false | true
Enable Notifications | `notificationEnabled` | Boolean | Check to enable notifications. | true | false
Fanout tag blacklist | `fanoutTagBlacklist` | String | Ingest operations with tags in this list are rejected. |  | true

Table 33. Catalog Backup Plugin
Name | Id | Type | Description | Default Value | Required
--- | --- | --- | --- | --- | ---
Root backup directory path | `rootBackupDir` | String | Root backup directory for Metacards. A relative path is relative to <DDF_HOME>. | data/backup | true
Subdirectory levels | `subDirLevels` | Integer | Number of subdirectory levels to create. Two characters from the ID are used to name each subdirectory level. | 2 | true

### 1.3. Platform Application Reference

The Platform application is considered to be a core application of the distribution. The Platform application provides the fundamental building blocks that the distribution needs to run. These building blocks include subsets of:

- Karaf

- CXF

- Camel

A Command Scheduler is also included as part of the Platform application to allow users to schedule Command Line Shell Commands.

#### 1.3.1. Platform Application Prerequisites

None.

#### 1.3.2. Installing Platform

Install the Platform application through the Admin Console.

1. Navigate to the Admin Console.

2. Select the System tab.

3. Select the Features tab.

4. Install the `platform-app` feature.

#### 1.3.3. Configuring the Platform Application

To configure the Platform Application:

1. Navigate to the Admin Console.

2. Select the Platform application.

3. Select the Configuration tab.

Table 34. Platform Available Configurations
Name | Property | Description
--- | --- | ---
Landing Page | org.codice.ddf.distribution.landingpage.properties | Starting page for users to interact with DDF.
Email Service | org.codice.ddf.platform.email.impl.SmtpClientImpl | Email Service configurations.
Platform Command Scheduler | ddf.platform.scheduler.Command | Platform Command Scheduler.
HTTP Response Security | org.codice.ddf.security.response.filter.ResponseHeaderConfig | HTTP Response Security response configurations.
Logging Service | org.codice.ddf.platform.logging.LoggingService | Logging Service configurations.
MIME Custom Types | DDF_Custom_Mime_Type_Resolver | DDF Custom Mime Types.
Platform UI | ddf.platform.ui.config | Platform UI configurations.

Table 35. Landing Page
Name | Id | Type | Description | Default Value | Required
--- | --- | --- | --- | --- | ---
Description | `description` | String | Specifies the description to display on the landing page. | As a common data layer, DDF provides secure enterprise-wide data access for both users and systems. | true
Phone Number | `phone` | String | Specifies the phone number to display on the landing page. |  | true
Email Address | `email` | String | Specifies the email address to display on the landing page. |  | true
External Web Site | `externalUrl` | String | Specifies the external web site URL to display on the landing page. |  | true
Announcements | `announcements` | String | Announcements to display on the landing page. | null | true
Branding Background | `background` | String | Specifies the landing page background color. Use html css colors or #rrggbb. |  | true
Branding Foreground | `foreground` | String | Specifies the landing page foreground color. Use html css colors or #rrggbb. |  | true
Branding Logo | `logo` | String | Specifies the landing page logo. Use a base64 encoded image. |  | true
Additional Links | `links` | String | Additional links to be displayed on the landing page. Use the format <text>,<link> (such as `example,http://www.example.com`). Empty entries are ignored. |  | yes

Table 36. Email Service
Name | Property | Type | Description | Default Value | Required
--- | --- | --- | --- | --- | ---
Host | `hostName` | String | Mail server hostname (must be resolvable by DNS) or IP address. |  | Yes
Port | `portNumber` | Integer | Mail server port number. | 25 | Yes
User Name | `userName` | String | Mail server user name used only for authenticated connections over TLS. |  | No
Password | `password` | Password | Mail server password used only for authenticated connections over TLS. |  | No

Table 37. Platform Command Scheduler
Name | Property | Type | Description | Default Value | Required
--- | --- | --- | --- | --- | ---
Command | `command` | String | Shell command to be used within the container. For example, log:set DEBUG"> |  | true
Interval | `intervalString` | String | The Interval String for each execution. Based on the Interval Type, this can be either a Cron String or a Second Interval. (e.x. '0 0 0 1/1 * ? *' or '12') |  | true
Interval Type | `intervalType` | String | Interval Type | cronString | true

Table 38. HTTP Response Security
Name | Id | Type | Description | Default Value | Required
--- | --- | --- | --- | --- | ---
Content Security Policy | `xContentSecurityPolicy` | String | Instructions for the client browser detailing which location and/or which type of resources may be loaded. |  | true
X-Frame-Options | `xFrameOptions` | String | The X-Frame-Options HTTP response header can be used to indicate whether or not a browser may render a page in a frame, iframe or object. |  | true
X-XSS-Protection | `xXssProtection` | String | The HTTP X-XSS-Protection response header is a feature that stops pages from loading when they detect reflected cross-site scripting (XSS) attacks. |  | true

Table 39. Logging Service
Name | Id | Type | Description | Default Value | Required
--- | --- | --- | --- | --- | ---
Max Log Events | `maxLogEvents` | Integer | The maximum number of log events stored for display in the Admin Console. This must be greater than 0 and must not exceed 5000. | 500 | true

Table 40. MIME Custom Types
Name | Id | Type | Description | Default Value | Required
--- | --- | --- | --- | --- | ---
Resolver Name | `name` | String | null | DDF Custom Resolver | false
Priority | `priority` | Integer | null | 10 | true
File Extensions to Mime Types | `customMimeTypes` | String | List of key/value pairs where key is the file extension and value is the mime type, for example, `nitf=image/nitf` | null | true

Table 41. Platform UI Configuration
Name | Id | Type | Description | Default Value | Required
--- | --- | --- | --- | --- | ---
Enable System Usage Message | `systemUsageEnabled` | Boolean | Turns on a system usage message, which is shown when the Search Application is opened. | false | true
System Usage Message Title | `systemUsageTitle` | String | A title for the system usage Message when the application is opened. |  | false
System Usage Message | `systemUsageMessage` | String | A system usage message to be displayed to the user each time the user opens the application. |  | false
Show System Usage Message once per session | `systemUsageOncePerSession` | Boolean | With this selected, the system usage message is shown once for each browser session. Uncheck this to have the usage message appear every time the search window is opened or refreshed. | true | true
Header | `header` | String | Specifies the header text to be rendered on all pages. |  | false
Footer | `footer` | String | Specifies the footer text to be rendered on all pages. |  | false
Text Color | `color` | String | Specifies the Text Color of the Header and Footer. Use html css colors or `#rrggbb`. |  | false
Background Color | `background` | String | Specifies the Background Color of the Header and Footer. Use html css colors or `#rrggbb`. |  | false
Session Timeout | `timeout` | Integer | Specifies the length of inactivity (in minutes) that causes a user to be logged out automatically. This value must be 2 minutes or greater, as users are warned when only 1 minute remains. If a value of less than 2 minutes is used, the timeout is set to the default time of 15 minutes. | 15 | true

### 1.4. Security Application Reference

The Security application provides authentication, authorization, and auditing services for the DDF. These services comprise both a framework that developers and integrators can extend as well as a reference implementation that meets security requirements.

This section documents the installation, maintenance, and support of this application.

Features Included in Security

- Security Core

- Security Encryption

- Security PEP

- Security PDP

#### 1.4.1. Security Prerequisites

To use the Security application, the following applications/features must be installed:

- Platform

#### 1.4.2. Installing Security

Install the Security application through the Admin Console.

1. Navigate to the Admin Console.

2. Select the System tab.

3. Select the Features tab.

4. Install the `security-app` feature.

#### 1.4.3. Configuring the Security Application

To configure the Security Application:

1. Navigate to the Admin Console.

2. Select the Security application.

3. Select the Configuration tab.

Table 42. Security Available Configurations
Name | Property | Description
--- | --- | ---
Security STS LDAP and Roles Claims Handler | Claims_Handler_Manager | STS Ldap and Roles Claims Handler Configuration.
OIDC Handler | org.codice.ddf.security.handler.oidc.OidcHandler | OIDC Handler configurations.
IdP Client | org.codice.ddf.security.idp.client.IdpMetadata | IdP Client configurations.
Session | org.codice.ddf.security.filter.login.Session | Session configurations.
Guest Claims Configuration | ddf.security.guest.realm | Guest Claims configurations.
Security STS PKI Token Validator | org.codice.ddf.security.validator.pki | STS PKI Token Validator configurations.
File Based Claims Handler | org.codice.ddf.security.sts.claims.property.PropertyFileClaimsHandler | File Based Claims Handler.
Logout Page | org.codice.ddf.security.idp.client.LogoutRequestService | Logout Page configurations.
Security SOAP Guest Interceptor | org.codice.ddf.security.interceptor.GuestInterceptor | Security SOAP Guest Interceptor.
SAML NameID Policy | ddf.security.service.SecurityManager | SAML NameID Policy.
Security AuthZ Realm | ddf.security.pdp.realm.AuthzRealm | AuthZ Security configurations.
Security STS Client | ddf.security.sts.client.configuration | STS Client configurations.
Web Context Policy Manager | org.codice.ddf.security.policy.context.impl.PolicyManager | Web Context Security Policies.
SAML Handler | org.codice.ddf.security.idp.client.IdpHandler | IdP Handler configurations.
Security STS Server | ddf.security.sts | STS configurations.

Table 43. Security STS LDAP and Roles Claims Handler
Name | Property | Type | Description | Default Value | Required
--- | --- | --- | --- | --- | ---
LDAP URL | `url` | String | true | `ldaps://${org.codice.ddf.system.hostname}:1636` | LDAP or LDAPS server and port
StartTLS | `startTls` | Boolean | Determines whether or not to use StartTLS when connecting via the ldap protocol. This setting is ignored if the URL uses ldaps. | `false` | true
LDAP Bind User DN | `ldapBindUserDn` | String | DN of the user to bind with LDAP. This user should have the ability to verify passwords and read attributes for any user. | `cn=admin` | true
LDAP Bind User Password | `password` | Password | Password used to bind user with LDAP. | `secret` | true
LDAP Group User Membership Attribute | `membershipUserAttribute` | String | Attribute used as the membership attribute for the user in the group. Usually this is uid, cn, or something similar. | `uid` | true
LDAP User Login Attribute | `loginUserAttribute` | String | Attribute used as the login username. Usually this is uid, cn, or something similar. | `uid` | true
LDAP Base User DN | `userBaseDn` | String | Full LDAP path to where users can be found. | `ou=users\,dc=example\,dc=com` | true
Override User Certificate DN | `overrideCertDn` | Boolean | When checked, this setting ignores the DN of a user and instead uses the LDAP Base User DN value. | `false` | true
LDAP Group ObjectClass | `objectClass` | String | ObjectClass that defines structure for group membership in LDAP. Usually this is groupOfNames or groupOfUniqueNames. | `groupOfNames` | true
LDAP Membership Attribute | `memberNameAttribute` | String | Attribute used to designate the user’s name as a member of the group in LDAP. Usually this is member or uniqueMember. | `member` | true
LDAP Base Group DN | `groupBaseDn` | String | Full LDAP path to where groups can be found. | `ou=groups\,dc=example\,dc=com` | true
Attribute Map File | `propertyFileLocation` | String | Location of the file which contains user attribute maps to use. | `<INSTALL_HOME>/etc/ws-security/attributeMap.properties` | true

