PA Configuration database table - Revision history

Ollvihe: /* MCP and OAuth Server Settings */

2026-05-15T22:07:24Z

MCP and OAuth Server Settings

← Older revision		Revision as of 22:07, 15 May 2026
Line 156:		Line 156:
	* '''DisableExternalOAuthForwarding''' (boolean): Can be used to disable forwarding OAuth requests to any configured external OAuth authorization server or SAML identity provider. If set, a QPR ProcessAnalyzer's own login view functionality is always used when authorizing a user. The default value is false.		* '''DisableExternalOAuthForwarding''' (boolean): Can be used to disable forwarding OAuth requests to any configured external OAuth authorization server or SAML identity provider. If set, a QPR ProcessAnalyzer's own login view functionality is always used when authorizing a user. The default value is false.
	* '''ClientCredentials''' (array of objects): List of confidential client registrations for the ''client_credentials'' grant type. Each entry maps a client application (identified by ''ClientId'' and ''ClientSecret'') to a ProcessAnalyzer user, enabling machine-to-machine authentication without interactive login. If not defined or empty, the ''client_credentials'' grant type is not available. Each object in the array supports the following properties:		* '''ClientCredentials''' (array of objects): List of confidential client registrations for the ''client_credentials'' grant type. Each entry maps a client application (identified by ''ClientId'' and ''ClientSecret'') to a ProcessAnalyzer user, enabling machine-to-machine authentication without interactive login. If not defined or empty, the ''client_credentials'' grant type is not available. Each object in the array supports the following properties:
	** '''ClientId''' (string): ~~The unique~~ client identifier used in the ''client_id'' parameter of the token request.		** '''ClientId''' (string): Unique client identifier used by the ''client_id'' parameter of the token request.
	** '''ClientSecret''' (string): ~~The client~~ secret used ~~to authenticate the client in~~ the ''client_secret'' parameter of the token request. Also supports HTTP Basic authentication (''Authorization: Basic base64(client_id:client_secret)'').		** '''ClientSecret''' (string): Client secret used by the ''client_secret'' parameter of the token request to authenticate the client to the MCP server. Also supports HTTP Basic authentication (''Authorization: Basic base64(client_id:client_secret)'').
	** '''MappedUserLoginName''' (string): ~~The login~~ name of the ProcessAnalyzer user this client acts as. The issued access token will represent this user and carry their identity and permissions. The user must exist and be active in ProcessAnalyzer.		** '''MappedUserLoginName''' (string): Login name of the QPR ProcessAnalyzer user this client acts as. The issued access token will represent this user and carry their identity and permissions. The user must exist and be active in QPR ProcessAnalyzer.
	** '''Description''' (string): Optional human-readable description for this client registration.		** '''Description''' (string): Optional human-readable description for this client registration.
	** '''RefreshTokenRotationGracePeriodSeconds''' (integer): Grace period in seconds during which a rotated (previously used) refresh token is still accepted. When a refresh token is used, it is rotated (replaced with a new one). During this grace period, the old token remains valid to accommodate concurrent or retried requests that may arrive with the old token. After the grace period expires, the old rotated token becomes permanently invalid. The default value is 60 seconds (1 minute).		** '''RefreshTokenRotationGracePeriodSeconds''' (integer): Grace period in seconds during which a rotated (previously used) refresh token is still accepted. When a refresh token is used, it is rotated (replaced with a new one). During this grace period, the old token remains valid to accommodate concurrent or retried requests that may arrive with the old token. After the grace period expires, the old rotated token becomes permanently invalid. The default value is 60 seconds (1 minute).

