nevisidm-dbschema Usage and Configuration

Introduction

The nevisidm-dbschema docker image is mainly prepared for nevisAdmin4 deployments, but it can be used to prepare and upgrade nevisIDM database schema directly.

The nevisidm-dbschema image is essentially the nevisidmdb tool installed on a standard lightweight Linux operating system in a Docker environment, which must be started slightly differently than the nevisidmdb tool.

The image can be configured using environment variables and mounted volumes. Using the environment variables, the Docker image’s startup script creates the nevisidmdb.properties configuration file and then passes the parameters to start the nevisidmdb.

There are several ways to instantiate the Docker image (this list is not exhaustive):

• Creating a Docker container from the command line
• Creating a Docker container using Docker Compose
• Creating a pod in a Kubernetes cluster

Environment variables

• IDMDB_CONNECTION: Connection URL to the target database.
  • Example: jdbc:mariadb://database/nevisidm
  • Mandatory: yes
• MARIADB_SETUP_URL: URL for creating the nevisidm database on MariaDB.
  • Example: jdbc:mariadb://database/mysql
  • Mandatory: only if setting up database on MariaDB.
• POSTGRESQL_SETUP_URL: URL for creating the nevisidm database on PostgreSQL.
  • Example: jdbc:postgresql://database/postgres
  • Mandatory: only if setting up database on PostgreSQL.
• POSTGRESQL_SETUP_PERMISSIONS_URL: URL for setting up permissions on PostgreSQL.
  • Example: jdbc:postgresql://database/nevisidm
  • Mandatory: only if setting up database on PostgreSQL.
• DBOWNER_NAME: Database schema administrator user's name.
  • Example: UIDM01
  • Mandatory: yes
• DBOWNER_PASSWORD: Database schema administrator user's password.
  • Mandatory: yes
• DBUSER_NAME: Application database user's name.
  • Example: UIDM02
  • Mandatory: only if setting up database roles.
• DBUSER_PASSWORD: Application database user's password.
  • Mandatory: only if setting up database roles.
• DBSYSTEM_NAME: System administrator database user to create schema administrator and application users and roles.
  • Example: root
  • Mandatory: only if setting up database.
• DBSYSTEM_PASSWORD: Password for system administrator user on the database.
  • Mandatory: only if setting up database.
• ROLE_APPL: Application user's role to grant schema owner's DB objects to the application user.
  • Example: RL_IDM_APPL
  • Mandatory: yes
• ROLE_ADM: Schema administrator user's role.
  • Example: RL_IDM_ADM
  • Mandatory: only if setting up database roles.
• DBTS_INDEX: Tablespace name for indexes.
  • Example: INDEX_IDM_DEV
  • Mandatory: only if you want to specify tablespace for indexes.
• DBTS_DATA: Tablespace name for table objects.
  • Example: DATA_IDM_DEV
  • Mandatory: only if you want to specify tablespace for tables.
• MULTICLIENT_MODE: Boolean value to enable the creation of a multi-client database schema.
  • Example: true
  • Mandatory: only for creating initial data for the schema.
• TZ: Timezone for database.
  • Example: UTC
  • Mandatory: only if setting up database.

Volumes

• Oracle JDBC driver: since the nevisidm-dbschema cannot use Oracle JDBC driver by default, it needs to be attached as volume.
  • Example path on host: /opt/oracle/product/19c/dbhome_1/jdbc/lib/ojdbc11.jar
  • Path on container/pod: /opt/nevisidmdb/lib/ojdbc11.jar
  • Read/write option: ro
• Logging directory: depending on the logging configuration, you can specify volume to write logging messages to the file system instead of standard output of Kubernetes cluster or Docker.
  • Example path on host: /opt/nevisidmdb/log
  • Path on container/pod: /var/opt/nevisidmdb/log
  • Read/write option: rw
• Special environment configuration: If you want to specify custom environment variables for the nevisidmdb, you can attach a custom env.conf file (with, for example, a VERBOSE=1 setting to enable additional debug logging).
  • Example path on host: /opt/nevisidmdb/env.conf
  • Path on container/pod: /opt/nevisidmdb/template/env.conf
  • Read/write option: ro
• Any required library: If you need special Java library (e.g. test data), you can attach as volume.
  • Example path on host: /opt/nevisidmdb/testdata.jar
  • Path on container/pod: /opt/nevisidmdb/lib/testdata.jar
  • Read/write option: ro

Entry point

If you want to pass parameters to the good-old nevisidmdb execution, you need to pass dev as first argument to the nevis-dbschema image entry point to activate development mode. By that, all the rest of the arguments will be passed directly to the nevisidmdb tool.

Sample compose configuration

services:
  nevisidmdb:
    image: your-image-repo.host/nevissecurity/nevisidm-dbschema:9.2611.0
    user: 0
    environment:
      - IDMDB_CONNECTION=jdbc:mariadb://database/nevisidm
      - MARIADB_SETUP_URL=jdbc:mariadb://database/mysql
      - DBOWNER_NAME=UIDM01
      - DBOWNER_PASSWORD=UIDM01
      - DBUSER_NAME=UIDM02
      - DBUSER_PASSWORD=UIDM02
      - DBSYSTEM_NAME=root
      - DBSYSTEM_PASSWORD=root
      - ROLE_APPL=RL_IDM_APPL
      - ROLE_ADM=RL_IDM_ADM
      - DBTS_INDEX=INDEX_IDM_DEV
      - DBTS_DATA=DATA_IDM_DEV
      - MULTICLIENT_MODE=true
      - TZ=UTC
    entrypoint: /bin/sh
    command: nevis-dbschema dev setup migrate
    volumes:
      - "/var/opt/nevisidmdb/log:/var/opt/nevisidmdb/log:rw"
      - "/opt/oracle/product/19c/dbhome_1/jdbc/lib/ojdbc11.jar:/opt/nevisidmdb/lib/ojdbc11.jar:ro"