Table 44. OIDC Handler
Name | Id | Type | Description | Default Value
--- | --- | --- | --- | ---
IdP Type | `idpType` | String | IdP type to use. | Keycloak
Client ID | `clientId` | String | Unique ID for the client, this may be provided by the Identity Provider. | ddf-client
Realm/Tenant | `realm` | String | Realm to use for a multi-tenant environment. This is required for Keycloak or Azure. | master
Secret | `secret` | String | This value must match the value set on the Identity Provider. | secret
Discovery URI | `discoveryUri` | String | Discovery URI for fetching OP metadata (http://openid.net/specs/openid-connect-discovery-1_0.html). | http://localhost:8080/auth/realms/master/.well-known/openid-configuration
Base URI | `baseUri` | String | Base URI for IdP. Do not fill out both this and the Discovery URI. Only one is needed depending on the IdP in use. | http://localhost:8080/auth
Logout URI | `logoutUri` | String | URI directing to single logout service of the IdP in use. | http://localhost:8080/auth/realms/master/protocol/openid-connect/logout
Scope | `scope` | String | OIDC scopes. | openid profile email resource.read
Use Nonce | `useNonce` | Boolean | Whether or not to use nonce in JWT. | true
Response Type | `responseType` | String | Response type to use. | code
Mode | `responseMode` | String | Mode. Leave blank if you are unsure of the value to use. | form_post

Table 45. IdP Client
Name | Id | Type | Description | Default Value
--- | --- | --- | --- | ---
IdP Metadata | `metadata` | String | Refer to metadata by HTTPS URL (https://), file URL (file:), or an XML block(<md:EntityDescriptor>…​</md:EntityDescriptor>). | https://${org.codice.ddf.system.hostname}:${org.codice.ddf.system.httpsPort}/services/idp/login/metadata
Perform User-Agent Check | `userAgentCheck` | Boolean | If selected, this allows clients that do not support ECP and are not browsers to fall back to PKI, BASIC, and potentially GUEST authentication, if enabled. | true

Table 46. Session
Name | Id | Type | Description | Default Value | Required
--- | --- | --- | --- | --- | ---
Session Timeout (in minutes) | `expirationTime` | Integer | Specifies the length of inactivity (in minutes) between client requests before the servlet container invalidates the session (this applies to all client sessions). This value must be 2 minutes or greater, as users are warned when only 1 minute remains. If a value of less than 2 minutes is used, the timeout is set to the default time of 31 minutes. See also Platform UI Config. | 31 | true

Table 47. Guest Claims Configuration
Name | Id | Type | Description | Default Value | Required
--- | --- | --- | --- | --- | ---
Attributes | `attributes` | String | The attributes to be returned for any Guest user. | http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier=guest,http://schemas.xmlsoap.org/ws/2005/05/identity/claims/role=guest | true

Table 48. Security STS PKI Token Validator
Name | Id | Type | Description | Default Value | Required
--- | --- | --- | --- | --- | ---
Realms | `realms` | String | The realms to be validated by this validator. | karaf | true
Do Full Path Validation | `pathValidation` | Boolean | Validate the full certificate path. Uncheck to only validate the subject cert. (RFC5280 6.1) | true | true

Table 49. File Based Claims Handler
Name | Id | Type | Description | Default Value | Required
--- | --- | --- | --- | --- | ---
Role Claim Type | `roleClaimType` | String | Role claim URI. | http://schemas.xmlsoap.org/ws/2005/05/identity/claims/role | true
ID Claim Type | `idClaimType` | String | ID claim URI. | http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier | true
User Role File | `propertyFileLocation` | String | Location of the file which maps roles to users. | etc/users.properties | true
User Attribute File | `usersAttributesFileLocation` | String | Location of the file which maps attributes to users. | etc/users.attributes | true

Table 50. Logout Page
Name | Id | Type | Description | Default Value
--- | --- | --- | --- | ---
Logout Page Time Out | `logOutPageTimeOut` | Long | This is the time limit that the SAML client waits for a user to click log out on the logout page. Any requests that take longer than this time for the user to submit are rejected."/> | 3600000

Table 51. Security SOAP Guest Interceptor
Name | Id | Type | Description | Default Value | Required
--- | --- | --- | --- | --- | ---
Deny Guest Access | `guestAccessDenied` | Boolean | If set to true, no guest access is allowed via this guest interceptor. If set to false, this interceptor generates guest tokens for incoming requests that lack a WS-Security header. | false | false

Table 52. SAML NameID Policy
Name | Id | Type | Description | Default Value | Required
--- | --- | --- | --- | --- | ---
SAML NameID Policy | `usernameAttributeList` | String | List of attributes that are considered for replacing the username of the logged in user. If any of these attributes match any of the attributes within the SecurityAssertion, the value of the first matching attribute is used as the username. (Does not apply when NameIDFormat is of the following: X509, persistent, kerberos or unspecified, and the username is not empty). | http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier, uid | true

Table 53. Security AuthZ Realm
Name | Id | Type | Description | Default Value | Required
--- | --- | --- | --- | --- | ---
Match-All Mappings | `matchAllMappings` | String | List of 'Match-All' subject attribute to Metacard attribute mapping. All values of this metacard key must be present in the corresponding subject key values. Format is subjectAttrName=metacardAttrName. |  | false
Match-One Mappings | `matchOneMappings` | String | List of 'Match-One' subject attribute to Metacard attribute mapping. One value of this metacard key must be present in the corresponding subject key values. Format is subjectAttrName=metacardAttrName. |  | false
Environment Attributes | `environmentAttributes` | String | List of environment attributes to pass to the XACML engine. Format is attributeId=attributeValue1,attributeValue2. |  | false

Table 54. Security STS Client
Name | Id | Type | Description | Default Value | Required
--- | --- | --- | --- | --- | ---
SAML Assertion Type | `assertionType` | String | The version of SAML to use. Most services require SAML v2.0. Changing this value from the default could cause services to stop responding. | http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0 | true
SAML Key Type | `keyType` | String | The key type to use with SAML. Most services require Bearer. Changing this value from the default could cause services to stop responding. | http://docs.oasis-open.org/ws-sx/ws-trust/200512/Bearer | true
SAML Key Size | `keySize` | String | The key size to use with SAML. The default key size is 256 and this is fine for most applications. Changing this value from the default could cause services to stop responding. | 256 | true
Use Key | `useKey` | Boolean | Signals whether or not the STS Client should supply a public key to embed as the proof key. Changing this value from the default could cause services to stop responding. | true | true
STS WSDL Address | `address` | String | STS WSDL Address | ${org.codice.ddf.system.protocol}${org.codice.ddf.system.hostname}:${org.codice.ddf.system.port}${org.codice.ddf.system.rootContext}/SecurityTokenService?wsdl | true
STS Endpoint Name | `endpointName` | String | STS Endpoint Name. | {http://docs.oasis-open.org/ws-sx/ws-trust/200512/}STS_Port | false
STS Service Name | `serviceName` | String | STS Service Name. | {http://docs.oasis-open.org/ws-sx/ws-trust/200512/}SecurityTokenService | false
Signature Properties | `signatureProperties` | String | Path to Signature crypto properties. This path can be part of the classpath, relative to <DDF_HOME>, or an absolute path on the system. | etc/ws-security/server/signature.properties | true
Encryption Properties | `encryptionProperties` | String | Path to Encryption crypto properties file. This path can be part of the classpath, relative to <DDF_HOME>, or an absolute path on the system. | etc/ws-security/server/encryption.properties | true
STS Properties | `tokenProperties` | String | Path to STS crypto properties file. This path can be part of the classpath, relative to <DDF_HOME>, or an absolute path on the system. | etc/ws-security/server/signature.properties | true
Claims | `claims` | String | List of claims that should be requested by the STS Client. | http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier,http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress,http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname,http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname,http://schemas.xmlsoap.org/ws/2005/05/identity/claims/role | true

Table 55. Web Context Policy Manager
Name | Id | Type | Description | Default Value | Required
--- | --- | --- | --- | --- | ---
Context Traversal Depth | `traversalDepth` | Integer | Depth to which paths are traversed. Any value greater than 500 is set to 500. | 20 | true
Allow Guest Access | `guestAccess` | Boolean | Allow guest access to all web contexts. Required attributes can be used to restrict access to contexts from guest users. | true | true
Allow Session Storage | `sessionAccess` | Boolean | Allow for session cookies to be used. Note that the SAML and OIDC authentication types require session storage to be enabled. | true | true
Authentication Types for Web Pages | `webAuthenticationTypes` | String | List of authentication types required for all web pages (these are all context paths except /services). List of valid authentication types are: BASIC, PKI, SAML, and OIDC. Example: AUTH1 | AUTH2 | AUTH3
PKI | `BASIC` | true | Authentication Types for Endpoints | endpointAuthenticationTypes | String
List of authentication types required for all endpoints (these are context paths that start with /services). List of valid authentication types are: BASIC, PKI, SAML, and OIDC. Example: AUTH1 | `AUTH2` | AUTH3 | PKI | BASIC | true
Required Attributes | `requiredAttributes` | String | List of attributes required for each Web Context. Example: /context={role=role1;type=type1} | /=,/admin={http://schemas.xmlsoap.org/ws/2005/05/identity/claims/role=system-admin},/system={http://schemas.xmlsoap.org/ws/2005/05/identity/claims/role=system-admin},/security-config={http://schemas.xmlsoap.org/ws/2005/05/identity/claims/role=system-admin} | true
White Listed Contexts | `whiteListContexts` | String | List of contexts that do not use security. Note that sub-contexts to ones listed here also skip security, unless authentication types are provided for it. For example: if /foo is listed here, then /foo/bar also does not require any sort of authentication. However, if /foo is listed and /foo/bar has authentication types provided in the 'Authentication Types' field, then that more specific policy is used. | ${org.codice.ddf.system.rootContext}/SecurityTokenService,${org.codice.ddf.system.rootContext}/internal/metrics,/proxy,${org.codice.ddf.system.rootContext}/saml,${org.codice.ddf.system.rootContext}/idp,/idp,${org.codice.ddf.system.rootContext}/platform/config/ui,/logout | true

Table 56. SAML Handler
Name | Id | Type | Description | Default Value
--- | --- | --- | --- | ---
Authentication Context Class | `authContextClasses` | String | Authentication Context Classes that are considered acceptable means of authentication by the SAML handler. | urn:oasis:names:tc:SAML:2.0:ac:classes:Password,urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport,urn:oasis:names:tc:SAML:2.0:ac:classes:X509,urn:oasis:names:tc:SAML:2.0:ac:classes:SmartcardPKI,urn:oasis:names:tc:SAML:2.0:ac:classes:SoftwarePKI,urn:oasis:names:tc:SAML:2.0:ac:classes:SPKI,urn:oasis:names:tc:SAML:2.0:ac:classes:TLSClient

Table 57. Security STS Server
Name | Id | Type | Description | Default Value | Required
--- | --- | --- | --- | --- | ---
SAML Assertion Lifetime | `lifetime` | Long | Set the number of seconds that an issued SAML assertion is valid. | 1800 | true
Token Issuer | `issuer` | String | The name of the server issuing tokens. Generally this is unique identifier of this IdP. | https://${org.codice.ddf.system.hostname}:${org.codice.ddf.system.httpsPort}${org.codice.ddf.system.rootContext}/idp/login | true
Signature Username | `signatureUsername` | String | Alias of the private key in the STS Server’s keystore used to sign messages. | ${org.codice.ddf.system.hostname} | true
Encryption Username | `encryptionUsername` | String | Alias of the private key in the STS Server’s keystore used to encrypt messages. | ${org.codice.ddf.system.hostname} | true

### 1.5. Solr Catalog Application Reference

DDF uses Solr for data storage, by default.

