Configuration reference

This page lists every configuration property supported in deployment.yaml. Group headings correspond to top-level YAML keys. For configuration guidance and examples, see the Basic configuration page and the Configure section.

Engine mode

Property	Type	Default	Description
engine.mode	string	ads	Operating mode for ADS. Accepted values: ads, caq, ads_caq. The ads_caq mode is recommended only for POC or pre-production environments.
allowTrailingSlashAuthorize	boolean	false	When true, ADS accepts requests to the /authorize endpoint that include a trailing slash. Provided for compatibility with ADS 1.x clients.

License

Property	Type	Default	Description
license	string	-	Path or URL to the license file. Supports relative path, absolute path, or classpath: prefix. Required: ADS does not start without a valid license.
licenseExpirationWarning	duration	30 days	How far in advance ADS logs a warning before the license expires. Format: integer + unit (e.g., 30 days, 15d).

Server

Property	Type	Default	Description
server.port	integer	8080	HTTP port ADS listens on. Set to 8443 when enabling TLS.
server.ssl.enabled	boolean	false	Enables HTTPS on the server port.
server.ssl.key-store	string	-	Path to the keystore file (e.g., file:server_keystore.p12).
server.ssl.key-store-password	string	-	Password for the keystore.
server.ssl.key-store-type	string	-	Keystore format. Common values: PKCS12, JKS.
server.ssl.client-auth	string	none	Client certificate requirement. none = one-way TLS. need = mutual TLS (two-way).
server.ssl.trust-store	string	-	Path to the truststore file. Required for mutual TLS.
server.ssl.trust-store-password	string	-	Password for the truststore.
server.ssl.trust-store-type	string	-	Truststore format. Common values: PKCS12, JKS.

Domain

Property	Type	Default	Description
domain.path	string	-	Location of the authorization domain configuration file. Supports relative path, absolute path, classpath: prefix, and HTTP/HTTPS URL. Required.
domain.refreshInterval	duration	-	How often ADS polls the domain source for changes at runtime. Format: integer + unit (e.g., 10 seconds, 5 minutes). When omitted, ADS reads the domain once at startup.
domain.reportNotReadyOnDomainRefreshError	boolean	false	When true, ADS returns 503 Service Unavailable from its readiness probe if a domain refresh fails. Has no effect if refreshInterval is not set.
domain.startup.maxRetries	integer	-	Number of retry attempts when loading the domain at startup.
domain.startup.retryInterval	duration	-	Wait time between startup retry attempts. Minimum: 1 second. Format: integer + unit.
domain.authentication.username	string	-	Username for Basic authentication when retrieving the domain from a remote endpoint. Do not set if using oauth2ClientId.
domain.authentication.password	string	-	Password for Basic authentication when retrieving the domain. Do not set if using oauth2ClientId.
domain.authentication.oauth2ClientId	string	-	OAuth2 client ID for token-based domain retrieval. Do not set if using username/password.
domain.authentication.tlsConfigurationId	string	-	Name of the Spring TLS bundle (defined under spring.ssl.bundle) used to secure domain retrieval requests.
domain.authentication.oauth2TlsConfigurationId	string	-	Name of the Spring TLS bundle used to secure OAuth2 token retrieval requests. Can reference the same bundle as tlsConfigurationId or a different one.

