Runtime properties configure the connection to Topaz. Properties marked with a lock are fixed at build time: the health check switch, the Dev Service settings, and the security read-body and permissions.enabled switches.

api-key, tls-configuration-name, plain-text and deadline can be set once under quarkus.topaz. and overridden per service under quarkus.topaz.authorizer. or quarkus.topaz.directory.*.

Client, Dev Service and health

Configuration property fixed at build time - All other configuration properties are overridable at runtime

Configuration property

Type

Default

quarkus.topaz.health.enabled

Whether a readiness health check for Topaz is published when a SmallRye Health extension is present.

Environment variable: QUARKUS_TOPAZ_HEALTH_ENABLED

boolean

true

quarkus.topaz.devservices.enabled

Whether Dev Services for Topaz is enabled. It is skipped anyway when quarkus.topaz.authorizer.host or quarkus.topaz.directory.host is set, or when no container runtime is available.

Environment variable: QUARKUS_TOPAZ_DEVSERVICES_ENABLED

boolean

true

quarkus.topaz.devservices.image-name

The Topaz container image. Defaults to the image this extension was tested with.

Environment variable: QUARKUS_TOPAZ_DEVSERVICES_IMAGE_NAME

string

quarkus.topaz.devservices.shared

Whether the container is shared between applications in dev mode. A shared container is found through the quarkus-dev-service-topaz label and is not re-seeded.

Environment variable: QUARKUS_TOPAZ_DEVSERVICES_SHARED

boolean

true

quarkus.topaz.devservices.service-name

Value of the quarkus-dev-service-topaz label, used to find a shared container.

Environment variable: QUARKUS_TOPAZ_DEVSERVICES_SERVICE_NAME

string

topaz

quarkus.topaz.devservices.policy.directory

Directory of Rego files mounted as a local bundle, as classpath:, filesystem: or a plain path. Mutually exclusive with image.

Environment variable: QUARKUS_TOPAZ_DEVSERVICES_POLICY_DIRECTORY

string

quarkus.topaz.devservices.policy.image

OCI policy image pulled from ghcr.io, e.g. ghcr.io/aserto-policies/policy-todo:latest. Mutually exclusive with directory.

Environment variable: QUARKUS_TOPAZ_DEVSERVICES_POLICY_IMAGE

string

quarkus.topaz.devservices.manifest-location

Location of a directory manifest YAML loaded after start, as classpath:, filesystem: or a plain path.

Environment variable: QUARKUS_TOPAZ_DEVSERVICES_MANIFEST_LOCATION

string

quarkus.topaz.devservices.data-location

Location of a directory holding objects.json and/or relations.json imported after start, as classpath:, filesystem: or a plain path.

Environment variable: QUARKUS_TOPAZ_DEVSERVICES_DATA_LOCATION

string

quarkus.topaz.devservices.api-key

When set, the container requires this API key (except for Info and gRPC reflection) and the application is configured to send it.

Environment variable: QUARKUS_TOPAZ_DEVSERVICES_API_KEY

string

quarkus.topaz.devservices.container-env."env-name"

Environment variables passed to the container.

Environment variable: QUARKUS_TOPAZ_DEVSERVICES_CONTAINER_ENV__ENV_NAME_

Map<String,String>

quarkus.topaz.devservices.console-enabled

Whether the Topaz console is exposed; its URL is set as quarkus.topaz.console-url.

Environment variable: QUARKUS_TOPAZ_DEVSERVICES_CONSOLE_ENABLED

boolean

true

quarkus.topaz.api-key

API key sent to both services unless overridden per service.

Environment variable: QUARKUS_TOPAZ_API_KEY

string

quarkus.topaz.tls-configuration-name

Name of the Quarkus TLS configuration used for both services unless overridden per service.

Environment variable: QUARKUS_TOPAZ_TLS_CONFIGURATION_NAME

string

quarkus.topaz.plain-text

Whether to use plaintext (no TLS) connections, unless overridden per service.

Environment variable: QUARKUS_TOPAZ_PLAIN_TEXT

boolean

quarkus.topaz.tenant-id

Tenant id sent to Topaz.

Environment variable: QUARKUS_TOPAZ_TENANT_ID

string

quarkus.topaz.deadline

Default deadline for calls, unless overridden per service.

Environment variable: QUARKUS_TOPAZ_DEADLINE

Duration 

quarkus.topaz.console-url

URL of the Topaz console; set by Dev Services, not read by the client.

Environment variable: QUARKUS_TOPAZ_CONSOLE_URL

string

quarkus.topaz.authorizer.host

Host of the service.

Environment variable: QUARKUS_TOPAZ_AUTHORIZER_HOST

string

localhost

quarkus.topaz.authorizer.port

Port of the service; defaults to 8282 for the authorizer and 9292 for the directory.

Environment variable: QUARKUS_TOPAZ_AUTHORIZER_PORT

int

quarkus.topaz.authorizer.api-key

API key for this service.

Environment variable: QUARKUS_TOPAZ_AUTHORIZER_API_KEY

string

quarkus.topaz.authorizer.tls-configuration-name

Name of the Quarkus TLS configuration for this service.

