Skip to content

OpenID integration (stateless authentication)

OpenID is for those who want to manage their Matillion ETL users via the in-instance User Configuration dialog and require no external services. Using OpenID removes the ability to use LDAP and so those following the advice in this section should ignore the advice in the similar LDAP integration** documentation.

  1. SSH into your Matillion ETL instance.
  2. Open the following file for editing: /usr/share/emerald/WEB-INF/classes/Emerald.properties.

  3. Ensure the following variables are set:

    Property Example Value Notes
    DEFAULT_TOMCAT_USER_USERNAME <username> If deleted manually, this user will be recreated upon restarting the instance(s).
    DEFAULT_TOMCAT_USER_PASSWORD <password> Desired default user's password.
    STATELESS_CONFIGURATION Must be set to true
    STATELESS_OPENID_ENABLE true This property must be set to true
    STATELESS_OPENID_PROVIDER GENERIC Valid values are: GENERIC, AZURE, GOOGLE, MICROSOFT and OKTA.
    STATELESS_PROTOCOL_TYPE HTTPS Valid values are: HTTP, HTTPS and BOTH.
    STATELESS_OPENID_ENDPOINT https://<idp-fqdn>/... The chosen OpenID Identity Provider's base URL.
    STATELESS_OPENID_ID <client-id> Usually referred to as the "client ID".
    SEC_STATELESS_OPENID_SECRET <client-secret> Usually referred to as the "client secret" or "secret value".
    STATELESS_OPENID_SCOPE <open-id-scope> See the documentation for each provider's suggested/default scope.
    STATELESS_OPENID_ATTRIBUTE <open-id-attributes> See the documentation for each provider's suggested/default attribute.
    VARIABLE_AUTHENTICATION Must be set to true

  4. Save and close the file.

  5. Open the following file for editing: /etc/sysconfig/tomcat.

  6. Ensure the following variables are set:

    MTLN_PERSISTENCE_URL_POSTGRES="jdbc:postgresql://<DatabaseAddress>:<Port>/DatabaseName"
MTLN_PERSISTENCE_USERNAME_POSTGRES=<username>
MTLN_PERSISTENCE_PASSWORD_POSTGRES=<password>

    Where the MTLN_PERSISTENCE_URL_POSTGRES address points to the fully qualified domain name (FQDN) of your persistence database and a port may or may not be required, depending on your setup. HA/clustered deployments will be required to provide details for their external Postgres database. For single-node deployments, this database is typically on the instance itself and should have the following values:

    MTLN_PERSISTENCE_URL_POSTGRES="jdbc:postgresql://127.0.0.1/postgres"
MTLN_PERSISTENCE_USERNAME_POSTGRES=postgres
MTLN_PERSISTENCE_PASSWORD_POSTGRES=postgres

  7. Save and close the file.

  8. The tomcat service must be restarted for your changes to take effect: 
systemctl restart tomcat
  1. You can now add users in the Admin → User Configuration menu.