Admin Backend configuration

Admin Backend (epam/ai-dial-admin-backend) is an optional service for backend-managed configuration, import/export, and legacy administration screens. It stores configuration state in its database and exports it for DIAL Core to read.

Admin Frontend can also work directly with Core, without this backend; see Admin Frontend configuration. The settings below apply only when Admin Backend is deployed. They match the backend's configuration guide at release 0.22.5, which lists every property, including OpenTelemetry and actuator settings.

Docker Compose example

From dial-docker-compose-advanced/dial-2.x/docker-compose-base.yml:

admin-backend:
  image: epam/ai-dial-admin-backend:0.20.1
  platform: linux/amd64
  user: root
  environment:
    ENABLE_CORE_CONFIG_VERSION_AUTO_DETECT: "true"
    CONFIG_EXPORT_OUTPUTFILE_PATH: /app/config/config.json
    CONFIG_REST_SECURITY_MODE: "oidc"
    CORE_CLIENT_URL: "http://core:8080"
    DEBUG_OPTS: "-agentlib:jdwp=transport=dt_socket,server=y,suspend=n,address=*:5006"
    DISABLE_SWAGGER_AUTHORIZATION: true
    ENABLE_CONFIG_AUTO_IMPORT_ON_BOOTSTRAP: "true"
    H2_DATASOURCE_ENCRYPTED_FILE_KEY: ${H2_DATASOURCE_ENCRYPTED_FILE_KEY}
    H2_DATASOURCE_MASTER_KEY: ${H2_DATASOURCE_MASTER_KEY}
    H2_DATASOURCE_PASSWORD: ${H2_DATASOURCE_PASSWORD}
    H2_FILE: ./data/testdb
    METRICS_ENABLED: "false"
    'providers.keycloak.audiences': 'dial-admin-console'
    'providers.keycloak.issuer': "http://${COMMON_HOST}:${KC_PORT}/realms/dial"
    'providers.keycloak.jwk-set-uri': "http://keycloak:${KC_PORT}/realms/dial/protocol/openid-connect/certs"
    'providers.keycloak.role-claims': roles
  volumes:
    - ${DIAL_DIR:-.}/admin/data:/app/data
    - ${DIAL_DIR:-.}/core:/app/config
  depends_on:
    core:
      condition: service_started
  restart: always

DIAL Core client

Variable	Default	Description
`CORE_CLIENT_URL`	`localhost:8081`	DIAL Core service URL.
~~`DIAL_ADMIN_CLIENT_ID`~~	—	Removed in 1.38. Superseded by `providers.<name>.audiences`, which defines the same property.
`CORE_PROMPTS_METADATA_DEFAULT_LIMIT`	`256`	Default limit for prompts metadata queries.
`CORE_APPLICATIONS_METADATA_DEFAULT_LIMIT`	`256`	Default limit for applications metadata queries.
`CORE_TOOLSETS_METADATA_DEFAULT_LIMIT`	`256`	Default limit for toolsets metadata queries.

Config file export

Admin Backend periodically exports the managed configuration to a file that DIAL Core reads as its config.json.

Variable	Default	Description
`CONFIG_EXPORT_ENABLED`	`true`	Enable or disable config file export.
`CORE_CONFIG_VERSION`	—	DIAL Core config version for export. Required if auto-detect is disabled.
`ENABLE_CORE_CONFIG_VERSION_AUTO_DETECT`	`false`	Auto-detect DIAL Core version from the running instance.
`CORE_VERSION_CACHE_EXPIRATION_MS`	`300000`	Cache expiration for auto-detected version (ms).
`CONFIG_EXPORT_SYNCPERIOD`	`15000`	Export interval (ms).
`ENABLE_CONFIG_RELOAD`	`true`	Write config to destination and call DIAL Core's `/reload_config` endpoint.
`DELAY_CONFIG_RELOAD_MILLISECONDS`	`5000`	Delay before calling `/reload_config` after writing the file.
`ENABLE_CONFIG_AUTO_RELOAD`	`false`	Enable automatic scheduled `/reload_config` calls.
`CONFIG_AUTO_RELOAD_SCHEDULE_DELAY_MILLISECONDS`	`120000`	Interval between auto-reload calls (ms).
`CONFIG_EXPORT_STORAGETYPE`	`LOCAL_FILE`	Storage type: `LOCAL_FILE`, `KUBE_SECRET`, or `CONFIG_MAP`.
`CONFIG_EXPORT_OUTPUTFILE_PATH`	`data/export/out.json`	Output file path (`LOCAL_FILE` mode).
`CONFIG_EXPORT_CONFIGMAP_NAMES`	—	ConfigMap names, comma-separated (`CONFIG_MAP` mode).
`CONFIG_EXPORT_CONFIGMAP_KEY`	`env.config.json`	Key in the ConfigMap.
`CONFIG_EXPORT_KUBESECRET_NAMES`	—	Kubernetes Secret names, comma-separated (`KUBE_SECRET` mode).
`CONFIG_EXPORT_KUBESECRET_KEY`	`kube-secret-key`	Key in the Kubernetes Secret.
`CONFIG_EXPORT_CREATE_RESOURCES`	`false`	Create export destination resources if they do not exist.
`CONFIG_EXPORT_SYNC_DURATION_THRESHOLD_MS`	`120000`	Threshold before sync status changes to `IN_PROGRESS_TOO_LONG` (ms).

Config file import

Variable	Default	Description
`IMPORT_CONFIGS_MAX_COUNT`	`64`	Maximum files per import operation.
`ENABLE_CONFIG_AUTO_IMPORT_ON_BOOTSTRAP`	`false`	Auto-import configuration on first startup (runs once if database is empty).
`IMPORT_AUTO_BOOTSTRAP_FILE_PATHS`	—	Comma-separated file paths for bootstrap import.
`IMPORT_AUTO_BOOTSTRAP_STRATEGY`	`MERGE_JSON`	Import strategy: `MERGE_JSON` or `SEQUENTIAL`.
`IMPORT_AUTO_BOOTSTRAP_CONFLICT_RESOLUTION`	`OVERRIDE`	Conflict resolution: `OVERRIDE` or `SKIP`.

Key vault integration

Admin Backend can fetch secrets from cloud key vaults for config export.

Variable	Default	Description
`CONFIG_EXPORT_KEYVAULT_TYPE`	`none`	Key vault type: `none`, `azure`, `vault`, `aws`, or `gcp`.
`CONFIG_EXPORT_KEYVAULT_SECRETNAMES`	—	Secret names in key vault (`azure`, `aws`, `gcp`).
`CONFIG_EXPORT_KEYVAULT_SECRETPATH`	—	Path to secrets in Hashicorp Vault.
`CONFIG_EXPORT_KEYVAULT_EXPIRATION_PERIOD`	`3`	Key vault value expiration period.
`CONFIG_EXPORT_KEYVAULT_EXPIRATION_UNIT`	`MONTHS`	Time unit for key vault expiration.

Cloud provider authentication for key vaults:

Variable	Description
`AUTH_AZURE_TYPE`	Azure auth type: `credential`, `cli`, or `managed`.
`AUTH_AZURE_CLIENT_ID`	Azure service principal client ID (`credential` mode).
`AUTH_AZURE_TENANT_ID`	Azure tenant ID (`cli` or `credential` mode).
`AUTH_AZURE_CLIENT_SECRET`	Azure service principal client secret (`credential` mode).
`AZURE_KEY_VAULT_URL`	Azure Key Vault URL.
`GCP_KEY_VAULT_PROJECT_ID`	GCP project ID for Secret Manager.
`VAULT_URI`	Hashicorp Vault server URL.
`VAULT_TOKEN`	Hashicorp Vault access token.

Core auth token provider

When Admin Backend communicates with DIAL Core, it authenticates using either a static API key or an OAuth token.

Variable	Default	Description
`CORE_AUTH_METHOD`	`token`	Authentication method: `token` or `api-key`.
`CORE_AUTH_API_KEY_VALUE`	—	API key value (`api-key` mode).
`CORE_AUTH_TOKEN_PROVIDER_URL`	`http://localhost/disabled`	Token provider URL (`token` mode).
`CORE_AUTH_TOKEN_PROVIDER_CLIENT_ID`	—	Client ID for token provider.
`CORE_AUTH_TOKEN_PROVIDER_CLIENT_SECRET`	—	Client secret for token provider.
`CORE_AUTH_TOKEN_PROVIDER_SCOPE`	—	Token scope.
`CORE_AUTH_TOKEN_PROVIDER_AUDIENCE`	—	Token audience.
`CORE_AUTH_TOKEN_PROVIDER_CACHE_ENABLED`	`true`	Enable token caching.
`CORE_AUTH_TOKEN_PROVIDER_CACHE_REFRESH_BEFORE_EXPIRATION_SECONDS`	`600`	Refresh window before token expiry (seconds).

Security

Variable	Default	Description
`CONFIG_REST_SECURITY_MODE`	`none`	Authentication mode: `oidc`, `basic`, or `none`.
`CLAIMS_EMAIL_KEY`	`unique_name`	JWT claim for user email.
`SECURITY_USER_CLAIM`	`oid`	JWT claim for user identification.
`SECURITY_REQUIRE_EMAIL`	`false`	Whether the email claim is required.
`DISABLE_SWAGGER_AUTHORIZATION`	`false`	Disable Swagger UI authorization.

Identity providers

Admin Backend supports multiple identity providers using the pattern providers.{name}.{field}:

Field	Description
`providers.*.issuer`	Accepted JWT issuers.
`providers.*.jwk-set-uri`	JWK Set URI for token verification.
`providers.*.user-info-endpoint`	User info URI (alternative to `jwk-set-uri`).
`providers.*.audiences`	Accepted JWT audiences.
`providers.*.role-claims`	JWT claim paths for roles.
`providers.*.allowed-roles`	Roles with access (deprecated — use `roles-mapping`).
`providers.*.roles-mapping`	JSON role mapping to `FULL_ADMIN` or `READ_ONLY_ADMIN`.
`providers.*.aliases`	Issuer aliases (Azure only).
`providers.*.email-claims`	JWT claim paths for email.
`providers.*.principal-claim`	Claim used as principal.

Datasource

Admin Backend stores its configuration state in a database. H2 is the default for development; PostgreSQL and MS SQL Server are supported for production.

Variable	Default	Description
`DATASOURCE_VENDOR`	`H2`	Database vendor: `H2`, `POSTGRES`, or `MS_SQL_SERVER`.
`DATASOURCE_AUTH_TYPE`	`basic`	Authentication type: `basic`, `azure`, or `gcp`.

H2 (default):

Variable	Default	Description
`H2_FILE`	`./data/testdb`	H2 database file path.
`H2_OPS`	`CIPHER=AES;DB_CLOSE_DELAY=-1;DB_CLOSE_ON_EXIT=FALSE`	H2 connection options.
`H2_DATASOURCE_MASTERKEY`	—	H2 encryption master key.
`H2_DATASOURCE_ENCRYPTEDFILEKEY`	—	H2 encrypted file key.
`H2_DATASOURCE_PASSWORD`	—	H2 password.

PostgreSQL:

Variable	Default	Description
`POSTGRES_HOST`	`localhost`	PostgreSQL host.
`POSTGRES_PORT`	`5432`	PostgreSQL port.
`POSTGRES_DATABASE`	`testdb`	Database name.
`POSTGRES_OPS`	—	Connection options appended to JDBC URL.
`POSTGRES_DATASOURCE_USERNAME`	`postgres`	Username.
`POSTGRES_DATASOURCE_PASSWORD`	`postgres`	Password.

MS SQL Server:

Variable	Default	Description
`MS_SQL_SERVER_HOST`	`localhost`	SQL Server host.
`MS_SQL_SERVER_PORT`	`1433`	SQL Server port.
`MS_SQL_SERVER_DATABASE`	`testdb`	Database name.
`MS_SQL_SERVER_OPS`	`encrypt=false;`	Connection options.
`MS_SQL_SERVER_DATASOURCE_USERNAME`	`sa`	Username.
`MS_SQL_SERVER_DATASOURCE_PASSWORD`	`SQLServerPassword1`	Password.

Common database settings:

Variable	Default	Description
`SPRING_JPA_HIBERNATE_DDL_AUTO`	`validate`	Hibernate DDL strategy.
`SPRING_FLYWAY_ENABLED`	`true`	Enable Flyway database migrations.

Kubernetes configuration

Required when CONFIG_EXPORT_STORAGETYPE is KUBE_SECRET or CONFIG_MAP.

Variable	Default	Description
`KUBERNETES_CONFIG_CONNECTTYPE`	`CONFIG_FILE`	Connection type: `CONFIG_FILE` or `TOKEN`.
`KUBERNETES_CONFIG_MASTERURL`	—	Kubernetes master URL (`TOKEN` mode).
`KUBERNETES_CONFIG_OAUTHTOKEN`	—	Kubernetes OAuth token (`TOKEN` mode).
`KUBERNETES_CONFIG_TRUSTCERTS`	`false`	Trust all Kubernetes certificates.
`KUBERNETES_CONFIG_NAMESPACE`	`default`	Kubernetes namespace.

Web server

Variable	Default	Description
`SERVER_PORT`	`8080`	Web server port.
`SERVLET_MULTIPART_MAX_FILE_SIZE`	`4MB`	Maximum file size for multipart uploads.
`SERVLET_MULTIPART_MAX_REQUEST_SIZE`	`64MB`	Maximum request size.

Metrics

These settings serve the legacy telemetry Dashboards: Admin Backend queries the InfluxDB that the legacy Analytics Realtime service writes, as its README notes. New deployments use DIAL Analytics instead: with Admin's Analytics settings and ANALYTICS_USAGE_ENABLED on, the dashboards read DIAL Analytics.

Variable	Default	Description
`METRICS_ENABLED`	`false`	Enable metrics collection from InfluxDB.
`METRICS_CONFIG_CONTENT`	—	Dataset configuration JSON content.
`METRICS_CONFIG_FILE`	—	Path to dataset configuration JSON file.
`METRICS_DATASOURCE_TYPE`	`influx2`	InfluxDB version: `influx2` or `influx3`.
`METRICS_STORAGE_HOST`	—	InfluxDB URL. Required if metrics are enabled.
`METRICS_STORAGE_TOKEN`	—	InfluxDB access token. Required if metrics are enabled.
`METRICS_MAX_TIME_RANGE`	`72h`	Maximum query time range.

Retry

Variable	Default	Description
`FEIGN_RETRY_PERIOD`	`10000`	Initial retry delay (ms).
`FEIGN_RETRY_MAXPERIOD`	`15000`	Maximum retry delay (ms).
`FEIGN_RETRY_MAXATTEMPTS`	`5`	Maximum retry attempts.
`FEIGN_RETRY_ERRORCODES`	`408,429,500,502,503,504`	HTTP status codes that trigger retries.

Logging

Variable	Default	Description
`APP_LOG_LEVEL`	`INFO`	Application log level.
`LOGGING_LEVEL_ORG_SPRINGFRAMEWORK_SECURITY`	`INFO`	Spring Security log level.
`LOGGING_LEVEL_ORG_HIBERNATE_SQL`	`INFO`	Hibernate SQL log level.
`LOGGER_CONFIGURATION_PATH`	`log-config/logging.levels.json`	External logger configuration file path.
`LOGGER_CONFIGURATION_INTERVAL`	`10`	Logger configuration check interval (seconds).

Validation

Entity name validation patterns (all optional, no defaults):

Variable	Description
`ROLE_NAME_VALIDATION_PATTERN`	Regex for role names.
`MODEL_NAME_VALIDATION_PATTERN`	Regex for model names.
`APPLICATION_NAME_VALIDATION_PATTERN`	Regex for application names.
`INTERCEPTOR_NAME_VALIDATION_PATTERN`	Regex for interceptor names.
`KEY_NAME_VALIDATION_PATTERN`	Regex for API key names.
`ROUTE_NAME_VALIDATION_PATTERN`	Regex for route names.
`TOOLSET_NAME_VALIDATION_PATTERN`	Regex for toolset names.
`APPLICATION_TYPE_SCHEMA_ID_VALIDATION_PATTERN`	Regex for application type schema IDs.

Docker Compose example​

DIAL Core client​

Config file export​

Config file import​

Key vault integration​

Core auth token provider​

Security​

Identity providers​

Datasource​

Kubernetes configuration​

Web server​

Metrics​

Retry​

Logging​

Validation​

Further reading​