#### 1.5.1. Solr Catalog Prerequisites

To use the Solr Catalog Application, the following apps/features must be installed:

- Platform

- Catalog

#### 1.5.2. Installing Solr Catalog

Install the Solr Catalog application through the Admin Console.

1. Navigate to the Admin Console.

2. Select the System tab.

3. Select the Features tab.

4. Install the `catalog-solr-app` feature.

#### 1.5.3. Configuring the Solr Catalog Application

To configure the Solr Catalog Application:

1. Navigate to the Admin Console.

2. Select the Solr Catalog application.

3. Select the Configuration tab.

Table 58. Solr Catalog Available Configurations
Name | Property | Description
--- | --- | ---
Solr Catalog Provider | ddf.catalog.solr.provider.SolrCatalogProvider | Solr Catalog Provider.

Table 59. Solr Catalog Provider
Name | Property | Type | Description | Default Value | Required
--- | --- | --- | --- | --- | ---
Force Auto Commit | `forceAutoCommit` | Boolean | WARNING: Performance Impact. Only in special cases should auto-commit be forced. Forcing auto-commit makes the search results visible immediately. | false | true

### 1.6. Spatial Application Reference

The Spatial Application provides KML transformer and a KML network link endpoint that allows a user to generate a View-based KML Query Results Network Link.

#### 1.6.1. Offline Gazetteer Service

In the Spatial Application, the `offline-gazetteer` is installed by default. This feature enables you to use an offline source of GeoNames data (as an alternative to the GeoNames Web service enabled by the `webservice-gazetteer` feature) to perform searches via the gazetteer search box in the Search UI.

Installing the `offline-gazetteer-index` feature provides a small set of GeoNames data to use with the offline gazetteer. The GeoNames data is stored as metacards in the core catalog and are tagged with `geonames` and `gazetteer`. This collection of GeoNames metacards can be expanded or updated by using the `gazetteer:update` command.

##### 1.6.1.1. Spatial Gazetteer Console Commands

The `gazetteer` commands provide the ability to interact with the local GeoNames metacard collection in the core catalog. These GeoNames metacards are used by the `offline-gazetteer` feature, which is an optional feature available in this application and is explained above. Note that these commands are only available if the `offline-gazetteer` feature is installed.

Table 60. Gazetteer Command Descriptions
Command | Description
--- | ---
`gazetteer:update` | Adds new gazetteer metacards to the core catalog from a resource. The resource argument can be one of three types: a local file path to a `.txt`, `.zip`, or `.geo.json` GeoNames data file. If a path to a file ends in .geo.json, it is processed as a geoJSON feature collection and imported as supplementary shape data for GeoNames entries. a URL to a `.txt` or `.zip` GeoNames data file. GeoJSON URLs are not supported. a keyword to automatically process a GeoNames file from from http://download.geonames.org/export/dump. Valid keywords include a country code, which adds the country as GeoNames metacards in the core catalog. The full list of country codes available can be found in http://download.geonames.org/export/dump/countryInfo.txt. `cities1000`, `cities5000`, and `cities15000`, which adds cities to the index that have at least 1000, 5000, or 15000 people, respectively. `all`, which downloads all of the current country codes. This process may take some time. The `-c` or `--create` flag can be used to clear out the existing gazetteer metacards before adding new entries.
`build-suggester-index` | Builds the Solr suggester index used for placename autocompletion when using the offline gazetteer. This index is built automatically whenever gazetteer metacards are created, updated, or deleted, but if those builds fail then this command can be used to attempt to build the index again.

#### 1.6.2. Standalone Solr Offline Gazetteer Feature

The Standalone Solr Offline Gazetteer is a reflection of the gazetteer data stored in the catalog but separated from other data. This allows the suggester to be separately rebuilt much quicker than for the entire catalog collection.

##### 1.6.2.1. Installing Standalone Solr Offline Gazetteer

The Standalone Solr Offline Gazetteer is not installed by default but can be installed by running `feature:install catalog-solr-offline-gazetteer`. This installs:

- The plugin that intercepts gazetteer metacard creates/updates/deletes to the catalog collection (and stores them in the standalone solr gazetteer collection)

- The gazetteer query service which registers the Query component that responds to requests from the UI gazetteer search box

- The `offline-solr-gazetteer:removeall` command which deletes all records in the gazetteer collection.

- The `offline-solr-gazetteer:synccatalog` command which syncs with the catalog and updates all records in the gazetteer collection to reflect it (or add them if they are not yet created)

##### 1.6.2.2. Special Note Regarding Installation

If the Spatial Geocoding Offline Catalog bundle and the bundle using the Gazetteer query service (for example, Intrigue) are both already running, you must restart the bundles consuming the service (for example, Intrigue) in order to pick up the correct one.

##### 1.6.2.3. Building the suggester index on Standalone Solr Offline Gazetteer

The suggester index is built when any of the other methods of building the catalog gazetteer are run, along with on initial install. So you can run `gazetteer:build-suggester-index` or `offline-solr-gazetteer:build-suggester-index` to build the suggester.

Another option is to send a build request via a solr client. An example of this is done through the Solr Dashboard after selecting the `gazetteer` collection and clicking `query`. Ensure that the Request-Handler (qt) is set to `/suggest` and then in the 'Extra Parameters' field add `suggest.build=true&suggest.dictionary=suggestPlace&suggest.q=bla`.

#### 1.6.3. Spatial Prerequisites

To use the Spatial Application, the following apps/features must be installed:

- Platform

- Catalog

#### 1.6.4. Installing Spatial

Install the Spatial application through the Admin Console.

1. Navigate to the Admin Console.

2. Select the System tab.

3. Select the Features tab.

4. Install the `spatial-app` feature.

#### 1.6.5. Configuring the Spatial Application

To configure the Spatial Application:

1. Navigate to the Admin Console.

2. Select the Spatial application.

3. Select the Configuration tab.

Table 61. Spatial Available Configurations
Name | Property | Description
--- | --- | ---
WFS 1.1.0 Federated Source | Wfs_v1_1_0_Federated_Source | WFS 1.1.0 Federated Source.
CSW Transactional Profile Federated Source | Csw_Transactional_Federated_Source | CSW Federated Source that supports transactions (create, update, delete).
Metacard to WFS Feature Map | org.codice.ddf.spatial.ogc.wfs.catalog.mapper.MetacardMapper | Metacard to WFS Feature Map.
WFS 2.0.0 Connected Source | Wfs_v2_0_0_Connected_Source | WFS 2.0.0 Connected Source.
WFS 2.0.0 Federated Source | Wfs_v2_0_0_Federated_Source | WFS 2.0.0 Federated Source.
Spatial KML Endpoint | org.codice.ddf.spatial.kml.endpoint.KmlEndpoint | Spatial KML Endpoint.
Spatial KML Style Map Entry | org.codice.ddf.spatial.kml.style | Spatial KML Style Map Entry.
CSW Federation Profile Source | Csw_Federation_Profile_Source | DDF’s full-fidelity CSW Federation Profile. Use this when federating to a DDF-based system.
GeoCoder Plugin | org.codice.ddf.spatial.geocoding.plugin.GeoCoderPlugin | GeoCoder Plugin.
GMD CSW ISO Federated Source | Gmd_Csw_Federated_Source | CSW Federated Source using the Geographic MetaData (GMD) format (ISO 19115:2003).
CSW Specification Profile Federated Source | Csw_Federated_Source | CSW Specification Profile Federated Source should be used when federating to an external CSW service.

Table 62. WFS v1.1.0 Federated Source
Name | Id | Type | Description | Default Value | Required
--- | --- | --- | --- | --- | ---
Source ID | `id` | String | The unique name of the Source | WFS | true
WFS URL | `wfsUrl` | String | URL to the endpoint implementing the Web Feature Service (WFS) spec | null | true
Disable CN Check | `disableCnCheck` | Boolean | Disable CN check for the server certificate. This should only be used when testing. | false | true
Coordinate Order | `coordinateOrder` | String | Coordinate order that remote source expects and returns spatial data in | LAT_LON | true
Forced Feature Type | `forcedFeatureType` | String | Force only a specific FeatureType to be queried instead of all featureTypes | null | false
Authentication Type | `authenticationType` | String | The Discovery URL where the metadata of the OAuth Provider protecting the source is hosted. Required if OAuth 2.0 authentication type is selected. | saml | true
Username | `username` | String | Username for WFS Service. Required if basic authentication type is selected. | null | false
Password | `password` | Password | Password for WFS Service. Required if basic authentication type is selected. | null | false
Non Queryable Properties | `nonQueryableProperties` | String | Properties listed here are NOT queryable and any attempt to filter on these properties results in an exception. | null | false
Poll Interval | `pollInterval` | Integer | Poll Interval to Check if the Source is available (in minutes - minimum 1). | 5 | true
Forced Spatial Filter Type | `forceSpatialFilter` | String | Force only the selected Spatial Filter Type as the only available Spatial Filter. | NO_FILTER | false
Connection Timeout | `connectionTimeout` | Integer | Amount of time to attempt to establish a connection before timing out, in milliseconds. | 30000 | true
Receive Timeout | `receiveTimeout` | Integer | Amount of time to wait for a response before timing out, in milliseconds. | 60000 | true
SRS Name | `srsName` | String | SRS Name to use in outbound GetFeature requests. The SRS Name parameter is used to assert the specific CRS transformation to be applied to the geometries of the features returned in a response document. | EPSG:4326 | false

