Configuration Reference

Runtime properties configure the connection to Topaz. A lock marks the properties that Quarkus fixes at build time:

  • The health check switch.

  • The Dev Service settings.

  • The security read-body and permissions.enabled switches.

Set api-key, tls-configuration-name, plain-text and deadline once under quarkus.topaz.. Override them per service under quarkus.topaz.authorizer. or quarkus.topaz.directory.*.

Client, Dev Service and health

Configuration property fixed at build time - All other configuration properties are overridable at runtime

Configuration property

Type

Default

quarkus.topaz.health.enabled

Whether a readiness health check for Topaz is published when a SmallRye Health extension is present.

Environment variable: QUARKUS_TOPAZ_HEALTH_ENABLED

boolean

true

quarkus.topaz.devservices.enabled

Whether Dev Services for Topaz is enabled. It is skipped anyway when quarkus.topaz.authorizer.host or quarkus.topaz.directory.host is set. It is also skipped when no container runtime is available.

Environment variable: QUARKUS_TOPAZ_DEVSERVICES_ENABLED

boolean

true

quarkus.topaz.devservices.image-name

The Topaz container image. It defaults to the image this extension was tested with.

Environment variable: QUARKUS_TOPAZ_DEVSERVICES_IMAGE_NAME

string

quarkus.topaz.devservices.shared

Whether the container is shared between applications in dev mode. A shared container is found through the quarkus-dev-service-topaz label. Dev Services does not seed it again.

Environment variable: QUARKUS_TOPAZ_DEVSERVICES_SHARED

boolean

true

quarkus.topaz.devservices.service-name

Value of the quarkus-dev-service-topaz label, used to find a shared container.

Environment variable: QUARKUS_TOPAZ_DEVSERVICES_SERVICE_NAME

string

topaz

quarkus.topaz.devservices.policy.directory

Directory of Rego files mounted as a local bundle. Use classpath:, filesystem: or a plain path. It excludes image.

Environment variable: QUARKUS_TOPAZ_DEVSERVICES_POLICY_DIRECTORY

string

quarkus.topaz.devservices.policy.image

OCI policy image pulled from ghcr.io, for example ghcr.io/aserto-policies/policy-todo:latest. It excludes directory.

Environment variable: QUARKUS_TOPAZ_DEVSERVICES_POLICY_IMAGE

string

quarkus.topaz.devservices.manifest-location

Location of a directory manifest YAML that Dev Services loads after the start. Use classpath:, filesystem: or a plain path.

Environment variable: QUARKUS_TOPAZ_DEVSERVICES_MANIFEST_LOCATION

string

quarkus.topaz.devservices.data-location

Location of a directory that holds objects.json, relations.json or both. Dev Services imports them after the start. Use classpath:, filesystem: or a plain path.

Environment variable: QUARKUS_TOPAZ_DEVSERVICES_DATA_LOCATION

string

quarkus.topaz.devservices.api-key

The API key of the container. When set, the container requires this API key for every call except Info and gRPC reflection. The application is configured to send it.

Environment variable: QUARKUS_TOPAZ_DEVSERVICES_API_KEY

string

quarkus.topaz.devservices.container-env."env-name"

Environment variables passed to the container.

Environment variable: QUARKUS_TOPAZ_DEVSERVICES_CONTAINER_ENV__ENV_NAME_

Map<String,String>

quarkus.topaz.devservices.console-enabled

Whether the Topaz console is exposed. Dev Services sets its URL as quarkus.topaz.console-url.

Environment variable: QUARKUS_TOPAZ_DEVSERVICES_CONSOLE_ENABLED

boolean

true

quarkus.topaz.api-key

API key sent to both services unless overridden per service.

Environment variable: QUARKUS_TOPAZ_API_KEY

string

quarkus.topaz.tls-configuration-name

Name of the Quarkus TLS configuration used for both services unless overridden per service.

Environment variable: QUARKUS_TOPAZ_TLS_CONFIGURATION_NAME

string

quarkus.topaz.plain-text

Whether to use plaintext (no TLS) connections, unless overridden per service.

Environment variable: QUARKUS_TOPAZ_PLAIN_TEXT

boolean

quarkus.topaz.tenant-id

Tenant id sent to Topaz.

Environment variable: QUARKUS_TOPAZ_TENANT_ID

string

quarkus.topaz.deadline

Default deadline for calls, unless overridden per service.

Environment variable: QUARKUS_TOPAZ_DEADLINE

Duration 

quarkus.topaz.console-url

URL of the Topaz console; set by Dev Services, not read by the client.

Environment variable: QUARKUS_TOPAZ_CONSOLE_URL

string

quarkus.topaz.authorizer.host

Host of the service.

Environment variable: QUARKUS_TOPAZ_AUTHORIZER_HOST

string

localhost

quarkus.topaz.authorizer.port

Port of the service. It defaults to 8282 for the authorizer and 9292 for the directory.

Environment variable: QUARKUS_TOPAZ_AUTHORIZER_PORT

int

quarkus.topaz.authorizer.api-key

API key for this service.

Environment variable: QUARKUS_TOPAZ_AUTHORIZER_API_KEY

string

quarkus.topaz.authorizer.tls-configuration-name

Name of the Quarkus TLS configuration for this service.

