AMS is configured through one or more files that use HOCON syntax, which itself is a form of JSON. The supplied AMS.conf file is located in $AMS_HOME/conf. However, you can also use your own site-specific configuration file and store it in a directory of your choosing. To accomplish this, the AMS start script can prepend any customer-supplied classpath elements to the classpath used to start the AMS server. AMS overrides the default configuration file with the custom one.

AMS is configured through one or more files that use HOCON syntax, which itself is a form of JSON. The supplied AMS.conf file is located in $AMS_HOME/conf. However, you can also use your own site-specific configuration file and store it in a directory of your choosing. To accomplish this, use the --conf option to start the AMS server. For example, ams-server --conf /path/to/my/site-specific-AMS.conf.

The following shows the configuration's HOCON properties, usage, and syntax examples, where applicable.

AMS provides a HOCON-formatted configuration file that allows you to configure security settings and user access control. The port number the server listens on is the prototypical example of a site-specific value that you can configure.

// Site-specific modifications to the AMS server configuration

com.tibco.ep.ams.configuration {

  Database {

    // The path to the database file and the username and password to access the file. 
    // The path can be absolute or relative to the working directory from which the AMS 
    // is started.        
    filePath = "data/ams-h2-persistence"
    userName = "sa"
    password = ""
  }

  ClientAPIListener = {

    // The port the AMS server listens on and whether that port is configured for secure (TLS) 
    // communication
    portNumber = 2185
    secure = false
  }

  CommunicationSecurity = {

    // The keystore file, keystore password, and key password when using secure (TLS) communication
    keyStore = "localhost.jks"
    keyStorePassword = "password"
    keyPassword = "password"
      
    // Client authentication is not currently supported in the AMS
    clientAuthentication = {
      trustStore = "localhost.jks"
      trustStorePassword = "password"
      cipherSuites = [
        "SSL_RSA_WITH_RC4_128_MD5"
        "SSL_RSA_WITH_RC4_128_SHA"
      ]
    }
  }

  LocalAuthenticationRealm = {

    // Users and their passwords and roles. Passwords can be enciphered with the 
    // sbcipher utility for additional security.
    principals = [
      {
         userName = "admin"
         password = "admin"
         roles = ["AMSAdmin"]
      }
      {
         userName = "deploy"
         password = "deploy"
         roles = ["AMSDeploy"]
      }
      {
         userName = "nopriv"
         password = "nopriv"
         roles = []
      }
    ]
  }

  LDAPAuthenticationRealm = {

    // Configuration for authenticating users against an LDAP server
    serverConnectAlgorithm = "round-robin"
    servers = [
      {
         authenticationCredentials = {
         userName = "CN=Administrator,CN=Users,DC=mycompany,DC=com"
         password = "password"
         }
         host = "adserver.mycompany.com"
         portNumber = 389
         secure = true
         principalRoot = "CN=Users,DC=mycompany,DC=com"
         principalSearch = "CN={0}"
         roleRoot = "CN=Groups,DC=mycompany,DC=com"
         roleSearch = "distinguishedName={0}"
         roleAttribute = "memberOf"
       }
    ]
  }
   OpenIDConnectAuthenticationRealm {

     // Properties that control how identities are bound to AMS profiles after 
     // authenticating with an identity provider if no matching AMS profile is found.
     IdentityToAMSProfileBinding = {

     // Configure the action(s) to take when no binding exists between an identity and 
     // an AMS profile. Valid values are:
     //
     //  FAIL - Fails the login request.
     //
     //  AUTO_CREATE - Creates a new AMS profile using the configured OpenID Connect claim 
     //  as the username.
     //
     //  SIGN_IN - Presents a login form to the user, who enters the credentials of an existing 
     //  AMS profile, creating the binding between the identity and profile.
     //
     //  SIGN_IN_OR_SIGN_UP - Presents a login form to the user, who enters the credentials of 
     //  an existing AMS profile or requests the creation of a new profile.
         bindAction = "AUTO_CREATE"

     // The OpenID Connect claim used for the username of auto-created AMS profiles. Valid values 
     // include: email, name, family_name
        autoCreateUsernameClaim = "email"

     // Determines whether auto-created users, or users created through the sign-up form, are 
     // initially enabled
        autoCreateUserEnabled = "false"

     // A comma-delimited list of role(s) to assign to auto-created users
        autoCreateDefaultRoles = ""

     // Zero or more filters to apply to auto-create AMS profile requests. A filter contains the name
     // of a fully-qualified Java path that conforms to the com.tibcp.ep.ams.auth.AMSAutoCreateFilter
     // interface along with zero or more parameters associated with each filter. In the example below,
     // a filter is used to restrict the creation of AMS profiles to users within a specific email domain.
     // For an auto-create request to succeed, it must pass all the configured filters.
     autoCreateFilters = [
       {
          javaClass = "com.tibco.ep.ams.auth.AMSAutoCreateEmailFilter"
          params = [

     // Comma-delimited list of acceptable email domains
       {
          name = "domains"
          value = "mycompany.com"
       }
             ]
          }
       ]
   }

     // Configuration for authentication against one or more OpenID Connect identity providers
        IdentityProviders = {

          providers = [
            {
               name = "Google"
               issuer = "https://accounts.google.com"
               clientId = "place your Google client ID here"
               clientSecret = "place your Google client secret here"
                }
                {
               name = "Auth0"
               issuer = "https://jtk-test.auth0.com"
               clientId = "place your Auth0 client ID here"
               clientSecret = "place your Auth0 client secret here"
               subjectProviderMappings = [
                {
                  subjectPrefix = "google-oauth2"
                  provider = "Google"
                }
              ]
            }
         ]
      }
  }

  AMSRealmList = [

    // Enables one or more of the realms defined above: LocalAuthenticationRealm, 
    // LDAPAuthenticationRealm, AMSPersistenceRealm, or OpenIDConnectAuthenticationRealm
    LocalAuthenticationRealm
    ]

  RoleToPrivilegeMappings = {

    // Map of roles to permissions.
    privileges = {

      AMSAdmin = [
          {
            privilege = "*"
          }
      ]

      AMSDeploy = [
          {
              privilege = "artifact:deploy"
          }
      ]
    }
  }

  DeploymentServiceNames = {

        // Zero or more StreamBase service names from which to accept deployment requests. If empty, the AMS responds to all
        // services. Service names can contain Java-compatible wildcards.
        filter = [
            // Uncomment the following line to respond to requests only from services starting with "myservice"
            // myservice.*
        ]

        // Credentials for one or more StreamBase services. These credentials are used when deploying artifacts
        // using a Target Type of StreamBase Service Name.
        services = [
            {
                serviceName = "myservice"
                userName = "guest"
                password = "guest"
            }
        ]
    }
  SourceControlManagement {

    repositories = [
      {
         name = "REPO1"                                          // A unique name for this repository instance
         enabled = false                                         // Set to true to enable this repository and false otherwise
         type = "GIT"                                            // Valid values are GIT, SUBVERSION, or CUSTOM
         javaClass = ""                                          // Required only when type == CUSTOM
         url = "https://svn.mycompany.com/path/to/repository"    // Repository URL
         branch = "master"                                       // Repository branch name (defaults to master)
         username = "myusername"                                 // Repository username (can be enciphered with ams-server --cipher)
         password = "mypassword"                                 // Repository password (can be enciphered with ams-server --cipher)
         executable = "/usr/bin/git"                             // Path to Subversion, Git, or custom executable
         pullIntervalSeconds = 0                                 // Interval in seconds between attempts to pull repository updates into AMS, or 0 to disable periodic pulling
      }
      {
         name = "REPO2"                                          // A unique name for this repository instance
         enabled = false                                         // Set to true to enable this repository and false otherwise
         type = "SUBVERSION"                                     // Valid values are GIT, SUBVERSION, or CUSTOM
         javaClass = ""                                          // Required only when type == CUSTOM
         url = "https://svn.mycompany.com/path/to/repository"    // Repository URL
         username = "myusername"                                 // Repository username (can be enciphered with ams-server --cipher)
         password = "mypassword"                                 // Repository password (can be enciphered with ams-server --cipher)
         executable = "/usr/bin/svn"                             // Path to Subversion, Git, or custom executable
         pullIntervalSeconds = 0                                 // Interval in seconds between attempts to pull repository updates into AMS, or 0 to disable periodic pulling
      }
    ]
  }
}