Authentication

Property	Type	Default	Description
authentication.enabled	boolean	true	Set to false to disable all authentication. When disabled, any spring.security user settings are ignored.
spring.security.user.name	string	-	Username for Basic authentication.
spring.security.user.password	string	-	Password for Basic authentication. Supports plain text or hashed values with a {id} prefix (e.g., {bcrypt}, {sha256}, {pbkdf2}, {noop}). In ADS 26.2.0+, {pbkdf2} requires a 16-byte salt (96 hex characters). Legacy 80-character hashes must be regenerated prior to upgrading.
spring.security.oauth2.resourceserver.jwt.audiences	string	-	Expected value of the JWT aud claim. ADS rejects tokens that do not match this audience. Optional.
spring.security.oauth2.resourceserver.jwt.jwk-set-uri	string	-	URI of the JSON Web Key Set (JWKS) endpoint for verifying JWT signatures. Accepts file: or https: URIs. Required for JWT authentication.
spring.security.oauth2.resourceserver.jwt.jws-algorithms	string	RS256	JSON Web Algorithm used to verify JWT signatures. Optional.
spring.security.oauth2.client.registration.<id>.client-id	string	-	OAuth2 client identifier, as registered with the authorization server.
spring.security.oauth2.client.registration.<id>.client-secret	string	-	OAuth2 client secret. Use an environment variable to avoid storing this in plain text.
spring.security.oauth2.client.registration.<id>.scope	string	-	OAuth2 scope(s) requested by the client (e.g., openid).
spring.security.oauth2.client.registration.<id>.authorization-grant-type	string	-	OAuth2 grant type. Use client_credentials for machine-to-machine token requests.
spring.security.oauth2.client.registration.<id>.provider	string	-	Provider key that supplies the token endpoint configuration.
spring.security.oauth2.client.provider.<id>.token-uri	string	-	Token endpoint URL of the authorization server.

TLS (Spring bundles)

Property	Type	Default	Description
spring.ssl.bundle.jks.<name>.keystore.location	string	-	Path to the keystore file for the named TLS bundle (e.g., file:server_keystore.p12).
spring.ssl.bundle.jks.<name>.keystore.password	string	-	Password to access the keystore. Use an environment variable.
spring.ssl.bundle.jks.<name>.keystore.type	string	-	Keystore format (e.g., PKCS12, JKS).
spring.ssl.bundle.jks.<name>.truststore.location	string	-	Path to the truststore file for the named TLS bundle.
spring.ssl.bundle.jks.<name>.truststore.password	string	-	Password to access the truststore. Use an environment variable.
spring.ssl.bundle.jks.<name>.truststore.type	string	-	Truststore format (e.g., PKCS12, JKS).

note

As an alternative to Spring TLS bundles, configure TLS trust at the JVM level by passing -Djavax.net.ssl.trustStore and -Djavax.net.ssl.trustStorePassword as JVM startup arguments. See Configure TLS.

Attribute connectors

Property	Type	Default	Description
attributeConnectorContext.jdbc.connectionPool.minimumSize	integer	-	Minimum JDBC connection pool size created by each SQL or Table attribute connector at startup. Connections above this minimum are closed after 10 minutes of inactivity. Set to 0 or omit to create connections only on demand.
attributeConnectorContext.jdbc.connectionPool.maximumSize	integer	-	Maximum JDBC connection pool size (idle + active). Set to 0 or omit to disable connection pooling.

Caching

Distributed cache

Property	Type	Default	Description
distributedCache.enabled	boolean	false	Enables distributed attribute caching across multiple ADS instances.
distributedCache.port	integer	7800	Port used for intra-cluster communication.
distributedCache.mode	string	REPL_ASYNC	Cache replication mode. REPL_ASYNC prioritizes speed. REPL_SYNC prioritizes data consistency.
distributedCache.clusterName	string	axio-cache-cluster	Identifier shared by all ADS instances that participate in the same cache cluster. All instances in a cluster must use the same value.
distributedCache.discoveryMethod	string	multicast	Mechanism used to discover other cluster members. multicast uses IP multicast. dns uses DNS A/SRV records and requires dnsQuery. Axiomatics recommends dns for Kubernetes deployments.
distributedCache.dnsQuery	string	-	DNS query string used to discover cluster members. Required when discoveryMethod is dns.
distributedCache.cacheStateLocation	string	-	Absolute path to a writable local directory for storing cluster state metadata. Enables cache state persistence across restarts. In Kubernetes deployments this defaults to an emptyDir on the pod. For JAR deployments the feature is disabled unless this property is set.
distributedCache.tls.keyStorePath	string	-	Path to the keystore for encrypting intra-cluster communication (e.g., file:server_keystore.p12). Not supported in Kubernetes deployments.
distributedCache.tls.keyStorePassword	string	-	Password for the distributed cache TLS keystore.
distributedCache.tls.keyStoreType	string	-	Keystore format for distributed cache TLS (e.g., PKCS12).

Cache override

Property	Type	Default	Description
attributeConnectors.cacheOverride.ttl	duration	-	Overrides the Time-To-Live for all attribute cache entries. Format: integer + unit (e.g., 2 seconds). Set to 0 seconds to disable caching. When set, this value applies to all attributes regardless of individual domain cache settings.
attributeConnectors.cacheOverride.maxItems	integer	-	Overrides the maximum number of cached values per attribute. Minimum: 0. When this limit is reached, ADS evicts the least recently used (LRU) entry to make room.

Logging and audit

Property	Type	Default	Description
logging.level.root	string	WARN	Minimum log level for all application output. Accepted values: OFF, FATAL, ERROR, WARN, INFO, DEBUG, TRACE.
logging.level."com.axiomatics.audit"	string	-	Log level for all ADS audit events (evaluation and administrative). Set to INFO to enable audit logging. Set to OFF to disable it.
logging.level."com.axiomatics.audit.ads.eval"	string	-	Log level for evaluation audit events only.
logging.level."com.axiomatics.audit.ads.admin"	string	-	Log level for administrative audit events only.
logging.config	string	-	Path to a custom Logback configuration file. Use this to control output destination (file, console, or both), format, and additivity.
audit.mode	string	concise_json	Format and verbosity of audit log output. Accepted values: concise_json, verbose_json, concise (XML), verbose (XML). Applies to ADS logs only. CAQ logs are always XML.

Metrics and tracing

Property	Type	Default	Description
management.server.port	integer	-	Separate port for management (health, metrics) endpoints. When omitted, management endpoints share server.port.
management.metrics.enable.system	boolean	false	Enables system-level Spring Boot metrics (CPU, memory, HTTP).
management.metrics.enable.jvm	boolean	false	Enables JVM metrics.
management.metrics.enable.decisions	boolean	false	Enables ADS RED metrics (Rate, Errors, Duration) for authorization decisions.
management.metrics.enable.duration.info	boolean	false	Enables duration histogram metrics for policy evaluation.
management.metrics.enable.error.requests	boolean	false	Enables tracking of failed access requests due to policy evaluation errors.
management.metrics.enable.successful.requests	boolean	false	Enables tracking of successfully evaluated requests (Permit or Deny).

Instance

Property	Type	Default	Description
identity.constant	string	-	Sets a fixed, unchanging identity string for this ADS instance. Useful for stable identification in logs and metrics. Do not set alongside identity.prefix.
identity.prefix	string	-	Sets a custom prefix for the auto-generated instance identity. ADS generates identities in the format <prefix>-<xxxxxxxx>, where the hex suffix changes on every restart. Do not set alongside identity.constant.

note

The identity.constant and identity.prefix values may contain alphanumeric characters, hyphens (-), and underscores (_). The maximum length is 100 characters.

Deprecated properties

Property	Type	Default	Description
legacyXmlConfig	-	-	(Deprecated, no replacement.) Originally supported XML-based domain configuration. XML domains are no longer supported in ADS 26.1.
security.enabled	boolean	-	(Deprecated: use authentication.enabled instead.) ADS 1.x property for disabling authentication.
concurrentEvaluation.numberOfWorkers	integer	-	(Deprecated: use Java Virtual Threads instead.) ADS 2.x property for parallel evaluation of Multiple Decision Profile (MDP) requests. In ADS 26.x, virtual threads are enabled by default (spring.threads.virtual.enabled: true) and provide equivalent concurrency without manual worker configuration.
metricsBackends	-	-	(Deprecated: use management.metrics instead.) ADS 1.x metrics backend configuration.
authentication.type	string	-	(Deprecated: use spring.security instead.) ADS 1.x authentication type setting.