Environment variable: QUARKUS_TOPAZ_AUTHORIZER_TLS_CONFIGURATION_NAME

string

quarkus.topaz.authorizer.plain-text

Whether to use a plaintext (no TLS) connection to this service.

Environment variable: QUARKUS_TOPAZ_AUTHORIZER_PLAIN_TEXT

boolean

quarkus.topaz.authorizer.deadline

Deadline for calls to this service.

Environment variable: QUARKUS_TOPAZ_AUTHORIZER_DEADLINE

Duration 

quarkus.topaz.directory.host

Host of the service.

Environment variable: QUARKUS_TOPAZ_DIRECTORY_HOST

string

localhost

quarkus.topaz.directory.port

Port of the service; defaults to 8282 for the authorizer and 9292 for the directory.

Environment variable: QUARKUS_TOPAZ_DIRECTORY_PORT

int

quarkus.topaz.directory.api-key

API key for this service.

Environment variable: QUARKUS_TOPAZ_DIRECTORY_API_KEY

string

quarkus.topaz.directory.tls-configuration-name

Name of the Quarkus TLS configuration for this service.

Environment variable: QUARKUS_TOPAZ_DIRECTORY_TLS_CONFIGURATION_NAME

string

quarkus.topaz.directory.plain-text

Whether to use a plaintext (no TLS) connection to this service.

Environment variable: QUARKUS_TOPAZ_DIRECTORY_PLAIN_TEXT

boolean

quarkus.topaz.directory.deadline

Deadline for calls to this service.

Environment variable: QUARKUS_TOPAZ_DIRECTORY_DEADLINE

Duration 
About the Duration format

To write duration values, use the standard java.time.Duration format. See the Duration#parse() Java API documentation for more information.

You can also use a simplified format, starting with a number:

  • If the value is only a number, it represents time in seconds.

  • If the value is a number followed by ms, it represents time in milliseconds.

In other cases, the simplified format is translated to the java.time.Duration format for parsing:

  • If the value is a number followed by h, m, or s, it is prefixed with PT.

  • If the value is a number followed by d, it is prefixed with P.

Security

The quarkus.topaz.enforcement.* properties come from quarkus-topaz-security; see Security.

Configuration property fixed at build time - All other configuration properties are overridable at runtime

Configuration property

Type

Default

quarkus.topaz.enforcement.read-body

Whether the request body is read and made available to the policy.

Environment variable: QUARKUS_TOPAZ_ENFORCEMENT_READ_BODY

boolean

false

quarkus.topaz.enforcement.permissions.enabled

Whether permission-based checks are enabled.

Environment variable: QUARKUS_TOPAZ_ENFORCEMENT_PERMISSIONS_ENABLED

boolean

false

quarkus.topaz.enforcement.policy-root

The policy root (Rego package prefix) that decisions are evaluated under.

Environment variable: QUARKUS_TOPAZ_ENFORCEMENT_POLICY_ROOT

string

quarkus.topaz.enforcement.decision

The name of the decision that must be true for a request to be allowed.

Environment variable: QUARKUS_TOPAZ_ENFORCEMENT_DECISION

string

allowed

quarkus.topaz.enforcement.additional-decisions

Further decisions to request from the authorizer alongside the main one.

Environment variable: QUARKUS_TOPAZ_ENFORCEMENT_ADDITIONAL_DECISIONS

list of string

quarkus.topaz.enforcement.anonymous

What to do with requests that carry no identity.

Environment variable: QUARKUS_TOPAZ_ENFORCEMENT_ANONYMOUS

deny, evaluate

deny

quarkus.topaz.enforcement.timeout

The deadline for a whole evaluation: the mappers (identity, policy path, resource context) and the Topaz call together, not each call separately. An evaluation that exceeds it is denied.

Environment variable: QUARKUS_TOPAZ_ENFORCEMENT_TIMEOUT

Duration 

5S
About the Duration format

To write duration values, use the standard java.time.Duration format. See the Duration#parse() Java API documentation for more information.

You can also use a simplified format, starting with a number:

  • If the value is only a number, it represents time in seconds.

  • If the value is a number followed by ms, it represents time in milliseconds.

In other cases, the simplified format is translated to the java.time.Duration format for parsing:

  • If the value is a number followed by h, m, or s, it is prefixed with PT.

  • If the value is a number followed by d, it is prefixed with P.

Zanzibar connector

The quarkus.topaz.zanzibar.* property comes from quarkus-topaz-zanzibar; see Zanzibar connector.

Configuration property fixed at build time - All other configuration properties are overridable at runtime

Configuration property

Type

Default

quarkus.topaz.zanzibar.default-user-type

Subject type used when quarkus-zanzibar hands over a relationship whose user type is blank. The filter does that only on the quarkus.zanzibar.filter.unauthenticated-user path, for an endpoint without @FGAUserType; the value also applies to a relationship with a blank user type passed to the RelationshipManager directly. It does not give an authenticated caller a type: quarkus-zanzibar takes that from the principal name (type:id), then a single role, then @FGAUserType, and treats the caller as unauthenticated when none of them gives one.

Environment variable: QUARKUS_TOPAZ_ZANZIBAR_DEFAULT_USER_TYPE

string

user