Package org.projectnessie.client

Class NessieConfigConstants

java.lang.Object
org.projectnessie.client.NessieConfigConstants
public final class NessieConfigConstants extends Object
Configuration constants for Nessie clients.

  • Field Details

    • CONF_NESSIE_URI

      public static final String CONF_NESSIE_URI
      Config property name ("nessie.uri") for the Nessie service URL.
      See Also:

    • CONF_NESSIE_USERNAME

      @Deprecated public static final String CONF_NESSIE_USERNAME
      Deprecated.
      "basic" HTTP authentication is not considered secure. Use CONF_NESSIE_AUTH_TOKEN instead.
      Config property name ("nessie.authentication.username") for the username used for (basic) authentication.
      See Also:

    • CONF_NESSIE_PASSWORD

      @Deprecated public static final String CONF_NESSIE_PASSWORD
      Deprecated.
      "basic" HTTP authentication is not considered secure. Use CONF_NESSIE_AUTH_TOKEN instead.
      Config property name ("nessie.authentication.password") for the password used for (basic) authentication.
      See Also:

    • CONF_NESSIE_AUTH_TOKEN

      public static final String CONF_NESSIE_AUTH_TOKEN
      Config property name ("nessie.authentication.token") for the token used for (bearer) authentication.
      See Also:

    • CONF_NESSIE_OAUTH2_ISSUER_URL

      public static final String CONF_NESSIE_OAUTH2_ISSUER_URL
      Config property name ("nessie.authentication.oauth2.issuer-url") for the OAuth2 authentication provider. The root URL of the OpenID Connect identity issuer provider, which will be used for discovering supported endpoints and their locations. For Keycloak, this is typically the realm URL: https://<keycloak-server>/realms/<realm-name>.

      Endpoint discovery is performed using the OpenID Connect Discovery metadata published by the issuer. See OpenID Connect Discovery 1.0 for more information.

      Either this property or CONF_NESSIE_OAUTH2_TOKEN_ENDPOINT must be set.

      See Also:

    • CONF_NESSIE_OAUTH2_TOKEN_ENDPOINT

      public static final String CONF_NESSIE_OAUTH2_TOKEN_ENDPOINT
      Config property name ("nessie.authentication.oauth2.token-endpoint") for the OAuth2 authentication provider. The URL of the OAuth2 token endpoint. For Keycloak, this is typically https://<keycloak-server>/realms/<realm-name>/protocol/openid-connect/token.

      Either this property or CONF_NESSIE_OAUTH2_ISSUER_URL must be set. In case it is not set, the token endpoint will be discovered from the issuer URL, using the OpenID Connect Discovery metadata published by the issuer.

      See Also:

    • CONF_NESSIE_OAUTH2_AUTH_ENDPOINT

      public static final String CONF_NESSIE_OAUTH2_AUTH_ENDPOINT
      Config property name ("nessie.authentication.oauth2.auth-endpoint") for the OAuth2 authentication provider. The URL of the OAuth2 authorization endpoint. For Keycloak, this is typically https://<keycloak-server>/realms/<realm-name>/protocol/openid-connect/auth.

      If using the "authorization_code" grant type, either this property or CONF_NESSIE_OAUTH2_ISSUER_URL must be set. In case it is not set, the authorization endpoint will be discovered from the issuer URL, using the OpenID Connect Discovery metadata published by the issuer.

      See Also:

    • CONF_NESSIE_OAUTH2_DEVICE_AUTH_ENDPOINT

      public static final String CONF_NESSIE_OAUTH2_DEVICE_AUTH_ENDPOINT
      Config property name ("nessie.authentication.oauth2.device-auth-endpoint") for the OAuth2 authentication provider. The URL of the OAuth2 device authorization endpoint. For Keycloak, this is typically http://<keycloak-server>/realms/<realm-name>/protocol/openid-connect/auth/device.

      If using the "Device Code" grant type, either this property or CONF_NESSIE_OAUTH2_ISSUER_URL must be set.