Table 63. CSW Transactional Profile Federated Source
Name | Id | Type | Description | Default Value | Required
--- | --- | --- | --- | --- | ---
Source ID | `id` | String | The unique name of the Source |  | true
CSW URL | `cswUrl` | String | URL to the endpoint implementing the Catalogue Service for Web (CSW) spec | ${variable-name}org.codice.ddf.system.protocol}${variable-name}org.codice.ddf.system.hostname}:${variable-name}org.codice.ddf.system.port}${variable-name}org.codice.ddf.system.rootContext}/csw | true
Event Service Address | `eventServiceAddress` | String | Event Service endpoint. | ${variable-name}org.codice.ddf.system.protocol}${variable-name}org.codice.ddf.system.hostname}:${variable-name}org.codice.ddf.system.port}${variable-name}org.codice.ddf.system.rootContext}/csw/subscription | false
Register for Events | `registerForEvents` | Boolean | Check to register for events from this source. | false | false
Authentication Type | `authenticationType` | String | Authentication type to use when federating. | saml | true
Username | `username` | String | Username for CSW Service. Required if basic authentication type is selected. |  | false
Password | `password` | Password | Password for CSW Service. Required if basic authentication type is selected. |  | false
OAuth Discovery Url | `oauthDiscoveryUrl` | String | The Discovery URL where the metadata of the OAuth Provider protecting the source is hosted. Required if OAuth 2.0 authentication type is selected. | https://localhost:8443/auth/realms/master/.well-known/openid-configuration | false
OAuth Client ID | `oauthClientId` | String | Client ID registered with the OAuth provider. Required if OAuth 2.0 authentication type is selected. | ddf-client | false
OAuth Client Secret | `oauthClientSecret` | String | Client Secret registered with the OAuth provider. Required if OAuth 2.0 authentication type is selected. | secret | false
OAuth Flow | `oauthFlow` | String | The OAuth flow to use when federating. Required if OAuth 2.0 authentication type is selected. | code | false
Disable CN Check | `disableCnCheck` | Boolean | Disable CN check for the server certificate. This should only be used when testing. | false | true
Coordinate Order | `coordinateOrder` | String | Coordinate order expected and returned by remote source | LON_LAT | true
Use posList in LinearRing | `usePosList` | Boolean | Use a <posList> element rather than a series of <pos> elements when issuing geospatial queries containing a LinearRing | false | false
Metacard Mappings | `metacardMappings` | String | Mapping of the Metacard Attribute names to their CSW property names. The format should be 'title=dc:title'. | effective=created,created=dateSubmitted,modified=modified,thumbnail=references,content-type=type,id=identifier,resource-uri=source | false
Poll Interval | `pollInterval` | Integer | Poll Interval to Check if the Source is available (in minutes - minimum 1). | 5 | true
Connection Timeout | `connectionTimeout` | Integer | Amount of time to attempt to establish a connection before timing out, in milliseconds. | 30000 | true
Receive Timeout | `receiveTimeout` | Integer | Amount of time to wait for a response before timing out, in milliseconds. | 60000 | true
Output Schema | `outputSchema` | String | Output Schema | urn:catalog:metacard | true
Query Type Name | `queryTypeName` | String | Qualified Name for the Query Type used in the CSW GetRecords request | csw:Record | true
Query Type Namespace | `queryTypeNamespace` | String | Namespace for the Query Type used in the CSW GetRecords request | http://www.opengis.net/cat/csw/2.0.2 | true
Force CQL Text | `isCqlForced` | Boolean | Force CQL Text as the Query Language | false | true
Forced Spatial Filter Type | `forceSpatialFilter` | String | Force only the selected Spatial Filter Type as the only available Spatial Filter. | NO_FILTER | false
Security Attributes | `securityAttributeStrings` | String | Security attributes for this source |  | true

Table 64. Metacard to WFS Feature Map
Name | Id | Type | Description | Default Value | Required
--- | --- | --- | --- | --- | ---
Feature Type | `featureType` | String | Feature Type. Format is {URI}local-name |  | true
Metacard Title to WFS Feature Property Mapping | `titleMapping` | String | Metacard Title to WFS Feature Property Mapping |  | false
Metacard Created Date to WFS Feature Property Mapping | `createdDateMapping` | String | Metacard Created Date to WFS Feature Property Mapping |  | false
Metacard Modified Date to WFS Feature Property Mapping | `modifiedDateMapping` | String | Metacard Modified Date to WFS Feature Property Mapping |  | false
Metacard Effective Date to WFS Feature Property Mapping | `effectiveDateMapping` | String | Metacard Effective Date to WFS Feature Property Mapping |  | false
Metacard Expiration Date to WFS Feature Property Mapping | `expirationDateMapping` | String | Metacard Expiration Date to WFS Feature Property Mapping |  | false
Metacard Resource URI to WFS Feature Property Mapping | `resourceUriMapping` | String | Metacard Resource URI to WFS Feature Property Mapping |  | false
Metacard Resource Size to WFS Feature Property Mapping | `resourceSizeMapping` | String | Metacard Resource Size to WFS Feature Property Mapping |  | false
The Units of the Feature Property that corresponds to the Metacard Resource Size | `dataUnit` | String | The Units of the Feature Property that corresponds to the Metacard Resource Size | B | true
Metacard Thumbnail to WFS Feature Property Mapping | `thumbnailMapping` | String | Metacard Thumbnail to WFS Feature Property Mapping |  | false
Metacard Geography to WFS Feature Property Mapping | `geographyMapping` | String | Metacard Geography to WFS Feature Property Mapping |  | false
Temporal Sort By Feature Property | `sortByTemporalFeatureProperty` | String | When Sorting Temporally, Sort By This Feature Property. |  | false
Relevance Sort By Feature Property | `sortByRelevanceFeatureProperty` | String | When Sorting By Relevance, Sort By This Feature Property. |  | false
Distance Sort By Feature Property | `sortByDistanceFeatureProperty` | String | When Sorting By Distance, Sort By This Feature Property. |  | false

Table 65. WFS 2.0.0 Connected Source
Name | Id | Type | Description | Default Value | Required
--- | --- | --- | --- | --- | ---
Source ID | `id` | String | The unique name of the Source | WFS | true
WFS URL | `wfsUrl` | String | URL to the endpoint implementing the Web Feature Service (WFS) 2.0.0 spec | null | true
Disable CN Check | `disableCnCheck` | Boolean | Disable CN check for the server certificate. This should only be used when testing. | false | true
Force Longitude/Latitude coordinate order | `isLonLatOrder` | Boolean | Force Longitude/Latitude coordinate order | false | true
Disable Sorting | `disableSorting` | Boolean | When selected, the system does not specify sort criteria with the query. This should only be used if the remote source is unable to handle sorting even when the capabilities states 'ImplementsSorting' is supported. | false | true
Authentication Type | `authenticationType` | String | The Discovery URL where the metadata of the OAuth Provider protecting the source is hosted. Required if OAuth 2.0 authentication type is selected. | saml | true
Username | `username` | String | Username for WFS Service. Required if basic authentication type is selected. | null | false
Password | `password` | Password | Password for WFS Service. Required if basic authentication type is selected. | null | false
Non Queryable Properties | `nonQueryableProperties` | String | Properties listed here are NOT queryable and any attempt to filter on these properties results in an exception. | null | false
Poll Interval | `pollInterval` | Integer | Poll Interval to Check if the Source is available (in minutes - minimum 1). | 5 | true
Forced Spatial Filter Type | `forceSpatialFilter` | String | Force only the selected Spatial Filter Type as the only available Spatial Filter. | NO_FILTER | false
Connection Timeout | `connectionTimeout` | Integer | Amount of time to attempt to establish a connection before timing out, in milliseconds. | 30000 | true
Receive Timeout | `receiveTimeout` | Integer | Amount of time to wait for a response before timing out, in milliseconds. | 60000 | true

Table 66. WFS 2.0.0 Federated Source
Name | Id | Type | Description | Default Value | Required
--- | --- | --- | --- | --- | ---
Source ID | `id` | String | The unique name of the Source | WFS_v2_0_0 | true
WFS URL | `wfsUrl` | String | URL to the endpoint implementing the Web Feature Service (WFS) 2.0.0 spec | null | true
Disable CN Check | `disableCnCheck` | Boolean | Disable CN check for the server certificate. This should only be used when testing. | false | true
Coordinate Order | `coordinateOrder` | String | Coordinate order that remote source expects and returns spatial data in | LAT_LON | true
Forced Feature Type | `forcedFeatureType` | String | Force only a specific FeatureType to be queried instead of all featureTypes | null | false
Disable Sorting | `disableSorting` | Boolean | When selected, the system does not specify sort criteria with the query. This should only be used if the remote source is unable to handle sorting even when the capabilities states 'ImplementsSorting' is supported. | false | true
Authentication Type | `authenticationType` | String | The Discovery URL where the metadata of the OAuth Provider protecting the source is hosted. Required if OAuth 2.0 authentication type is selected. | saml | true
Username | `username` | String | Username for the WFS Service. Required if basic authentication type is selected. | null | false
Password | `password` | Password | Password for the WFS Service. Required if basic authentication type is selected. | null | false
Non Queryable Properties | `nonQueryableProperties` | String | Properties listed here are NOT queryable and any attempt to filter on these properties results in an exception. | null | false
Poll Interval | `pollInterval` | Integer | Poll Interval to Check if the Source is available (in minutes - minimum 1). | 5 | true
Forced Spatial Filter Type | `forceSpatialFilter` | String | Force only the selected Spatial Filter Type as the only available Spatial Filter. | NO_FILTER | false
Connection Timeout | `connectionTimeout` | Integer | Amount of time to attempt to establish a connection before timing out, in milliseconds. | 30000 | true
Receive Timeout | `receiveTimeout` | Integer | Amount of time to wait for a response before timing out, in milliseconds. | 60000 | true

Table 67. Spatial KML Endpoint
Name | Id | Type | Description | Default Value | Required
--- | --- | --- | --- | --- | ---
Style Document | `styleUrl` | String | KML Document containing custom styling. This is served up by the KmlEndpoint. (for example, file:///path/to/kml/style/doc.kml) |  | false
Icons Location | `iconLoc` | String | Location of icons for the KML endpoint |  | false
Description | `description` | String | Description of this NetworkLink. Enter a short description of what this NetworkLink provides. |  | false
Web Site | `webSite` | String | URL of the web site to be displayed in the description. |  | false
Logo | `logo` | String | URL to the logo to be displayed in the description. |  | false
Visible By Default | `visibleByDefault` | Boolean | Check if the source NetworkLinks should be visible by default. | false | false
Max Number of Results | `maxResults` | Integer | The maximum number of results that should be returned from each layer. | 100 | false

Table 68. Spatial KML Style Map Entry
Name | Id | Type | Description | Default Value | Required
--- | --- | --- | --- | --- | ---
Attribute Name | `attributeName` | String | The name of the Metacard Attribute to match against. For example, title, metadata-content-type, etc | null | true
Attribute Value | `attributeValue` | String | The value of the Metacard Attribute. | null | true
Style URL | `styleUrl` | String | The full qualified URL to the KML Style, for example, http://example.com/styles#myStyle | null | true

Table 69. CSW Federation Profile Source
Name | Id | Type | Description | Default Value | Required
--- | --- | --- | --- | --- | ---
Source ID | `id` | String | The unique name of the Source | CSW | true
CSW URL | `cswUrl` | String | URL to the endpoint implementing the Catalogue Service for Web (CSW) spec | ${org.codice.ddf.external.protocol}${org.codice.ddf.external.hostname}:${org.codice.ddf.external.port}${org.codice.ddf.external.context}${org.codice.ddf.system.rootContext}/csw | true
CSW Event Service Address | `eventServiceAddress` | String | CSW Event Service endpoint. | ${org.codice.ddf.external.protocol}${org.codice.ddf.external.hostname}:${org.codice.ddf.external.port}${org.codice.ddf.external.context}${org.codice.ddf.system.rootContext}/csw/subscription | false
Register for Events | `registerForEvents` | Boolean | Check to register for events from this connected source. | false | false
Authentication Type | `authenticationType` | String | Authentication type to use when federating. | saml | true
Username | `username` | String | Username for CSW Service. Required if basic authentication type is selected. | null | false
Password | `password` | String | Password for CSW Service. Required if basic authentication type is selected. | null | false
OAuth Discovery Url | `oauthDiscoveryUrl` | String | The Discovery URL where the metadata of the OAuth Provider protecting the source is hosted. Required if OAuth 2.0 authentication type is selected. | https://localhost:8443/auth/realms/master/.well-known/openid-configuration | false
OAuth Client ID | `oauthClientId` | String | Client ID registered with the OAuth provider. Required if OAuth 2.0 authentication type is selected. | ddf-client | false
OAuth Client Secret | `oauthClientSecret` | String | Client Secret registered with the OAuth provider. Required if OAuth 2.0 authentication type is selected. | secret | false
OAuth Flow | `oauthFlow` | String | The OAuth flow to use when federating. Required if OAuth 2.0 authentication type is selected. | code | false
Connection Timeout | `connectionTimeout` | Integer | Amount of time to attempt to establish a connection before timing out,in milliseconds. | 30000 | true
Receive Timeout | `receiveTimeout` | Integer | Amount of time to wait for a response before timing out,in milliseconds. | 60000 | true

Table 70. GeoCoder Plugin
Title | Property | Type | Description | Default Value
--- | --- | --- | --- | ---
Radius | `radiusInKm` | Integer | The search radius from a Point in kilometers. | 10

Table 71. GMD CSW ISO Federated Source
Name | Id | Type | Description | Default Value | Required
--- | --- | --- | --- | --- | ---
Source ID | `id` | String | The unique name of the Source |  | true
CSW URL | `cswUrl` | String | URL to the endpoint implementing the Catalogue Service for Web (CSW) spec |  | true
Authentication Type | `authenticationType` | String | Authentication type to use when federating. | saml | true
Username | `username` | String | Username for CSW Service. Required if basic authentication type is selected. |  | false
Password | `password` | Password | Password for CSW Service. Required if basic authentication type is selected. |  | false
OAuth Discovery Url | `oauthDiscoveryUrl` | String | The Discovery URL where the metadata of the OAuth Provider protecting the source is hosted. Required if OAuth 2.0 authentication type is selected. | https://localhost:8443/auth/realms/master/.well-known/openid-configuration | false
OAuth Client ID | `oauthClientId` | String | Client ID registered with the OAuth provider. Required if OAuth 2.0 authentication type is selected. | ddf-client | false
OAuth Client Secret | `oauthClientSecret` | String | Client Secret registered with the OAuth provider. Required if OAuth 2.0 authentication type is selected. | secret | false
OAuth Flow | `oauthFlow` | String | The OAuth flow to use when federating. Required if OAuth 2.0 authentication type is selected. | code | false
Disable CN Check | `disableCnCheck` | Boolean | Disable CN check for the server certificate. This should only be used when testing. | false | true
Coordinate Order | `coordinateOrder` | String | Coordinate order expected and returned by remote source | LON_LAT | true
Use posList in LinearRing | `usePosList` | Boolean | Use a <posList> element rather than a series of <pos> elements when issuing geospatial queries containing a LinearRing | false | false
Metacard Mappings | `metacardMappings` | String | Mapping of the Metacard Attribute names to their CSW property names. The format should be 'title=dc:title'. | id=apiso:Identifier,effective=apiso:PublicationDate,created=apiso:CreationDate,modified=apiso:RevisionDate,title=apiso:AlternateTitle,AnyText=apiso:AnyText,ows:BoundingBox=apiso:BoundingBox,language=apiso:Language,language=apiso:ResourceLanguage,datatype=apiso:Type,description=apiso:Abstract,contact.point-of-contact-name=apiso:OrganisationName,topic.keyword=apiso:Subject,media.format=apiso:Format,modified=apiso:Modified | false
Poll Interval | `pollInterval` | Integer | Poll Interval to Check if the Source is available (in minutes - minimum 1). | 5 | true
Connection Timeout | `connectionTimeout` | Integer | Amount of time to attempt to establish a connection before timing out, in milliseconds. | 30000 | true
Receive Timeout | `receiveTimeout` | Integer | Amount of time to wait for a response before timing out, in milliseconds. | 60000 | true
Output Schema | `outputSchema` | String | Output Schema | http://www.isotc211.org/2005/gmd | true
Query Type Name | `queryTypeName` | String | Qualified Name for the Query Type used in the CSW GetRecords request | gmd:MD_Metadata | true
Query Type Namespace | `queryTypeNamespace` | String | Namespace for the Query Type used in the CSW GetRecords request | http://www.isotc211.org/2005/gmd | true
Force CQL Text | `isCqlForced` | Boolean | Force CQL Text as the Query Language | false | true
Forced Spatial Filter Type | `forceSpatialFilter` | String | Force only the selected Spatial Filter Type as the only available Spatial Filter. | NO_FILTER | false
Security Attributes | `securityAttributeStrings` | String | Security attributes for this source |  | true

Table 72. CSW Specification Profile Federated Source
Name | Id | Type | Description | Default Value | Required
--- | --- | --- | --- | --- | ---
Source ID | `id` | String | The unique name of the Source | null | true
CSW URL | `cswUrl` | String | URL to the endpoint implementing the Catalogue Service for Web (CSW) spec | ${org.codice.ddf.external.protocol}${org.codice.ddf.external.hostname}:${org.codice.ddf.external.port}${org.codice.ddf.external.context}${org.codice.ddf.system.rootContext}/csw | true
Event Service Address | `eventServiceAddress` | String | DDF Event Service endpoint. | ${org.codice.ddf.external.protocol}${org.codice.ddf.external.hostname}:${org.codice.ddf.external.port}${org.codice.ddf.external.context}${org.codice.ddf.system.rootContext}/csw/subscription | false
Register for Events | `registerForEvents` | Boolean | Check to register for events from this source. | false | false
Authentication Type | `authenticationType` | String | Authentication type to use when federating. | saml | true
Username | `username` | String | Username for CSW Service. Required if basic authentication type is selected. | null | false
Password | `password` | Password | Password for CSW Service. Required if basic authentication type is selected. | null | false
OAuth Discovery Url | `oauthDiscoveryUrl` | String | The Discovery URL where the metadata of the OAuth Provider protecting the source is hosted. Required if OAuth 2.0 authentication type is selected. | https://localhost:8443/auth/realms/master/.well-known/openid-configuration | false
OAuth Client ID | `oauthClientId` | String | Client ID registered with the OAuth provider. Required if OAuth 2.0 authentication type is selected. | ddf-client | false
OAuth Client Secret | `oauthClientSecret` | String | Client Secret registered with the OAuth provider. Required if OAuth 2.0 authentication type is selected. | secret | false
OAuth Flow | `oauthFlow` | String | The OAuth flow to use when federating. Required if OAuth 2.0 authentication type is selected. | code | false
Disable CN Check | `disableCnCheck` | Boolean | Disable CN check for the server certificate. This should only be used when testing. | false | true
Coordinate Order | `coordinateOrder` | String | Coordinate order that remote source expects and returns spatial data in | LON_LAT | true
Use posList in LinearRing | `usePosList` | Boolean | Use a <posList> element rather than a series of <pos> elements when issuing geospatial queries containing a LinearRing | false | false
Metacard Mappings | `metacardMappings` | String | Mapping of the Metacard Attribute names to their CSW property names. The format should be 'title=dc:title'. | effective=created,created=dateSubmitted,modified=modified,thumbnail=references,content-type=type,id=identifier,resource-uri=source | false
Poll Interval | `pollInterval` | Integer | Poll Interval to Check if the Source is available (in minutes - minimum 1). | 5 | true
Connection Timeout | `connectionTimeout` | Integer | Amount of time to attempt to establish a connection before timing out,in milliseconds. | 30000 | true
Receive Timeout | `receiveTimeout` | Integer | Amount of time to wait for a response before timing out,in milliseconds. | 60000 | true
Output Schema | `outputSchema` | String | Output Schema | http://www.opengis.net/cat/csw/2.0.2 | true
Query Type Name | `queryTypeName` | String | Qualified Name for the Query Type used in the CSW GetRecords request | csw:Record | true
Query Type Namespace | `queryTypeNamespace` | String | Namespace for the Query Type used in the CSW GetRecords request | http://www.opengis.net/cat/csw/2.0.2 | true
Force CQL Text as the Query Language | `isCqlForced` | Boolean | Force CQL Text | false | true
Forced Spatial Filter Type | `forceSpatialFilter` | String | Force only the selected Spatial Filter Type as the only available Spatial Filter. | NO_FILTER | false
Security Attributes | `securityAttributeStrings` | String | Security attributes for this source | null | true

### 1.7. Search UI Application Reference

The Search UI is a user interface that enables users to search a catalog and associated sites for content and metadata.

#### 1.7.1. Search UI Prerequisites

To use the Search UI application, the following applications/features must be installed:

- Platform

- Catalog

#### 1.7.2. Installing Search UI

Install the Search UI application through the Admin Console.

1. Navigate to the Admin Console.

2. Select the System tab.

3. Select the Features tab.

4. Install the `search-ui-app` feature.

#### 1.7.3. Configuring the Search UI Application

To configure the Search UI Application:

1. Navigate to the Admin Console.

2. Select the Search UI application.

3. Select the Configuration tab.

Table 73. Search UI Available Configurations
Name | Property | Description
--- | --- | ---
Catalog UI Search Workspace Query Monitor | org.codice.ddf.catalog.ui.query.monitor.impl.WorkspaceQueryService | Catalog UI Search Workspace Query Monitor.
Email Notifier | org.codice.ddf.catalog.ui.query.monitor.email.EmailNotifier | Email Notifier.
Search UI Redirect | org.codice.ddf.ui.searchui.filter.RedirectServlet | Search UI redirect.
Catalog UI Search Workspace Service | org.codice.ddf.catalog.ui.query.monitor.impl.WorkspaceServiceImpl | Catalog UI Search Workspace Service.
Catalog UI Search Transformer Blacklists | org.codice.ddf.catalog.ui.transformer.TransformerDescriptors | Catalog UI Search Transformer Blacklists.
Catalog UI Search Workspace Security | org.codice.ddf.catalog.ui.security | Catalog UI Search Workspace Security.
Facet Attribute Whitelist | org.codice.ddf.catalog.plugin.facetattributeaccess.facetwhitelist | Facet Attribute Whitelist

Table 74. Catalog UI Search Workspace Query Monitor
Name | Id | Type | Description | Default Value | Required
--- | --- | --- | --- | --- | ---
Query Timeout | `queryTimeoutMinutes` | Long | Set the number of minutes to wait for query to complete. | `5` | true
Notification Time Interval | `queryTimeInterval` | Integer | Set the Relative Time Search (past X minutes up to 24 hours). Note: This queries for results from the interval to the time the query is sent out. | `1440` | true

Table 75. Catalog UI Search Email Notifier
Name | Id | Type | Description | Default Value | Required
--- | --- | --- | --- | --- | ---
Subject | `subjectTemplate` | String | Set the subject line template. | `Workspace '%[attribute=title]' notification` | true
Body | `bodyTemplate` | String | Set the body template. | `The workspace '%[attribute=title]' contains up to %[hitCount] results. Log in to see results https://{FQDN}:{PORT}/search/catalog/#workspaces/%attribute=id.` | true
From Address | `fromEmail` | String | Set the 'from' email address. | `donotreply@example.com` | true

Table 76. Search UI Redirect
Name | Id | Type | Description | Default Value | Required
--- | --- | --- | --- | --- | ---
Redirect URI | `defaultUri` | String | Specifies the redirect URI to use when accessing the /search URI. | `${org.codice.ddf.external.context}/search/simple/` | true