TeeHiet: TK-64611

2026-05-13T04:35:52Z

TK-64611

← Older revision		Revision as of 04:35, 13 May 2026
Line 160:		Line 160:
	** '''MappedUserLoginName''' (string): The login name of the ProcessAnalyzer user this client acts as. The issued access token will represent this user and carry their identity and permissions. The user must exist and be active in ProcessAnalyzer.		** '''MappedUserLoginName''' (string): The login name of the ProcessAnalyzer user this client acts as. The issued access token will represent this user and carry their identity and permissions. The user must exist and be active in ProcessAnalyzer.
	** '''Description''' (string): Optional human-readable description for this client registration.		** '''Description''' (string): Optional human-readable description for this client registration.
	~~Example ClientCredentials definition~~:		** '''RefreshTokenRotationGracePeriodSeconds''' (integer): Grace period in seconds during which a rotated (previously used) refresh token is still accepted. When a refresh token is used, it is rotated (replaced with a new one). During this grace period, the old token remains valid to accommodate concurrent or retried requests that may arrive with the old token. After the grace period expires, the old rotated token becomes permanently invalid. The default value is 60 seconds (1 minute).
	~~<pre>~~
	~~"ClientCredentials": [~~
	{
	~~"ClientId": "my-backend-service"~~,
	~~"ClientSecret": "~~a~~-secure-random-secret"~~,
	~~"MappedUserLoginName": "service-account"~~,
	~~"Description": "Backend integration service"~~
	}
	]
	~~</pre>~~

	Example BuiltInOAuthServerConfiguration configuration:<br>		Example BuiltInOAuthServerConfiguration configuration:<br>
Line 176:		Line 166:
	{		{
	"Issuer": "",		"Issuer": "",
	"AcceptedAudiences": ~~["qpr-processanalyzer"]~~,		"AcceptedAudiences": null,
	"SigningKey": "",		"SigningKey": "",
	"TokenLifetime": 3600		"TokenLifetime": 3600,
			"DisableExternalOAuthForwarding2": true,
			"ClientCredentials": [{
			"ClientId": "my-backend-service",
			"ClientSecret": "a-secure-random-secret",
			"MappedUserLoginName": "service-account",
			"Description": "Backend integration service"
			}]
	}		}
	</pre>		</pre>

Ollvihe: /* General Settings */

2026-05-04T08:24:35Z

General Settings

← Older revision		Revision as of 08:24, 4 May 2026
Line 33:		Line 33:
	\|\|AIAgentDefaultModelName		\|\|AIAgentDefaultModelName
	\|\|openai-gpt-5-nano		\|\|openai-gpt-5-nano
	\|\|~~Specifies the~~ Snowflake LLM ~~model~~ to use for AI Agent dashboard component and AI Agent presets. If not defined, '''openai-gpt-5-nano''' is used. See list of available LLM's: ~~Snowflake documentation](~~https://docs.snowflake.com/en/sql-reference/functions/complete-snowflake-cortex#arguments ~~(note~~ that the list might not be ~~always~~ up-to-date because the available LLM's change often).		\|\|Snowflake LLM to use by default for AI Agent dashboard component and AI Agent presets. If not defined, '''openai-gpt-5-nano''' is used. See list of available LLM's: https://docs.snowflake.com/en/sql-reference/functions/complete-snowflake-cortex#arguments. Note that the list might not be up-to-date because the available LLM's change often. To get the up-to-date list, use the following SQL command: https://docs.snowflake.com/en/sql-reference/sql/show-models.
	\|-		\|-
	\|\|OpenAIDefaultModelName		\|\|OpenAIDefaultModelName
	\|\|gpt-5.4		\|\|gpt-5.4
	\|\|OpenAI ~~large language model (~~LLM) to use for the [[AI_Assistant_for_QPR_ProcessAnalyzer\|AI Assistant]] and [[Generic_Functions_in_QPR_ProcessAnalyzer#OpenAIChatCompletion\|OpenAIChatCompletion]] function. If not defined, '''gpt-5.4''' will be used. More information about OpenAI models: https://platform.openai.com/docs/models.		\|\|OpenAI API LLM to use for the [[AI_Assistant_for_QPR_ProcessAnalyzer\|AI Assistant]] and [[Generic_Functions_in_QPR_ProcessAnalyzer#OpenAIChatCompletion\|OpenAIChatCompletion]] function. If not defined, '''gpt-5.4''' will be used. More information about OpenAI models: https://platform.openai.com/docs/models.
	\|-		\|-
	\|\|DefaultCortexAgentsModelName		\|\|DefaultCortexAgentsModelName