      See Also:

    • CONF_NESSIE_OAUTH2_GRANT_TYPE_CLIENT_CREDENTIALS

      public static final String CONF_NESSIE_OAUTH2_GRANT_TYPE_CLIENT_CREDENTIALS
      See Also:

    • CONF_NESSIE_OAUTH2_GRANT_TYPE_PASSWORD

      public static final String CONF_NESSIE_OAUTH2_GRANT_TYPE_PASSWORD
      See Also:

    • CONF_NESSIE_OAUTH2_GRANT_TYPE_AUTHORIZATION_CODE

      public static final String CONF_NESSIE_OAUTH2_GRANT_TYPE_AUTHORIZATION_CODE
      See Also:

    • CONF_NESSIE_OAUTH2_GRANT_TYPE_DEVICE_CODE

      public static final String CONF_NESSIE_OAUTH2_GRANT_TYPE_DEVICE_CODE
      See Also:

    • CONF_NESSIE_OAUTH2_GRANT_TYPE

      public static final String CONF_NESSIE_OAUTH2_GRANT_TYPE
      Config property name ("nessie.authentication.oauth2.grant-type") for the OAuth2 authentication provider. The grant type to use when authenticating against the OAuth2 server. Valid values are: Optional, defaults to "client_credentials".

      Depending on the grant type, different properties must be provided.

      For the "client_credentials" grant type, the following properties must be provided:

      For the "password" grant type, the following properties must be provided:

      For the "authorization_code" grant type, the following properties must be provided:

      For the "device_code" grant type, the following properties must be provided:

      Both client and user must be properly configured with appropriate permissions in the OAuth2 server for the authentication to succeed.

      See Also:

    • CONF_NESSIE_OAUTH2_CLIENT_ID

      public static final String CONF_NESSIE_OAUTH2_CLIENT_ID
      Config property name ("nessie.authentication.oauth2.client-id") for the OAuth2 authentication provider. The client ID to use when authenticating against the OAuth2 server. Required if using OAuth2 authentication, ignored otherwise.
      See Also:

    • CONF_NESSIE_OAUTH2_CLIENT_SECRET

      public static final String CONF_NESSIE_OAUTH2_CLIENT_SECRET
      Config property name ("nessie.authentication.oauth2.client-secret") for the OAuth2 authentication provider. The client secret to use when authenticating against the OAuth2 server. Required if using OAuth2 authentication, ignored otherwise.
      See Also:

    • CONF_NESSIE_OAUTH2_USERNAME

      public static final String CONF_NESSIE_OAUTH2_USERNAME
      Config property name ("nessie.authentication.oauth2.username") for the OAuth2 authentication provider. The username to use when authenticating against the OAuth2 server. Required if using OAuth2 authentication and "password" grant type, ignored otherwise.
      See Also:

    • CONF_NESSIE_OAUTH2_PASSWORD

      public static final String CONF_NESSIE_OAUTH2_PASSWORD
      Config property name ("nessie.authentication.oauth2.password") for the OAuth2 authentication provider. The user password to use when authenticating against the OAuth2 server. Required if using OAuth2 authentication and the "password" grant type, ignored otherwise.
      See Also:

    • DEFAULT_DEFAULT_ACCESS_TOKEN_LIFESPAN

      public static final String DEFAULT_DEFAULT_ACCESS_TOKEN_LIFESPAN
      See Also:

    • CONF_NESSIE_OAUTH2_DEFAULT_ACCESS_TOKEN_LIFESPAN

      public static final String CONF_NESSIE_OAUTH2_DEFAULT_ACCESS_TOKEN_LIFESPAN
      Config property name ("nessie.authentication.oauth2.default-access-token-lifespan") for the OAuth2 authentication provider. The default access token lifespan; if the OAuth2 server returns an access token without specifying its expiration time, this value will be used. Optional, defaults to "PT1M". Must be a valid ISO-8601 duration.
      See Also:

    • DEFAULT_DEFAULT_REFRESH_TOKEN_LIFESPAN

      public static final String DEFAULT_DEFAULT_REFRESH_TOKEN_LIFESPAN
      See Also:

    • CONF_NESSIE_OAUTH2_DEFAULT_REFRESH_TOKEN_LIFESPAN

      public static final String CONF_NESSIE_OAUTH2_DEFAULT_REFRESH_TOKEN_LIFESPAN
      Config property name ("nessie.authentication.oauth2.default-refresh-token-lifespan") for the OAuth2 authentication provider. The default refresh token lifespan; if the OAuth2 server returns a refresh token without specifying its expiration time, this value will be used. Optional, defaults to "PT30M". Must be a valid ISO-8601 duration.
      See Also:

    • DEFAULT_REFRESH_SAFETY_WINDOW

      public static final String DEFAULT_REFRESH_SAFETY_WINDOW
      See Also:

    • CONF_NESSIE_OAUTH2_REFRESH_SAFETY_WINDOW

      public static final String CONF_NESSIE_OAUTH2_REFRESH_SAFETY_WINDOW
      Config property name ("nessie.authentication.oauth2.refresh-safety-window") for the OAuth2 authentication provider. The refresh safety window to use; a new token will be fetched when the current token's remaining lifespan is less than this value. Optional, defaults to "PT10S". Must be a valid ISO-8601 duration.
      See Also:

    • DEFAULT_PREEMPTIVE_TOKEN_REFRESH_IDLE_TIMEOUT

      public static final String DEFAULT_PREEMPTIVE_TOKEN_REFRESH_IDLE_TIMEOUT
      See Also:

    • CONF_NESSIE_OAUTH2_PREEMPTIVE_TOKEN_REFRESH_IDLE_TIMEOUT

      public static final String CONF_NESSIE_OAUTH2_PREEMPTIVE_TOKEN_REFRESH_IDLE_TIMEOUT
      Config property name ("nessie.authentication.oauth2.preemptive-token-refresh-idle-timeout") for the OAuth2 authentication provider. For how long the OAuth2 provider should keep the tokens fresh, if the client is not being actively used. Setting this value too high may cause an excessive usage of network I/O and thread resources; conversely, when setting it too low, if the client is used again, the calling thread may block if the tokens are expired and need to be renewed synchronously. Optional, defaults to "PT30S". Must be a valid ISO-8601 duration.
      See Also:

    • DEFAULT_BACKGROUND_THREAD_IDLE_TIMEOUT

      public static final String DEFAULT_BACKGROUND_THREAD_IDLE_TIMEOUT
      See Also:

    • CONF_NESSIE_OAUTH2_BACKGROUND_THREAD_IDLE_TIMEOUT

      public static final String CONF_NESSIE_OAUTH2_BACKGROUND_THREAD_IDLE_TIMEOUT
      Config property name ("nessie.authentication.oauth2.background-thread-idle-timeout") for the OAuth2 authentication provider. How long the background thread should be kept running if the client is not being actively used, or no token refreshes are being executed. Optional, defaults to "PT30S". Setting this value too high will cause the background thread to keep running even if the client is not used anymore, potentially leaking thread and memory resources; conversely, setting it too low could cause the background thread to be restarted too often. Must be a valid ISO-8601 duration.
      See Also:

    • CONF_NESSIE_OAUTH2_CLIENT_SCOPES

      public static final String CONF_NESSIE_OAUTH2_CLIENT_SCOPES
      Config property name ("nessie.authentication.oauth2.client-scopes") for the OAuth2 authentication provider. Space-separated list of scopes to include in each request to the OAuth2 server. Optional, defaults to empty (no scopes).

      The scope names will not be validated by the Nessie client; make sure they are valid according to RFC 6749 Section 3.3.

      See Also:

    • CONF_NESSIE_OAUTH2_TOKEN_EXCHANGE_ENABLED

      public static final String CONF_NESSIE_OAUTH2_TOKEN_EXCHANGE_ENABLED
      Config property name ("nessie.authentication.oauth2.token-exchange-enabled") for the OAuth2 authentication provider. If set to true, the Nessie client will attempt to exchange access tokens for refresh tokens whenever appropriate. This, however, can only work if the OAuth2 server supports token exchange. Optional, defaults to true (enabled).

      Note that recent versions of Keycloak support token exchange, but it is disabled by default. See Using token exchange for more information and how to enable this feature.