Table 77. Catalog UI Search Workspace Service
Name | Id | Type | Description | Default Value | Required
--- | --- | --- | --- | --- | ---
Maximum Subscriptions | `maxSubscriptions` | Integer | Specifies the maximum number of workspace subscriptions that may be queried for email notifications. | `100` | true

Table 78. Catalog UI Search Transformer Blacklists
Name | Id | Type | Description | Default Value | Required
--- | --- | --- | --- | --- | ---
Metacard Transformer Blacklist | `blackListedMetacardTransformerIds` | String | The IDs of all Metacard Transformers services that do not show up as export actions in the UI. Every ID in this set removes that transformer as an export option in the UI. | `[]` | false
Query Response Transformer Blacklist | `blackListedQueryResponseTransformerIds` | String | The IDs of all Query Response Transformers services that do not show up as export actions in the UI. Every ID in this set removes that transformer as an export option in the UI. | `[`zipCompression`]` | false

Table 79. Catalog UI Search Workspace Security
Name | Id | Type | Description | Default Value | Required
--- | --- | --- | --- | --- | ---
System User Attribute | `systemUserAttribute` | String | The name of the attribute to determine the system user. | `http://schemas.xmlsoap.org/ws/2005/05/identity/claims/role` | true
System User Attribute Value | `systemUserAttributeValue` | String | The value of the attribute to determine the system user. | `system-user` | true

Table 80. Facet Attribute Whitelist
Name | Id | Type | Description | Default Value | Required
--- | --- | --- | --- | --- | ---
Facet Attribute Whitelist | `facetAttributeWhitelist` | String | Attributes that can be faceted against through the catalog framework. Caution: Suggestion values are not protected by any security. Only choose attributes whose values are safe for all users to view. |  | false

## 2. Application Whitelists

Within each DDF application, certain packages are exported for use by third parties.

### 2.1. Packages Removed From Whitelist

In the transition of the whitelist from the ambiguous package listing to the new class listing several errors were found. The packages originally listed that were removed either did not exist, contained experimental interfaces, or contained only internal implementations and should have never been included in the whitelist. The following is a list of packages that were listed in error and have been removed from the whitelist.

Note | None of the packages in this list have been removed from the distribution. They may however be changed or removed in the future.

Admin

- `org.codice.ddf.ui.admin.api.plugin`

- `org.codice.ddf.admin.configuration.plugin`

Catalog

- `org.codice.ddf.admin.configuration.plugin`

- `ddf.catalog.data.metacardtype`

- `ddf.catalog.federation.impl`

- `ddf.catalog.plugin.groomer`

- `ddf.catalog.pubsub`

- `ddf.catalog.pubsub.tracker`

- `ddf.catalog.resource.data`

- `ddf.catalog.resource.impl`

- `ddf.catalog.resourceretriever`

- `ddf.catalog.transformer.metacard.geojson`

- `ddf.common`

- `org.codice.ddf.endpoints`

- `org.codice.ddf.endpoints.rest`

- `org.codice.ddf.endpoints.rest.action`

- `org.codice.ddf.opensearch.query`

- `org.codice.ddf.opensearch.query.filter`

Platform

- `org.codice.ddf.configuration.admin`

- `org.codice.ddf.configuration.migration`

- `org.codice.ddf.configuration.persistence`

- `org.codice.ddf.configuration.persistence.felix`

- `org.codice.ddf.configuration.status`

- `org.codice.ddf.parser`

- `org.codice.ddf.parser.xml`

- `org.codice.ddf.platform.error.handler`

- `org.codice.ddf.platform.util`

Security

- `ddf.security.assertion.impl`

- `ddf.security.common.audit`

- `ddf.security.http.impl`

- `ddf.security.impl`

- `ddf.security.pdp.realm`

- `ddf.security.permission`

- `ddf.security.principal`

- `ddf.security.realm.sts`

- `ddf.security.samlp.impl`

- `ddf.security.service.impl`

- `ddf.security.settings`

- `ddf.security.soap.impl`

- `ddf.security.sts`

- `ddf.security.ws.policy.impl`

- `org.codice.ddf.security.certificate.generator`

- `org.codice.ddf.security.certificate.keystore.editor`

- `org.codice.ddf.security.common`

- `org.codice.ddf.security.filter.authorization`

- `org.codice.ddf.security.filter.login`

- `org.codice.ddf.security.filter.websso`

- `org.codice.ddf.security.handler.basic`

- `org.codice.ddf.security.handler.guest.configuration`

- `org.codice.ddf.security.handler.guest`

- `org.codice.ddf.security.handler.pki`

- `org.codice.ddf.security.handler.saml`

- `org.codice.ddf.security.interceptor`

- `org.codice.ddf.security.interceptor`

- `org.codice.ddf.security.policy.context.impl`

- `org.codice.ddf.security.servlet.logout`

- `org.codice.ddf.security.validator.username`

Spatial

- `org.codice.ddf.spatial.geocoder`

- `org.codice.ddf.spatial.geocoder.geonames`

- `org.codice.ddf.spatial.geocoding`

- `org.codice.ddf.spatial.geocoding.context`

- `org.codice.ddf.spatial.kml.endpoint`

- `org.codice.ddf.spatial.ogc.catalog.resource.impl`

### 2.2. Catalog Whitelist

The following classes have been exported by the Catalog application and are approved for use by third parties:

In package `ddf.catalog`

- `CatalogFramework`

- `Constants`

In package `ddf.catalog.cache`

- `ResourceCacheInterface` Deprecated

In package `ddf.catalog.data`

- `Attribute`

- `AttributeDescriptor`

- `AttributeType`

- `BinaryContent`

- `ContentType`

- `Metacard`

- `MetacardCreationException`

- `MetacardType`

- `MetacardTypeUnregistrationException`

- `Result`

In package `ddf.catalog.event`

- `DeliveryException`

- `DeliveryMethod`

- `EventException`

- `EventProcessor`

- `InvalidSubscriptionException`

- `Subscriber`

- `Subscription`

- `SubscriptionExistsException`

- `SubscriptionNotFoundException`

In package `ddf.catalog.federation`

- `Federatable`

- `FederationException`

- `FederationStrategy`

In package `ddf.catalog.filter`

- `AttributeBuilder`

- `BufferedSpatialExpressionBuilder`

- `ContextualExpressionBuilder`

- `EqualityExpressionBuilder`

- `ExpressionBuilder`

- `FilterAdapter`

- `FilterBuilder`

- `FilterDelegate`

- `NumericalExpressionBuilder`

- `NumericalRangeExpressionBuilder`

- `SpatialExpressionBuilder`

- `TemporalInstantExpressionBuilder`

- `TemporalRangeExpressionBuilder`

- `XPathBasicBuilder`

- `XPathBuilder`

In package `ddf.catalog.filter.delegate`

- `CopyFilterDelegate`

- `FilterToTextDelegate`

In package `ddf.catalog.operation`

- `CreateRequest`

- `CreateResponse`

- `DeleteRequest`

- `DeleteResponse`

- `Operation`

- `OperationTransaction`

- `Pingable`

- `ProcessingDetails`

- `Query`

- `QueryRequest`

- `QueryResponse`

- `Request`

- `ResourceRequest`

- `ResourceResponse`

- `Response`

- `SourceInfoRequest`

- `SourceInfoResponse`

- `SourceProcessingDetails`

- `SourceResponse`

- `Update`

- `UpdateRequest`

- `UpdateResponse`

In package `ddf.catalog.plugin`

- `AccessPlugin`

- `PluginExecutionException`

- `PolicyPlugin`

- `PolicyResponse`

- `PostFederatedQueryPlugin`

- `PostIngestPlugin`

- `PostQueryPlugin`

- `PostResourcePlugin`

- `PreDeliveryPlugin`

- `PreFederatedQueryPlugin`

- `PreIngestPlugin`

- `PreQueryPlugin`

- `PreResourcePlugin`

- `PreSubscriptionPlugin`

- `StopProcessingException`

In package `ddf.catalog.resource`

- `DataUsageLimitExceededException`

- `Resource`

- `ResourceNotFoundException`

- `ResourceNotSupportedException`

- `ResourceReader`

- `ResourceWriter`

In package `ddf.catalog.service`

- `ConfiguredService`

In package `ddf.catalog.source`

- `CatalogProvider`

- `ConnectedSource`

- `FederatedSource`

- `IngestException`

- `InternalIngestException`

- `RemoteSource`

- `Source`

- `SourceDescriptor`

- `SourceMonitor`

- `SourceUnavailableException`

- `UnsupportedQueryException`

In package `ddf.catalog.transform`

- `CatalogTransformerException`

- `InputCollectionTransformer`

- `InputTransformer`

- `MetacardTransformer`

- `QueryResponseTransformer`

In package `ddf.catalog.transformer.api`

- `MetacardMarshaller`

- `PrintWriter`

- `PrintWriterProvider`

In package `ddf.catalog.util`

- `Describable` Deprecated

- `Maskable`

In package `ddf.catalog.validation`

- `MetacardValidator`

- `ValidationException`

In package `ddf.geo.formatter`

- `CompositeGeometry`

- `GeometryCollection`

- `LineString`

- `MultiLineString`

- `MultiPoint`

- `MultiPolygon`

- `Point`

- `Polygon`

In package `ddf.util`

- `InetAddressUtil`

- `NamespaceMapImpl`

- `NamespaceResolver`

- `WktStandard`

- `XPathCache`

- `XPathHelper`

- `XSLTUtil`

### 2.3. Platform Whitelist

The following classes have been exported by the Platform application and are approved for use by third parties:

In package `ddf.action`

- `Action`

- `ActionProvider`

- `ActionRegistry`

In package `org.codice.ddf.branding`

- `BrandingPlugin`

- `BrandingRegistry`

In package `org.codice.ddf.configuration`

- `ConfigurationWatcher` Deprecated

### 2.4. Security Whitelist

The following classes have been exported by the Security application and are approved for use by third parties:

In package `ddf.security`

- `SecurityConstants`

- `Subject`

In package `ddf.security.assertion`

- `SecurityAssertion`

In package `ddf.security.common.util`

- `Security` Deprecated

- `SecurityProperties`

- `ServiceComparator`

- `SortedServiceList` Deprecated

In package `ddf.security.encryption`

- `EncryptionService`

In package `ddf.security.expansion`

- `Expansion`

In package `ddf.security.http`

- `SessionFactory`

In package `ddf.security.service`

- `SecurityManager`

- `SecurityServiceException`

- `TokenRequestHandler`

In package `ddf.security.sts.client.configuration`

- `STSClientConfiguration`

In package `ddf.security.ws.policy`

- `AbstractOverrideInterceptor`

- `PolicyLoader`

In package `org.codice.ddf.security.handler.api`

- `AuthenticationHandler`

In package `org.codice.ddf.security.policy.context.attributes`

- `ContextAttributeMapping`

In package `org.codice.ddf.security.policy.context`

- `ContextPolicy`

- `ContextPolicyManager`

### 2.5. Solr Catalog Whitelist

The following classes have been exported by the Solr Catalog application and are approved for use by third parties:

None.

### 2.6. Search UI Whitelist

The following classes have been exported by the Search UI application and are approved for use by third parties:

None.

## 3. DDF Dependency List

This list of DDF dependencies is automatically generated:

### 3.1. DDF 2.31.0 Dependency List

- `ca.juliusdavies:not-yet-commons-ssl:jar:0.3.11`

- `ch.qos.logback:logback-access:jar:1.2.3`

- `ch.qos.logback:logback-classic:jar:1.2.3`

- `ch.qos.logback:logback-core:jar:1.2.3`

- `com.connexta.arbitro:arbitro-core:jar:1.0.0`

- `com.fasterxml.jackson.core:jackson-annotations:jar:2.12.5`

- `com.fasterxml.jackson.core:jackson-core:jar:2.12.5`

- `com.fasterxml.jackson.core:jackson-databind:jar:2.12.5`

- `com.fasterxml.woodstox:woodstox-core:jar:6.2.6`

- `com.github.drapostolos:type-parser:jar:0.5.0`

- `com.github.jai-imageio:jai-imageio-core:jar:1.4.0`

- `com.github.jai-imageio:jai-imageio-jpeg2000:jar:1.3.1_CODICE_3`

- `com.github.jknack:handlebars:jar:2.0.0`

- `com.github.lookfirst:sardine:jar:5.7`

- `com.github.luben:zstd-jni:jar:1.4.9-1`

- `com.github.openjson:openjson:jar:1.0.12`

- `com.google.code.findbugs:jsr305:jar:3.0.2`

- `com.google.code.gson:gson:jar:2.8.5`

- `com.google.crypto.tink:tink:jar:1.4.0`

- `com.google.guava:guava:jar:29.0-jre`

- `com.google.http-client:google-http-client:jar:1.22.0`

- `com.google.protobuf:protobuf-java:jar:3.12.4`

- `com.googlecode.json-simple:json-simple:jar:1.1.1`

- `com.googlecode.owasp-java-html-sanitizer:owasp-java-html-sanitizer:jar:20191001.1`

- `com.hazelcast:hazelcast:jar:3.12.10`

- `com.jhlabs:filters:jar:2.0.235-1`

- `com.mchange:c3p0:jar:0.9.5.5`

- `com.nimbusds:lang-tag:jar:1.4.4`

- `com.nimbusds:nimbus-jose-jwt:jar:8.14.1`

- `com.nimbusds:oauth2-oidc-sdk:jar:8.3`

- `com.rometools:rome-utils:jar:1.9.0`

- `com.rometools:rome:jar:1.9.0`

- `com.sparkjava:spark-core:jar:2.9.2`

- `com.thoughtworks.xstream:xstream:jar:1.4.18`

- `com.unboundid:unboundid-ldapsdk:jar:4.0.14`

- `com.xebialabs.restito:restito:jar:0.9.4`

- `com.zensols.jrtf:tutego.jrtf:jar:0.1.0`

- `commons-beanutils:commons-beanutils:jar:1.9.4`

- `commons-codec:commons-codec:jar:1.11`

- `commons-codec:commons-codec:jar:1.15`

- `commons-collections:commons-collections:jar:3.2.2`

- `commons-configuration:commons-configuration:jar:1.10`

- `commons-digester:commons-digester:jar:1.8.1`

- `commons-fileupload:commons-fileupload:jar:1.3.3`

- `commons-io:commons-io:jar:2.11.0`

- `commons-lang:commons-lang:jar:2.6`

- `commons-logging:commons-logging:jar:1.2`

- `commons-net:commons-net:jar:3.5`

- `commons-validator:commons-validator:jar:1.6`

- `de.micromata.jak:JavaAPIforKml:jar:2.2.0`

- `de.micromata.jak:JavaAPIforKml:jar:2.2.1_CODICE_1`

- `io.github.soc:ogc-tools-gml-jts:jar:1.1.90`

- `io.micrometer:micrometer-registry-prometheus:jar:1.5.1`

- `io.rest-assured:rest-assured:jar:3.3.0`

- `jakarta.activation:jakarta.activation-api:jar:1.2.2`

- `jakarta.mail:jakarta.mail-api:jar:1.6.5`

- `jakarta.xml.bind:jakarta.xml.bind-api:jar:2.3.3`

- `jakarta.xml.soap:jakarta.xml.soap-api:jar:1.4.2`

- `javax.activation:activation:jar:1.1.1`

- `javax.annotation:javax.annotation-api:jar:1.2`

- `javax.cache:cache-api:jar:1.1.1`

- `javax.inject:javax.inject:jar:1`

- `javax.measure:unit-api:jar:1.0`

- `javax.servlet:javax.servlet-api:jar:3.1.0`

- `javax.servlet:servlet-api:jar:2.5`

- `javax.validation:validation-api:jar:1.1.0.Final`

- `javax.ws.rs:javax.ws.rs-api:jar:2.1`

- `javax.xml.bind:jaxb-api:jar:2.2.11`

- `javax.xml.stream:stax-api:jar:1.0-2`

- `joda-time:joda-time:jar:2.10.6`

- `junit:junit:jar:4.13.2`

- `net.bytebuddy:byte-buddy-agent:jar:1.10.18`

- `net.bytebuddy:byte-buddy:jar:1.10.18`

- `net.jodah:failsafe:jar:0.9.3`

- `net.jodah:failsafe:jar:0.9.5`

- `net.jodah:failsafe:jar:1.0.0`

- `net.minidev:accessors-smart:jar:2.4.7`

- `net.minidev:asm:jar:1.0.2`

- `net.minidev:json-smart:jar:2.3`

- `net.minidev:json-smart:jar:2.4.7`

- `net.sf.jwordnet:jwnl:jar:1.3.3`

- `net.sf.saxon:Saxon-HE:jar:9.6.0-4`

- `org.antlr:antlr4-runtime:jar:4.3`

- `org.apache.abdera:abdera-extensions-geo:jar:1.1.3`

- `org.apache.abdera:abdera-extensions-opensearch:jar:1.1.3`

- `org.apache.ant:ant-launcher:jar:1.9.7`

- `org.apache.ant:ant:jar:1.9.7`

- `org.apache.aries.jmx:org.apache.aries.jmx.api:jar:1.1.5`

- `org.apache.aries.jmx:org.apache.aries.jmx.core:jar:1.1.8`

- `org.apache.aries.proxy:org.apache.aries.proxy:jar:1.1.10`

- `org.apache.aries:org.apache.aries.util:jar:1.1.3`

- `org.apache.calcite:calcite-core:jar:1.26.0`

- `org.apache.camel:camel-aws-s3:jar:3.8.0`

- `org.apache.camel:camel-base:jar:3.8.0`

- `org.apache.camel:camel-core:jar:3.8.0`

- `org.apache.camel:camel-http-common:jar:3.8.0`

- `org.apache.camel:camel-servlet:jar:3.8.0`

- `org.apache.camel:camel-support:jar:3.8.0`

- `org.apache.commons:commons-collections4:jar:4.1`

- `org.apache.commons:commons-compress:jar:1.21`

- `org.apache.commons:commons-csv:jar:1.4`

- `org.apache.commons:commons-exec:jar:1.3`

- `org.apache.commons:commons-lang3:jar:3.11`

- `org.apache.commons:commons-math3:jar:3.6.1`

- `org.apache.commons:commons-pool2:jar:2.5.0`

- `org.apache.commons:commons-text:jar:1.6`

- `org.apache.cxf:cxf-core:jar:3.4.4`

- `org.apache.cxf:cxf-rt-bindings-soap:jar:3.4.4`

- `org.apache.cxf:cxf-rt-features-logging:jar:3.4.4`

- `org.apache.cxf:cxf-rt-frontend-jaxrs:jar:3.4.4`

- `org.apache.cxf:cxf-rt-frontend-jaxws:jar:3.4.4`

- `org.apache.cxf:cxf-rt-rs-client:jar:3.4.4`

- `org.apache.cxf:cxf-rt-rs-security-jose-jaxrs:jar:3.4.4`

- `org.apache.cxf:cxf-rt-rs-security-jose:jar:3.4.4`

- `org.apache.cxf:cxf-rt-rs-security-oauth2:jar:3.4.4`

- `org.apache.cxf:cxf-rt-rs-security-sso-saml:jar:3.4.4`

- `org.apache.cxf:cxf-rt-rs-security-xml:jar:3.4.4`

- `org.apache.cxf:cxf-rt-transports-http:jar:3.4.1`

- `org.apache.cxf:cxf-rt-transports-http:jar:3.4.4`

- `org.apache.cxf:cxf-rt-ws-security:jar:3.4.4`

- `org.apache.felix:org.apache.felix.configadmin:jar:1.9.22`

- `org.apache.felix:org.apache.felix.fileinstall:jar:3.7.0`

- `org.apache.felix:org.apache.felix.framework:jar:6.0.5`

- `org.apache.felix:org.apache.felix.scr:jar:2.1.28`

- `org.apache.felix:org.apache.felix.utils:jar:1.11.8`

- `org.apache.httpcomponents:httpclient:jar:4.5.12`

- `org.apache.httpcomponents:httpcore:jar:4.4.13`

- `org.apache.httpcomponents:httpmime:jar:4.5.12`

- `org.apache.karaf.bundle:org.apache.karaf.bundle.core:jar:4.3.3`

- `org.apache.karaf.features:enterprise:xml:features:4.3.3`

- `org.apache.karaf.features:org.apache.karaf.features.core:jar:4.3.3`

- `org.apache.karaf.features:standard:xml:features:4.3.3`

- `org.apache.karaf.itests:common:jar:4.3.3`

- `org.apache.karaf.jaas:org.apache.karaf.jaas.boot:jar:4.3.3`

- `org.apache.karaf.jaas:org.apache.karaf.jaas.config:jar:4.3.3`

- `org.apache.karaf.jaas:org.apache.karaf.jaas.modules:jar:4.3.3`

- `org.apache.karaf.log:org.apache.karaf.log.core:jar:4.3.3`

- `org.apache.karaf.shell:org.apache.karaf.shell.console:jar:4.3.3`

- `org.apache.karaf.shell:org.apache.karaf.shell.core:jar:4.3.3`

- `org.apache.karaf.system:org.apache.karaf.system.core:jar:4.3.3`

- `org.apache.karaf:apache-karaf:tar.gz:4.3.3`

- `org.apache.karaf:apache-karaf:zip:4.3.3`

- `org.apache.karaf:karaf:pom:4.3.3`

- `org.apache.karaf:org.apache.karaf.client:jar:4.3.3`

- `org.apache.karaf:org.apache.karaf.util:jar:4.3.3`

- `org.apache.logging.log4j:log4j-1.2-api:jar:2.11.2`

- `org.apache.logging.log4j:log4j-api:jar:2.11.2`

- `org.apache.logging.log4j:log4j-api:jar:2.8.2`

- `org.apache.logging.log4j:log4j-core:jar:2.11.2`

- `org.apache.logging.log4j:log4j-slf4j-impl:jar:2.11.2`

- `org.apache.lucene:lucene-analyzers-common:jar:8.9.0`

- `org.apache.lucene:lucene-core:jar:3.0.2`

- `org.apache.lucene:lucene-core:jar:8.9.0`

- `org.apache.lucene:lucene-queryparser:jar:8.9.0`

- `org.apache.pdfbox:fontbox:jar:2.0.23`

- `org.apache.pdfbox:pdfbox-tools:jar:2.0.23`

- `org.apache.pdfbox:pdfbox:jar:2.0.23`

- `org.apache.poi:poi-ooxml-schemas:jar:4.1.2`

- `org.apache.poi:poi-ooxml:jar:4.1.2`

- `org.apache.poi:poi-scratchpad:jar:4.1.2`

- `org.apache.poi:poi:jar:4.1.2`

- `org.apache.servicemix.bundles:org.apache.servicemix.bundles.jaxb-runtime:jar:2.3.2_2`

- `org.apache.servicemix.bundles:org.apache.servicemix.bundles.jdom:jar:2.0.6_1`

- `org.apache.servicemix.bundles:org.apache.servicemix.bundles.poi:jar:4.1.2_1`

- `org.apache.servicemix.specs:org.apache.servicemix.specs.jaxb-api-2.3:jar:2.3_3`

- `org.apache.servicemix.specs:org.apache.servicemix.specs.jsr339-api-2.0:jar:2.6.0`

- `org.apache.shiro:shiro-core:jar:1.7.1`

- `org.apache.solr:solr-core:jar:8.9.0`

- `org.apache.solr:solr-solrj:jar:8.9.0`

- `org.apache.tika:tika-core:jar:1.26`

- `org.apache.tika:tika-parsers:jar:1.26`

- `org.apache.ws.commons.axiom:axiom-api:jar:1.2.14`

- `org.apache.ws.xmlschema:xmlschema-core:jar:2.2.3`

- `org.apache.wss4j:wss4j-ws-security-common:jar:2.3.0`

- `org.apache.wss4j:wss4j-ws-security-dom:jar:2.3.0`

- `org.apache.xmlbeans:xmlbeans:jar:3.1.0`

- `org.apache.zookeeper:zookeeper-jute:jar:3.6.2`

- `org.apache.zookeeper:zookeeper:jar:3.6.2`

- `org.assertj:assertj-core:jar:3.18.1`

- `org.awaitility:awaitility:jar:3.1.6`

- `org.bouncycastle:bcmail-jdk15on:jar:1.69`

- `org.bouncycastle:bcpkix-jdk15on:jar:1.69`

- `org.bouncycastle:bcprov-jdk15on:jar:1.69`

- `org.codehaus.woodstox:stax2-api:jar:4.2.1`

- `org.codice.countrycode:converter:jar:0.1.8`

- `org.codice.opendj.embedded:opendj-embedded-app:xml:features:1.3.3`

- `org.codice.pro-grade:pro-grade:jar:1.1.3`

- `org.codice.thirdparty:commons-httpclient:jar:3.1.0_1`

- `org.codice.thirdparty:ffmpeg:zip:bin:4.3.1_1`

- `org.codice.thirdparty:geotools-suite:jar:20.1_2`

- `org.codice.thirdparty:gt-api:jar:20.1_3`

- `org.codice.thirdparty:jts:jar:1.16.0_2`

- `org.codice.thirdparty:lucene-core:jar:3.0.2_1`

- `org.codice.thirdparty:ogc-filter-v_1_1_0-schema:jar:1.1.0_5`

- `org.codice.thirdparty:picocontainer:jar:1.3_1`

- `org.codice.thirdparty:tika-bundle:jar:1.26.0_1`

- `org.codice.usng4j:usng4j-api:jar:0.4`

- `org.codice.usng4j:usng4j-impl:jar:0.4`

- `org.cryptomator:siv-mode:jar:1.2.2`

- `org.eclipse.jetty.websocket:websocket-servlet:jar:9.4.42.v20210604`

- `org.eclipse.jetty:jetty-http:jar:9.4.42.v20210604`

- `org.eclipse.jetty:jetty-security:jar:9.4.42.v20210604`

- `org.eclipse.jetty:jetty-server:jar:9.4.42.v20210604`

- `org.eclipse.jetty:jetty-servlet:jar:9.4.42.v20210604`

- `org.eclipse.jetty:jetty-util:jar:9.4.42.v20210604`

- `org.eclipse.platform:org.eclipse.osgi:jar:3.16.300`

- `org.forgerock.commons:forgerock-util:jar:3.0.2`

- `org.forgerock.commons:i18n-core:jar:1.4.2`

- `org.forgerock.commons:i18n-slf4j:jar:1.4.2`

- `org.forgerock.opendj:opendj-core:jar:3.0.0`

- `org.forgerock.opendj:opendj-grizzly:jar:3.0.0`

- `org.fusesource.jansi:jansi:jar:1.18`

- `org.geotools.xsd:gt-xsd-gml3:jar:28.2`

- `org.geotools:gt-cql:jar:20.2`

- `org.geotools:gt-epsg-hsql:jar:28.2`

- `org.geotools:gt-main:jar:28.2`

- `org.geotools:gt-api:jar:28.2`

- `org.geotools:gt-referencing:jar:28.2`

- `org.geotools:gt-shapefile:jar:28.2`

- `org.geotools:gt-xml:jar:28.2`

- `org.glassfish.grizzly:grizzly-framework:jar:2.3.30`

- `org.glassfish.grizzly:grizzly-http-server:jar:2.3.25`

- `org.glassfish.jaxb:jaxb-runtime:jar:2.3.3`

- `org.hamcrest:hamcrest-all:jar:1.3`

- `org.hibernate:hibernate-core:jar:5.4.24.Final`

- `org.hisrc.w3c:xlink-v_1_0:jar:1.4.0`

- `org.imgscalr:imgscalr-lib:jar:4.2`

- `org.jasypt:jasypt:jar:1.9.3`

- `org.jcodec:jcodec:jar:0.2.0_1`

- `org.joda:joda-convert:jar:1.2`

- `org.jolokia:jolokia-osgi:jar:1.6.2`

- `org.json:json:jar:20170516`

- `org.jsoup:jsoup:jar:1.11.3`

- `org.jvnet.jaxb2_commons:jaxb2-basics-runtime:jar:0.10.0`

- `org.jvnet.jaxb2_commons:jaxb2-basics-runtime:jar:0.11.0`

- `org.jvnet.jaxb2_commons:jaxb2-basics-runtime:jar:0.6.0`

- `org.jvnet.ogc:filter-v_1_1_0:jar:2.6.1`

- `org.jvnet.ogc:filter-v_2_0_0-schema:jar:1.1.0`

- `org.jvnet.ogc:gml-v_3_1_1-schema:jar:1.1.0`

- `org.jvnet.ogc:gml-v_3_1_1:jar:2.6.1`

- `org.jvnet.ogc:gml-v_3_2_1-schema:jar:1.1.0`

- `org.jvnet.ogc:gml-v_3_2_1:pom:1.1.0`

- `org.jvnet.ogc:ows-v_1_0_0-schema:jar:1.1.0`

- `org.jvnet.ogc:ows-v_1_0_0:jar:2.6.1`

- `org.jvnet.ogc:ows-v_1_1_0-schema:jar:1.1.0`

- `org.jvnet.ogc:wcs-v_1_0_0-schema:jar:1.1.0`

- `org.jvnet.ogc:wfs-v_1_1_0:jar:2.6.1`

- `org.la4j:la4j:jar:0.6.0`

- `org.locationtech.jts:jts-core:jar:1.19.0`

- `org.locationtech.spatial4j:spatial4j:jar:0.8`

- `org.mindrot:jbcrypt:jar:0.4`

- `org.mockito:mockito-core:jar:3.6.28`

- `org.objenesis:objenesis:jar:3.1`

- `org.opengis:geoapi:jar:3.0.1`

- `org.opensaml:opensaml-core:jar:3.4.6`

- `org.opensaml:opensaml-soap-impl:jar:3.4.6`

- `org.opensaml:opensaml-xmlsec-api:jar:3.4.6`

- `org.opensaml:opensaml-xmlsec-impl:jar:3.4.6`

- `org.ops4j.pax.exam:pax-exam-container-karaf:jar:4.13.4`

- `org.ops4j.pax.exam:pax-exam-features:xml:4.13.4`

- `org.ops4j.pax.exam:pax-exam-junit4:jar:4.13.4`

- `org.ops4j.pax.exam:pax-exam-link-mvn:jar:4.13.4`

- `org.ops4j.pax.exam:pax-exam:jar:4.13.4`

- `org.ops4j.pax.swissbox:pax-swissbox-extender:jar:1.8.4`

- `org.ops4j.pax.tinybundles:tinybundles:jar:3.0.0`

- `org.ops4j.pax.url:pax-url-aether:jar:2.6.7`

- `org.ops4j.pax.url:pax-url-wrap:jar:2.6.7`

- `org.ops4j.pax.web:pax-web-api:jar:7.3.19`

- `org.ops4j.pax.web:pax-web-jsp:jar:7.3.19`

- `org.osgi:org.osgi.enterprise:jar:5.0.0`

- `org.osgi:osgi.cmpn:jar:7.0.0`

- `org.osgi:osgi.core:jar:7.0.0`

- `org.ow2.asm:asm-analysis:jar:7.1`

- `org.ow2.asm:asm-tree:jar:7.1`

- `org.ow2.asm:asm:jar:7.1`

- `org.ow2.asm:asm:jar:9.2`

- `org.pac4j:pac4j-core:jar:4.0.1`

- `org.pac4j:pac4j-jwt:jar:4.0.1`

- `org.pac4j:pac4j-oauth:jar:4.0.1`

- `org.pac4j:pac4j-oidc:jar:4.0.1`

- `org.parboiled:parboiled-core:jar:1.3.1`

- `org.parboiled:parboiled-java:jar:1.3.1`

- `org.quartz-scheduler:quartz:jar:2.3.2`

- `org.slf4j:jcl-over-slf4j:jar:1.7.32`

- `org.slf4j:jul-to-slf4j:jar:1.7.24`

- `org.slf4j:slf4j-api:jar:1.7.32`

- `org.slf4j:slf4j-ext:jar:1.7.29`

- `org.slf4j:slf4j-log4j12:jar:1.7.32`

- `org.slf4j:slf4j-simple:jar:1.7.32`

- `org.springframework.ldap:spring-ldap-core:jar:2.3.3.RELEASE`

- `org.springframework.osgi:spring-osgi-core:jar:1.2.1`

- `org.springframework:spring-core:jar:5.2.13.RELEASE`

- `org.taktik:mpegts-streamer:jar:0.1.0_2`

- `org.xmlunit:xmlunit-matchers:jar:2.8.2`

- `xalan:serializer:jar:2.7.2`

- `xalan:xalan:jar:2.7.2`

- `xerces:xercesImpl:jar:2.12.0`

- `xml-apis:xml-apis:jar:1.4.01`

- `xpp3:xpp3:jar:1.1.4c`

## 4. Hardening Checklist

The following list enumerates the required mitigations needed for hardening. It is not intended to be a step-by-step procedure. To harden a new system, perform configuration as documented.

- ❏ Configure Auditing

- ❏ Set Directory Permissions

- ❏ Configure Keystore and Certificates

- ❏ Disallow Login Without Certificates

- ❏ Configure Certificate Revocation

  - ❏ Deny Guest User Access (if denying Guest users)

  - ❏ Allow Guest User Access (if allowing Guest users)

- ❏ Configure Guest Claim Attributes (if allowing Guest users)

- ❏ Configure Guest User Authentication

- ❏ Create unique user role

- ❏ Restricting Access to Admin Console

- ❏ Restricting Access to Features, Apps, Services, and Configurations

- ❏ Remove Default Users

- ❏ Harden Solr

- ❏ Environment Hardening