Ollvihe: /* General Settings */

2026-05-04T08:19:02Z

General Settings

← Older revision		Revision as of 08:19, 4 May 2026
Line 30:		Line 30:
	\|\|		\|\|
	\|\|API key for the OpenAI API (https://platform.openai.com/docs/api-reference). It needs to be configured to use the [[AI_Assistant_for_QPR_ProcessAnalyzer\|AI Assistant]] and [[Generic_Functions_in_QPR_ProcessAnalyzer#OpenAIChatCompletion\|OpenAIChatCompletion]] function.		\|\|API key for the OpenAI API (https://platform.openai.com/docs/api-reference). It needs to be configured to use the [[AI_Assistant_for_QPR_ProcessAnalyzer\|AI Assistant]] and [[Generic_Functions_in_QPR_ProcessAnalyzer#OpenAIChatCompletion\|OpenAIChatCompletion]] function.
			\|-
			\|\|AIAgentDefaultModelName
			\|\|openai-gpt-5-nano
			\|\|Specifies the Snowflake LLM model to use for AI Agent dashboard component and AI Agent presets. If not defined, '''openai-gpt-5-nano''' is used. See list of available LLM's: Snowflake documentation](https://docs.snowflake.com/en/sql-reference/functions/complete-snowflake-cortex#arguments (note that the list might not be always up-to-date because the available LLM's change often).
	\|-		\|-
	\|\|OpenAIDefaultModelName		\|\|OpenAIDefaultModelName
	\|\|gpt-4o		\|\|gpt-5.4
	\|\|OpenAI large language model (LLM) to use for the [[AI_Assistant_for_QPR_ProcessAnalyzer\|AI Assistant]] and [[Generic_Functions_in_QPR_ProcessAnalyzer#OpenAIChatCompletion\|OpenAIChatCompletion]] function. If not defined, '''gpt-4o''' will be used~~. Note that only LLM's that support the function calling feature, are suitable for the AI Assistant~~. More information about OpenAI models: https://platform.openai.com/docs/models.		\|\|OpenAI large language model (LLM) to use for the [[AI_Assistant_for_QPR_ProcessAnalyzer\|AI Assistant]] and [[Generic_Functions_in_QPR_ProcessAnalyzer#OpenAIChatCompletion\|OpenAIChatCompletion]] function. If not defined, '''gpt-5.4''' will be used. More information about OpenAI models: https://platform.openai.com/docs/models.
	\|-		\|-
	\|\|DefaultCortexAgentsModelName		\|\|DefaultCortexAgentsModelName
	\|\|llama3.1-70b		\|\|llama3.1-70b
	\|\|Specifies the ~~default language model~~ when using Snowflake Cortex Agents (https://docs.snowflake.com/en/user-guide/snowflake-cortex/cortex-agents-rest-api). If not defined, '''llama3.1-70b''' is used.		\|\|Specifies the LLM to use when using Snowflake Cortex Agents (https://docs.snowflake.com/en/user-guide/snowflake-cortex/cortex-agents-rest-api). If not defined, '''llama3.1-70b''' is used.
	\|-		\|-
	\|\|<span id="QueryTimeout">QueryTimeout</span>		\|\|<span id="QueryTimeout">QueryTimeout</span>

Ollvihe: /* OAuth Client (for External OAuth Server) */

2026-04-28T15:20:56Z

OAuth Client (for External OAuth Server)

← Older revision		Revision as of 15:20, 28 April 2026
Line 258:		Line 258:

	== OAuth Client (for External OAuth Server) ==		== OAuth Client (for External OAuth Server) ==
			QPR ProcessAnalyzer can be used with an external OAuth Server. In this mode, users authenticate to a 3rd party OAuth authentication server which is accepted by QPR ProcessAnalyzer by granting user access.

	Having both ExternalOAuthServerConfiguration and SAML authentication configured at the same time is not supported.		Having both ExternalOAuthServerConfiguration and SAML authentication configured at the same time is not supported.

Ollvihe: /* OAuth Client (for External OAuth Server) */

2026-04-28T15:15:41Z

OAuth Client (for External OAuth Server)

← Older revision		Revision as of 15:15, 28 April 2026
Line 282:		Line 282:
	"UserNameClaim": "name"		"UserNameClaim": "name"
	}		}

	</pre>		</pre>
	\|}		\|}

Ollvihe: /* MCP and OAuth Server Settings */

2026-04-28T15:15:25Z

MCP and OAuth Server Settings

← Older revision		Revision as of 15:15, 28 April 2026
Line 125:		Line 125:

	== MCP and OAuth Server Settings ==		== MCP and OAuth Server Settings ==
	MCP server settings are needed for QPR ProcessAnalyzer to act as an [[QPR_ProcessAnalyzer_as_MCP_Server\|MCP server]]. To authenticate to the MCP server, either the API key needs to be defined, or the (internal) OAuth Server needs to be configured (BuiltInOAuthServerConfiguration setting).		MCP server settings are needed for QPR ProcessAnalyzer to act as an [[QPR_ProcessAnalyzer_as_MCP_Server\|MCP server]]. To authenticate to the MCP server, either the API key needs to be defined (in the McpServerConfiguration setting), or the internal OAuth Server needs to be configured (BuiltInOAuthServerConfiguration setting).

	{\| class="wikitable" style="text-align: left"		{\| class="wikitable" style="text-align: left"
Line 144:		Line 144:
	\|-		\|-
	\|\|BuiltInOAuthServerConfiguration		\|\|BuiltInOAuthServerConfiguration
	\|\|Used to configure OAuth 2.0 compatible OAuth server settings for OAuth server built-in to ProcessAnalyzer server. If not set, built-in OAuth server functionality is disabled and clients can't connect to this server using OAuth. If set, contains a string representation of a JSON object that supports the following properties:		\|\|Used to configure OAuth 2.0 compatible OAuth server settings for OAuth server built-in ("internal") to ProcessAnalyzer server. If not set, built-in OAuth server functionality is disabled and clients can't connect to this server using OAuth. If set, contains a string representation of a JSON object that supports the following properties:
	* '''Issuer''' (string): OAuth issuer, which identifies a trusted authorization server that authenticates users and issues OAuth 2.0 access tokens and JSON Web Tokens (JWTs). If not defined or empty, default value is used, which is of format: <QPR ProcessAnalyzer server's base URL>/builtin-oauth. For example: https://example.com/builtin-oauth. The default value is empty.		* '''Issuer''' (string): OAuth issuer, which identifies a trusted authorization server that authenticates users and issues OAuth 2.0 access tokens and JSON Web Tokens (JWTs). If not defined or empty, default value is used, which is of format: <QPR ProcessAnalyzer server's base URL>/builtin-oauth. For example: https://example.com/builtin-oauth. The default value is empty.
	* '''AcceptedAudiences''' (array of strings): Array of strings that define all the accepted audiences this QPR ProcessAnalyzer server is serving. When authorizing user using OAuth, these values are matched with the audience-parameter (a.k.a. client id) of the authorization. Only requests with a value that matches a value in this array are accepted. If null, audience-parameters are not validated at all. Instead, all authorization requests will pass the audience validation check. This also enables [https://datatracker.ietf.org/doc/html/rfc7591 Dynamic Client Registration Protocol (DCR)]. The default value is an empty array.		* '''AcceptedAudiences''' (array of strings): Array of strings that define all the accepted audiences this QPR ProcessAnalyzer server is serving. When authorizing user using OAuth, these values are matched with the audience-parameter (a.k.a. client id) of the authorization. Only requests with a value that matches a value in this array are accepted. If null, audience-parameters are not validated at all. Instead, all authorization requests will pass the audience validation check. This also enables [https://datatracker.ietf.org/doc/html/rfc7591 Dynamic Client Registration Protocol (DCR)]. The default value is an empty array.

Ollvihe: /* MCP and OAuth Server Settings */

2026-04-28T14:46:12Z

MCP and OAuth Server Settings

← Older revision		Revision as of 14:46, 28 April 2026
Line 159:		Line 159:
	<pre>		<pre>
	"ClientCredentials": [		"ClientCredentials": [
	{		{
	"ClientId": "my-backend-service",		"ClientId": "my-backend-service",
	"ClientSecret": "a-secure-random-secret",		"ClientSecret": "a-secure-random-secret",
	"MappedUserLoginName": "service-account",		"MappedUserLoginName": "service-account",
	"Description": "Backend integration service"		"Description": "Backend integration service"
	}		}
	]		]
	</pre>		</pre>

Ollvihe: /* MCP and OAuth Server Settings */

2026-04-28T14:44:58Z

MCP and OAuth Server Settings

← Older revision		Revision as of 14:44, 28 April 2026
Line 125:		Line 125:

	== MCP and OAuth Server Settings ==		== MCP and OAuth Server Settings ==
	MCP server settings are needed for QPR ProcessAnalyzer to act as an [[QPR_ProcessAnalyzer_as_MCP_Server\|MCP server]].		MCP server settings are needed for QPR ProcessAnalyzer to act as an [[QPR_ProcessAnalyzer_as_MCP_Server\|MCP server]]. To authenticate to the MCP server, either the API key needs to be defined, or the (internal) OAuth Server needs to be configured (BuiltInOAuthServerConfiguration setting).

	{\| class="wikitable" style="text-align: left"		{\| class="wikitable" style="text-align: left"

TeeHiet: TK-64494

2026-04-28T12:05:17Z

TK-64494

@@ Line 149: / Line 149: @@
 * '''SigningKey''' (string): Signing key for the built-in OAuth identity provider. If empty, generates a non-deterministic key based on the physical system where QPR ProcessAnalyzer is running. NOTE: Once QPR ProcessAnalyzer server is restarted, these non-deterministic keys no longer work. If defined, string must contain the key either in PEM ([https://learn.microsoft.com/en-us/dotnet/api/system.security.cryptography.rsa.importfrompem?view=net-10.0 RFC 7468 PEM-encoded key]) or JSON ([https://datatracker.ietf.org/doc/html/rfc7517 RFC 7517]) format. The default value is empty.
 * '''TokenLifetimeSeconds''' (integer): Token lifetime in seconds for the built-in OAuth identity provider. After access token created by built-in gets older than this lifetime, it becomes unusable and a new token has to be created. The default value is 3600.
 * '''DisableExternalOAuthForwarding''' (boolean): Can be used to disable forwarding OAuth requests to any configured external OAuth authorization server or SAML identity provider. If set, a QPR ProcessAnalyzer's own login view functionality is always used when authorizing a user. The default value is false.
-Example configuration:<br>
+* '''ClientCredentials''' (array of objects):  List of confidential client registrations for the ''client_credentials'' grant type. Each entry maps a client application (identified by ''ClientId'' and ''ClientSecret'') to a ProcessAnalyzer user, enabling machine-to-machine authentication without interactive login. If not defined or empty, the ''client_credentials'' grant type is not available. Each object in the array supports the following properties:
 <pre>
+{

← Older revision		Revision as of 08:24, 4 May 2026
Line 33:		Line 33:
	\|\|AIAgentDefaultModelName		\|\|AIAgentDefaultModelName
	\|\|openai-gpt-5-nano		\|\|openai-gpt-5-nano
	\|\|~~Specifies the~~ Snowflake LLM ~~model~~ to use for AI Agent dashboard component and AI Agent presets. If not defined, '''openai-gpt-5-nano''' is used. See list of available LLM's: ~~Snowflake documentation](~~https://docs.snowflake.com/en/sql-reference/functions/complete-snowflake-cortex#arguments ~~(note~~ that the list might not be ~~always~~ up-to-date because the available LLM's change often).		\|\|Snowflake LLM to use by default for AI Agent dashboard component and AI Agent presets. If not defined, '''openai-gpt-5-nano''' is used. See list of available LLM's: https://docs.snowflake.com/en/sql-reference/functions/complete-snowflake-cortex#arguments. Note that the list might not be up-to-date because the available LLM's change often. To get the up-to-date list, use the following SQL command: https://docs.snowflake.com/en/sql-reference/sql/show-models.
	\|-		\|-
	\|\|OpenAIDefaultModelName		\|\|OpenAIDefaultModelName
	\|\|gpt-5.4		\|\|gpt-5.4
	\|\|OpenAI ~~large language model (~~LLM) to use for the [[AI_Assistant_for_QPR_ProcessAnalyzer\|AI Assistant]] and [[Generic_Functions_in_QPR_ProcessAnalyzer#OpenAIChatCompletion\|OpenAIChatCompletion]] function. If not defined, '''gpt-5.4''' will be used. More information about OpenAI models: https://platform.openai.com/docs/models.		\|\|OpenAI API LLM to use for the [[AI_Assistant_for_QPR_ProcessAnalyzer\|AI Assistant]] and [[Generic_Functions_in_QPR_ProcessAnalyzer#OpenAIChatCompletion\|OpenAIChatCompletion]] function. If not defined, '''gpt-5.4''' will be used. More information about OpenAI models: https://platform.openai.com/docs/models.
	\|-		\|-
	\|\|DefaultCortexAgentsModelName		\|\|DefaultCortexAgentsModelName