      See Also:

    • CONF_NESSIE_OAUTH2_AUTHORIZATION_CODE_FLOW_WEB_PORT

      public static final String CONF_NESSIE_OAUTH2_AUTHORIZATION_CODE_FLOW_WEB_PORT
      Config property name ("nessie.authentication.oauth2.auth-code-flow.web-port") for the OAuth2 authentication provider. The port used for the internal web server that listens for the authorization code callback. This is only used if the grant type to use is "authorization_code". Optional; if not present, a random port will be used.
      See Also:

    • CONF_NESSIE_OAUTH2_AUTHORIZATION_CODE_FLOW_TIMEOUT

      public static final String CONF_NESSIE_OAUTH2_AUTHORIZATION_CODE_FLOW_TIMEOUT
      Config property name ("nessie.authentication.oauth2.auth-code-flow.timeout") for the OAuth2 authentication provider. How long the client should wait for the authorization code flow to complete. This is only used if the grant type to use is "authorization_code". Optional, defaults to "PT5M".
      See Also:

    • DEFAULT_AUTHORIZATION_CODE_FLOW_TIMEOUT

      public static final String DEFAULT_AUTHORIZATION_CODE_FLOW_TIMEOUT
      See Also:

    • CONF_NESSIE_OAUTH2_DEVICE_CODE_FLOW_TIMEOUT

      public static final String CONF_NESSIE_OAUTH2_DEVICE_CODE_FLOW_TIMEOUT
      Config property name ("nessie.authentication.oauth2.device-code-flow.timeout") for the OAuth2 authentication provider. How long the client should wait for the device code flow to complete. This is only used if the grant type to use is "device_code". Optional, defaults to "PT5M".
      See Also:

    • DEFAULT_DEVICE_CODE_FLOW_TIMEOUT

      public static final String DEFAULT_DEVICE_CODE_FLOW_TIMEOUT
      See Also:

    • CONF_NESSIE_OAUTH2_DEVICE_CODE_FLOW_POLL_INTERVAL

      public static final String CONF_NESSIE_OAUTH2_DEVICE_CODE_FLOW_POLL_INTERVAL
      Config property name ("nessie.authentication.oauth2.device-code-flow.poll-interval") for the OAuth2 authentication provider. How often the client should poll the OAuth2 server for the device code flow to complete. This is only used if the grant type to use is "device_code". Optional, defaults to "PT5S".
      See Also:

    • DEFAULT_DEVICE_CODE_FLOW_POLL_INTERVAL

      public static final String DEFAULT_DEVICE_CODE_FLOW_POLL_INTERVAL
      See Also:

    • CONF_NESSIE_AWS_REGION

      public static final String CONF_NESSIE_AWS_REGION
      Config property name ("nessie.authentication.aws.region") for the region used for AWS authentication.
      See Also:

    • CONF_NESSIE_AWS_PROFILE

      public static final String CONF_NESSIE_AWS_PROFILE
      Config property name ("nessie.authentication.aws.profile") for the profile name used for AWS authentication (optional).
      See Also:

    • CONF_NESSIE_AUTH_TYPE

      public static final String CONF_NESSIE_AUTH_TYPE
      Config property name ("nessie.authentication.type") for the authentication provider ID. Valid values are BASIC, BEARER, OAUTH2 and AWS.

      The value is matched against the values returned by NessieAuthenticationProvider.getAuthTypeValue() of the available authentication providers.

      Note that "basic" HTTP authentication is not considered secure, use BEARER instead.

      See Also:

    • CONF_NESSIE_REF

      public static final String CONF_NESSIE_REF
      Config property name ("nessie.ref") for the nessie reference name used by clients, recommended setting.
      See Also:

    • CONF_NESSIE_REF_HASH

      public static final String CONF_NESSIE_REF_HASH
      Config property name ("nessie.ref.hash") for the nessie reference hash used by clients, optional setting.
      See Also:

    • CONF_NESSIE_TRACING

      public static final String CONF_NESSIE_TRACING
      Config property name ("nessie.tracing") to enable adding the HTTP headers of an active OpenTracing span to all Nessie requests. Valid values are true and false.
      See Also:

    • CONF_READ_TIMEOUT

      public static final String CONF_READ_TIMEOUT
      Config property name ("nessie.transport.read-timeout") for the network transport read-timeout, default is 25000.
      See Also:

    • CONF_CONNECT_TIMEOUT

      public static final String CONF_CONNECT_TIMEOUT
      Config property name ("nessie.transport.connect-timeout") for the network transport connect timeout in milliseconds, default is 5000.
      See Also:

    • CONF_NESSIE_DISABLE_COMPRESSION

      public static final String CONF_NESSIE_DISABLE_COMPRESSION
      Config property name ("nessie.transport.disable-compression") to disable compression on the network layer, if set to true.
      See Also:

    • CONF_NESSIE_CLIENT_NAME

      public static final String CONF_NESSIE_CLIENT_NAME
      Config property name ("nessie.client-builder-name") for custom client builder name.
      See Also:

    • CONF_NESSIE_CLIENT_BUILDER_IMPL

      @Deprecated public static final String CONF_NESSIE_CLIENT_BUILDER_IMPL
      Deprecated.
      Prefer using Nessie client implementation names, configured via CONF_NESSIE_CLIENT_NAME.
      Config property name ("nessie.client-builder-impl") for custom client builder class name.
      See Also:

    • CONF_NESSIE_SSL_CIPHER_SUITES

      public static final String CONF_NESSIE_SSL_CIPHER_SUITES
      Optional, list of comma-separated cipher suites for SSL connections, see SSLParameters.setCipherSuites(String[]).

      This parameter only works on Java 11 and newer.

      See Also:

    • CONF_NESSIE_SSL_PROTOCOLS

      public static final String CONF_NESSIE_SSL_PROTOCOLS
      Optional, list of comma-separated protocols for SSL connections, see SSLParameters.setProtocols(String[]).

      This parameter only works on Java 11 and newer.

      See Also:

    • CONF_NESSIE_SNI_HOSTS

      public static final String CONF_NESSIE_SNI_HOSTS
      Optional, the SNI host names for SSL connections, see SSLParameters.setServerNames(List).

      Takes a comma-separated list of SNI hostnames.

      This parameter only works on Java 11 and newer.

      See Also:

    • CONF_NESSIE_SNI_MATCHER

      public static final String CONF_NESSIE_SNI_MATCHER
      Optional, a single SNI matcher for SSL connections, see SSLParameters.setSNIMatchers(Collection).

      Takes a single SNI hostname matcher, a regular expression representing the SNI hostnames to match.

      This parameter only works on Java 11 and newer.

      See Also:

    • CONF_NESSIE_HTTP_2

      public static final String CONF_NESSIE_HTTP_2
      Optional, allow HTTP/2 upgrade, if set to true.

      This parameter only works on Java 11 and newer.

      See Also:

    • CONF_NESSIE_HTTP_REDIRECT

      public static final String CONF_NESSIE_HTTP_REDIRECT
      Optional, specify how redirects are handled.

      See HttpClient.Redirect, possible values:

      • NEVER: Never redirect.
      • ALWAYS: Always redirect.
      • NORMAL: Always redirect, except from HTTPS URLs to HTTP URLs.

      This parameter only works on Java 11 and newer.

      See Also:

    • CONF_FORCE_URL_CONNECTION_CLIENT

      public static final String CONF_FORCE_URL_CONNECTION_CLIENT
      Optional, when running on Java 11 force the use of the old URLConnection based client for HTTP, if set to true.

      This parameter only works on Java 11 and newer.

      See Also:

    • CONF_ENABLE_API_COMPATIBILITY_CHECK

      public static final String CONF_ENABLE_API_COMPATIBILITY_CHECK
      Enables API compatibility check when creating the Nessie client. The default is true.

      You can also control this setting by setting the system property nessie.client.enable-api-compatibility-check to true or false.

      See Also:

    • DEFAULT_READ_TIMEOUT_MILLIS

      public static final int DEFAULT_READ_TIMEOUT_MILLIS
      See Also:

    • DEFAULT_CONNECT_TIMEOUT_MILLIS

      public static final int DEFAULT_CONNECT_TIMEOUT_MILLIS
      See Also: