[App_Service]

ads_domainname

The domain name of the Active Directory domain. Example: sample.com. This is only used when configuring Active Directory security.

ads_groupname

This was used when configuring Active Directory Legacy mode security; this mode is no longer supported.

ads_base_fqdn

Active Directory Fully Qualified Domain Name

Example : DC=ad,DC=sample,DC=com

This must match the distinguishedName of your Active Directory Domain.

ads_groupdn

This was used when configuring Active Directory Legacy mode security; this mode is no longer supported.

ads_ouname

This was used when configuring Active Directory Legacy mode security; this mode is no longer supported.

ads_trust_policy

Active Directory Security Trust Policy. Used when configuring Active Directory Delegate mode security. Defines the way security certificates are processed when connecting to an Active Directory Domain Controller.

 The value trustAll allows connection to an Active Directory Domain Controller regardless of the security certificate it presents.

 The value trustNone allows connection to an Active Directory Domain Controller only if the security certificate it presents is listed in the truststore.

ads_hostname

Active Directory Security Host Name. Used when configuring Active Directory delegate mode security. Defines the DNS names of one or more Active Directory Domain Controllers, or if the Active Directory Domain Controllers are referenced by the domain name, that domain name. The SecurityConfig program sets this based on your configuration information.

ads_max_group_recursion

Active Directory Security Maximum Group Recursion. Used when configuring Active Directory delegate mode security. Defines the depth limit that is searched to find a user's group affiliation. This can be set if there are large numbers of AD groups and the response time to AD Domain Controllers is slow. Defaults to 3.

ads_monitor_delay

Active Directory Security Monitor Delay. Used when configuring Active Directory Delegate mode security. Controls the length of time (in seconds) between checks on the health of an Active Directory Domain Controller.

Defaults to 30 seconds.

This is a tuning parameter and generally should not be modified.

ads_monitor_threads

Active Directory Security Monitor Thread Count. Used when configuring Active Directory Delegate mode security. Controls the number of threads used to monitor the Active Directory Domain Controllers.

Defaults to 10.

This is a tuning parameter and generally should not be modified.

ads_port

Used when configuring Active Directory Delegate mode security. Must be set to 636 if using SSL (recommended) to connect to Active Directory Domain Controllers; set to 389 if not using SSL. The SecurityConfig program sets this based on your configuration information.

ads_security

Active Directory Security Transport Type. Used when configuring Active Directory Delegate mode security. Set to NONE, SSL, SASL, or SSL+SASL. Controls the protocol used to connect to Active Directory Domain Controllers. The SecurityConfig program sets this based on your configuration information.

agent_status_delay

Default: 5. Time, in seconds, to delay agent status updates.

Before editing this setting, contact BMC Support.

agent_status_pool_size

Default: 8. Number of threads in the agent status executor pool.

Before editing this setting, contact BMC Support.

company_name

Used with the execution key to determine product licensing.

client_port

Default:15005. Defines the port that the Monitor Console client connects to.

config_files=jetty/qpas.xml jetty/apache-ds.xml

Defines the config files used to configure jetty. By default it starts the main TMTM Application Service applications including the apache LDAP server. When running with Active Directory authentication, the jetty/apache-ds.xml can be removed.

doc_home

This allows a user to override the location of the online Documents directory. It defaults to the install directory.

execution_key

Used with the company_name to determine product licensing.

force_client_to_server_timezone

When set to TRUE, forces clients to use the server's timezone. Useful for instances where clients are in a different timezone than the server to avoid gaps in queried report data. The timezone in use by the client is displayed on the clock in the lower right-hand corner of the client window.

hostname

Default: localhost. Defines the host name or IP address of the computer on which the TMTM Application Service runs.

jaas_config_file=jetty/apache-ds_jaas.config

This allows a user to override the name of the Java JAAS config file used for configuring java application security. It defaults to the configuration for the IETF user authentication. The user overrides this in order to set up Active Directory authentication. The name refers to a file in the jetty directory.

java.naming.security.credentials=D;5iKGpSZ3

Defines the password used to start and stop the LDAP service. It needs to be changed whenever the user runs the setadminpw script to match the new password.

java.naming.security.principal=uid=admin,ou=system

Defines the internal user id used to start and stop the LDAP service. It should not normally be changed.

javax.net.ssl.trustStore

Default: ldapsTruststore.jks

This is a java keystore containing certificates of trusted directory servers.

The LDAP Directory Service internal to the product always has an entry in this keystore. A trusted entry for the self-signed certificate is added when the certificate is generated (see ldaps_keystore). Entries for trusted Active Directory servers are also stored in here.