Environment variable: QUARKUS_TOPAZ_AUTHORIZER_TLS_CONFIGURATION_NAME

string

quarkus.topaz.authorizer.plain-text

Whether to use a plaintext (no TLS) connection to this service.

Environment variable: QUARKUS_TOPAZ_AUTHORIZER_PLAIN_TEXT

boolean

quarkus.topaz.authorizer.deadline

Deadline for calls to this service.

Environment variable: QUARKUS_TOPAZ_AUTHORIZER_DEADLINE

Duration 

quarkus.topaz.directory.host

Host of the service.

Environment variable: QUARKUS_TOPAZ_DIRECTORY_HOST

string

localhost

quarkus.topaz.directory.port

Port of the service. It defaults to 8282 for the authorizer and 9292 for the directory.

Environment variable: QUARKUS_TOPAZ_DIRECTORY_PORT

int

quarkus.topaz.directory.api-key

API key for this service.

Environment variable: QUARKUS_TOPAZ_DIRECTORY_API_KEY

string

quarkus.topaz.directory.tls-configuration-name

Name of the Quarkus TLS configuration for this service.

Environment variable: QUARKUS_TOPAZ_DIRECTORY_TLS_CONFIGURATION_NAME

string

quarkus.topaz.directory.plain-text

Whether to use a plaintext (no TLS) connection to this service.

Environment variable: QUARKUS_TOPAZ_DIRECTORY_PLAIN_TEXT

boolean

quarkus.topaz.directory.deadline

Deadline for calls to this service.

Environment variable: QUARKUS_TOPAZ_DIRECTORY_DEADLINE

Duration 
About the Duration format

To write duration values, use the standard java.time.Duration format. See the Duration#parse() Java API documentation for more information.

You can also use a simplified format, starting with a number:

  • If the value is only a number, it represents time in seconds.

  • If the value is a number followed by ms, it represents time in milliseconds.

In other cases, the simplified format is translated to the java.time.Duration format for parsing:

  • If the value is a number followed by h, m, or s, it is prefixed with PT.

  • If the value is a number followed by d, it is prefixed with P.

Security

The quarkus.topaz.enforcement.* properties come from quarkus-topaz-security. See Security.

Configuration property fixed at build time - All other configuration properties are overridable at runtime

Configuration property

Type

Default

quarkus.topaz.enforcement.read-body

Get whether the request body is read and made available to the policy.

Environment variable: QUARKUS_TOPAZ_ENFORCEMENT_READ_BODY

boolean

false

quarkus.topaz.enforcement.permissions.enabled

Get whether permission-based checks are enabled.

Environment variable: QUARKUS_TOPAZ_ENFORCEMENT_PERMISSIONS_ENABLED

boolean

false

quarkus.topaz.enforcement.policy-root

Get the policy root, which is the Rego package prefix that decisions are evaluated under.

Environment variable: QUARKUS_TOPAZ_ENFORCEMENT_POLICY_ROOT

string

quarkus.topaz.enforcement.decision

Get the name of the decision that must be true for a request to be allowed.

Environment variable: QUARKUS_TOPAZ_ENFORCEMENT_DECISION

string

allowed

quarkus.topaz.enforcement.additional-decisions

Get the further decisions to request from the authorizer alongside the main one.

Environment variable: QUARKUS_TOPAZ_ENFORCEMENT_ADDITIONAL_DECISIONS

list of string

quarkus.topaz.enforcement.anonymous

Get what to do with requests that carry no identity.

Environment variable: QUARKUS_TOPAZ_ENFORCEMENT_ANONYMOUS

deny, evaluate

deny

quarkus.topaz.enforcement.timeout

Get the deadline for a whole evaluation.

The deadline covers the mappers (identity, policy path and resource context) and the Topaz call together. It does not apply to each call separately. An evaluation that exceeds it is denied.

Environment variable: QUARKUS_TOPAZ_ENFORCEMENT_TIMEOUT

Duration 

5S
About the Duration format

To write duration values, use the standard java.time.Duration format. See the Duration#parse() Java API documentation for more information.

You can also use a simplified format, starting with a number:

  • If the value is only a number, it represents time in seconds.

  • If the value is a number followed by ms, it represents time in milliseconds.

In other cases, the simplified format is translated to the java.time.Duration format for parsing:

  • If the value is a number followed by h, m, or s, it is prefixed with PT.

  • If the value is a number followed by d, it is prefixed with P.

Zanzibar connector

The quarkus.topaz.zanzibar.* property comes from quarkus-topaz-zanzibar. See Zanzibar connector.

Configuration property fixed at build time - All other configuration properties are overridable at runtime

Configuration property

Type

Default

quarkus.topaz.zanzibar.default-user-type

The subject type for a relationship whose user type is blank.

quarkus-zanzibar hands over such a relationship on the quarkus.zanzibar.filter.unauthenticated-user path, for an endpoint without @FGAUserType. The value also applies to a relationship with a blank user type passed to the RelationshipManager directly. It does not give an authenticated caller a type. quarkus-zanzibar takes that type from the principal name (type:id), then a single role, then @FGAUserType. It treats the caller as unauthenticated when none of them gives one.

Environment variable: QUARKUS_TOPAZ_ZANZIBAR_DEFAULT_USER_TYPE

string

user