PEP Server configuration file

# Configuration file for the pepserver
#

# ----------------------------
# Application configuration
# ----------------------------
[application]

# Directory where the pepserver saves its temporary files etc.
workingdir = ./

# Directory where token elements are stored.
tokenelementdir = ./tokenelements

# Execute this program/script after the policy has been successfully updated in shared memory.
# Can be used to distribute a policy to multiple nodes/destinations.
# If nothing is set no execute is done.
#postdeploy = <path/script>

# Specifies the communication id to use. Default 0
# Teradata  : Configurable.
# SQLServer : Must be set to 0.
# Oracle    : Configurable. Must match the value specified in 'createobjects.sql'
# DB2       : Configurable.
# Valid values are in the range 0 to 255.
communicationid = 0

# Add the PEP Server's IP Address to request headers.
# This is needed when the PEP Server is communicating with ESA via a proxy.
addipaddressheader = yes


# ---------------------------------
# Logging configuration 
# ---------------------------------
[logging]

# Logging level for pepserver application logs: OFF - No logging, SEVERE, WARNING, INFO, CONFIG, ALL
level = WARNING

# Set the output type for protections logs. Set to either tcp or stdout.
# tcp    = (default) Logs are sent to fluent-bit using tcp
# stdout = Logs are sent to stdout
output = tcp

# Fluentbit host and port values (mostly localhost) where logs will be forwarded from the protector.
host = 127.0.0.1
port = 15780

# In case that connection to the fluentbit is lost, set how logs must be handled.
# This setting is only for the protector logs and not application logs, sent from pepserver
# drop = (default) Protector throws logs away if connection to the fluentbit is lost
# error = Protector returns error without protecting/unprotecting data if connection to the fluentbit is lost
mode = drop

# Intervall in seconds, on how often we send logs from protector to logforwarder. ( Default 1 sec )
# It can be set to a maximum of 86400 ( i.e. 24 hours ).
logsendinterval = 1

# -----------------------------
# Policy management
# -----------------------------
[policymanagement]

# The base URL to the HubController service.
url = https://10.10.100.5:8443

# Path to the CA certificate.
cafile = ./CA.pem

# Path to the certificate.
certfile = ./cert.pem

# Path to the private key for the certificate.
certkeyfile = ./cert.key

# Path to the credential file used to decrypt the private key.
keycredentialfile = ./certkeyup.bin

# Number of seconds between checks to refresh policy from ESA.
# Specify a value in the range 30 to 86400 seconds (default is 60 seconds). If this
# value is set to be larger than 300 then the node status might not be proper on ESA.
# Some random bias will be added to this value to spread the load from multiple pep servers.
policyrefreshinterval = 60

# Define what value to return if data to protect is an empty string
# null = Return a null value (Default)
# encrypt = Return an encrypted value
# empty = Return an empty string
emptystring = null


# -----------------------------------
# Application Protector configuration
# -----------------------------------
[applicationprotector]

# Listener port for Application Protector Client/Server.
#listener = tcp, 15910/127.0.0.1


# ----------------------------
# Administration configuration
# ----------------------------
[administration]

# Listener port for the administration interface.
# Only accessible on localhost.
listener = tcp, 16700

# The URI to the authentication API.
# Base URL and certificates is taken from policymanagement section
uri = /api/v1/auth/login/checkcredentials


# -----------------------------
# Member management
# -----------------------------
[member]

# Specifies how policy users are checked against policy
# yes = (The default) policy users are treated in case sensitive manner
# no = policy users are treated in case insensitive manner.
case-sensitive = yes

# -----------------------------
# Shared Memory management
# -----------------------------
# This section appears only for the DSG. For other protectors, you must add the section manually.
[sharedmemory]
groupname = dsggroup
worldreadable = no