← Older revision		Revision as of 08:19, 4 May 2026
Line 30:		Line 30:
	\|\|		\|\|
	\|\|API key for the OpenAI API (https://platform.openai.com/docs/api-reference). It needs to be configured to use the [[AI_Assistant_for_QPR_ProcessAnalyzer\|AI Assistant]] and [[Generic_Functions_in_QPR_ProcessAnalyzer#OpenAIChatCompletion\|OpenAIChatCompletion]] function.		\|\|API key for the OpenAI API (https://platform.openai.com/docs/api-reference). It needs to be configured to use the [[AI_Assistant_for_QPR_ProcessAnalyzer\|AI Assistant]] and [[Generic_Functions_in_QPR_ProcessAnalyzer#OpenAIChatCompletion\|OpenAIChatCompletion]] function.
			\|-
			\|\|AIAgentDefaultModelName
			\|\|openai-gpt-5-nano
			\|\|Specifies the Snowflake LLM model to use for AI Agent dashboard component and AI Agent presets. If not defined, '''openai-gpt-5-nano''' is used. See list of available LLM's: Snowflake documentation](https://docs.snowflake.com/en/sql-reference/functions/complete-snowflake-cortex#arguments (note that the list might not be always up-to-date because the available LLM's change often).
	\|-		\|-
	\|\|OpenAIDefaultModelName		\|\|OpenAIDefaultModelName
	\|\|gpt-4o		\|\|gpt-5.4
	\|\|OpenAI large language model (LLM) to use for the [[AI_Assistant_for_QPR_ProcessAnalyzer\|AI Assistant]] and [[Generic_Functions_in_QPR_ProcessAnalyzer#OpenAIChatCompletion\|OpenAIChatCompletion]] function. If not defined, '''gpt-4o''' will be used~~. Note that only LLM's that support the function calling feature, are suitable for the AI Assistant~~. More information about OpenAI models: https://platform.openai.com/docs/models.		\|\|OpenAI large language model (LLM) to use for the [[AI_Assistant_for_QPR_ProcessAnalyzer\|AI Assistant]] and [[Generic_Functions_in_QPR_ProcessAnalyzer#OpenAIChatCompletion\|OpenAIChatCompletion]] function. If not defined, '''gpt-5.4''' will be used. More information about OpenAI models: https://platform.openai.com/docs/models.
	\|-		\|-
	\|\|DefaultCortexAgentsModelName		\|\|DefaultCortexAgentsModelName
	\|\|llama3.1-70b		\|\|llama3.1-70b
	\|\|Specifies the ~~default language model~~ when using Snowflake Cortex Agents (https://docs.snowflake.com/en/user-guide/snowflake-cortex/cortex-agents-rest-api). If not defined, '''llama3.1-70b''' is used.		\|\|Specifies the LLM to use when using Snowflake Cortex Agents (https://docs.snowflake.com/en/user-guide/snowflake-cortex/cortex-agents-rest-api). If not defined, '''llama3.1-70b''' is used.
	\|-		\|-
	\|\|<span id="QueryTimeout">QueryTimeout</span>		\|\|<span id="QueryTimeout">QueryTimeout</span>