The Security Config tool can be used to populate this keystore.

javax.net.ssl.trustStorePassword

Default: BMCSOFTWARE (stored in obfuscated format).

The password for the javax.net.ssl.trustStore java keystore file. The password may be in plain text or obfuscated in "Cryptor" format using mqsusertool to encode a plain text password. The Security Config tool can be used to set this.

jetty_home=jetty

This allows a user to override the location of the jetty home directory. It defaults to the jetty directory in the install directory.

jetty_keystore=jetty/webapps/localhost.jks

A java keystore file containing the keys and certificate used to secure the HTTPS port (15004 by default).

Users may access the product launch page, reports or agent distributions using HTTPS.

A self-signed certificate is generated when the Application Service starts if the keystore file does not already exist.

See Post core component installation and configuration for more information.

jetty_keystore_keypassword=OBF:1fuk1kl61f9d1mrf1ldm1gu71ldw1mrn1f991klg1fuq

Defines the keystore key password used for the jetty_keystore file. See Post core component installation and configuration for more information.

jetty_keystore_password=OBF:1fuk1kl61f9d1mrf1ldm1gu71ldw1mrn1f991klg1fuq

Defines the keystore password used for the jetty_keystore file. See Post core component installation and configuration for more information.

ldap_base_fqdn=dc=mqsoftware,dc=com

This allows a user to override the base LDAP fully qualified domain name. It needs to be changed when using Active Directory authentication.

ldap_bind_dn

Active Directory Security Bind DN pattern. Used when configuring Active Directory Delegate mode security. Overrides the default bind DN pattern used to access the LDAP server. Before editing this setting, contact BMC Support.

ldap_user_dn

Active Directory Security User DN pattern. Used when configuring Active Directory Delegate mode security. Overrides the default user DN pattern used to access the LDAP server. Before editing this setting, contact BMC Support.

ldap_group_dn

Active Directory Security Group DN pattern. Used when configuring Active Directory Delegate mode security. Overrides the default group DN pattern used to access the LDAP server. Before editing this setting, contact BMC Support.

ldap_hostname

Default: localhost. When using Microsoft Active Directory it defines the host name or IP address of the computer on which Microsoft Active Directory runs. Otherwise it defines the host name where the product is installed. When integrating with TSMA located on another host, network interfaces are used by default to determine a hostname or IP address to configure TSMA so that it can connect to TMTM. If for some reason the hostname or IP address used is not reachable from the TSMA machine you can specify a hostname or IP address yourself by changing this keyword from localhost to a reachable hostname or IP address.

Default : ldapsKeystore.jks

A keystore that contains the key and certificate used for the LDAPS port.

A self-signed certificate is generated when the Application Service starts if the keystore file does not already exist.

Default : BMCSOFTWARE (stored in obfuscated format).

The password for the ldaps_keystore file. The password may be obfuscated in "Cryptor" format using mqsusertool to encode a plain text password.

ldap_port

Default:15008. Defines the port on which the TMTM Application Service connects to the internal directory service using LDAP.

ldap_schema

Default: "IETF", indicates the internal LDAP will be used for security.

 "Delegate" indicates Active Directory Delegate mode.

ldap_max_results

Default: 1000. Defines the maximum number of user entries that can be returned on an LDAP request.

secure_agent_distributions

web_port

Default:15007. Defines the port on which the TMTM Application Service listens.

web_secure_port

Default:15004. Defines the port on which the TMTM Application Service secure traffic travels.

client_protocols

Default: "TLSv1,TLSv1.1,TLSv1.2". Defines protocol used for clients.

client_ciphers

Default: "TLS_DH_anon_WITH_AES_128_CBC_SHA". Whitelist of ciphers that can be used with clients.

default_client_vm_args

No default. Used to define default JVM launch settings for Monitor Console clients, e.g. "-Dcom.bmc.mmpa.client_protocols=SSLv3" would restrict the initial client handshake to use SSLv3. Settings are cached on client machines. The client cache must be cleared to pick up changed settings (using the Java Control Panel).

default_client_min_memory

Defaults to "256m". Defines the default client VM initial heap size. Can be no lower than the default.

default_client_max_memory

Defaults to "512m". Defines the default client VM maximum heap size. Can be no larger than "8000m".

inject_agent_ts_host

Defaults to true. Indicates if agent bootstrap packages should have the TS host name injected. If set to false, the TS host name is not set in agent bootstrap packages.

Before editing this setting, contact BMC Support.