Design Hub configuration guide

Design Hub is a NodeJS based application for molecule design and idea management. It includes an HTTP and WebSocket server to serve multiple clients running the embedded web application.

All configuration is performed on the server, this document describes the available options.

• Configuration
  • Database
  • Chemistry web services
  • Plugins
  • License
  • Networking
  • Security
  • GUI
  • Workflow
  • Performance
• Setting up local authentication
• Setting up LDAP authentication
• Setting up SAML authentication
• Setting up OpenID Connect authentication
• Marvin JS configuration
• Groups, roles and permissions
• Structure search advanced configuration

Configuration

This application requires a JSON configuration file to be passed as a command line argument. The configuration file holds all the key settings regarding database connection, networking, security, persistence, plugins and more.

The minimum configuration requires database details, JChem Microservices details, a license and a port to be specified, but a more general sample of typical options is below. Note that some values point to files or other services. These should be changed to match your environment - of course you can store your Chemaxon license files or Design Hub plugins anywhere. See below in the spreadsheet for your full list of options:

sample for config.json:

{
 "databaseHost": "db",
 "databasePort": 5432,
 "databaseName": "designhub",
 "databaseUser": "designhubuser",
 "databasePassword": "CHANGETHIS",
 "secretKey": "CHANGETHIS",
 "authentication": {
   "internal": {
     "type": "local",
     "label": "Testing domain",
     "accounts": [{
       "username": "demo",
       "password": "demo"
     }]
   }
  },
  "jchemMicroServices": "http://jms-gateway:8080/",
  "mjsService": "http://mjs-service:8080/"
}

Below you can find a detailed description for each option:

{info} Note: All relative paths are resolved against the location of config.json.

Database configuration

Chemistry web services configuration

Plugin configuration

License configuration

Networking configuration

Security configuration

GUI configuration

"marvinjs": {
   "templates": "./templates.mrv",
   "webservices": {
      "clean2dws": "/rest-v0/util/convert/clean",
      "molconvertws": "/rest-v0/util/calculate/molExport",
      "reactionconvertws": "/rest-v0/util/calculate/reactionExport",
      "stereoinfows": "/rest-v0/util/calculate/cipStereoInfo"
   },
  "displaySettings": {
      "toolbars": "reporting"
   }
 } 

Workflow configuration

Performance configuration

Setting up local authentication

Design Hub supports a very simple local authentication intended for personal testing or evaluation purposes. This enables all features depending on tracking users and storing profiles, without having to setup identity provider connections. Accounts are read from a list specified in config.json. Below you can find a sample:

{
 "port": 443,
 "hostname": "example.com",
 "tls": {
   "key": "/config/certs/example-com-key.pem",
   "cert": "/config/certs/example-com-cert.pem"
 },
 "secretKey": "lalilulelo",
 "authentication": {
   "test": {
     "type": "local",
     "label": "Test Ltd",
     "accounts": [
       {"username": "demo", "password": "demo"},
       {"username": "demo2", "password": "demo2"}
     ]
   }
 }
}

Setting up LDAP authentication

The application supports LDAP and LDAPS authentication, which works with Active Directory as well. The most common configuration options are supported. Below you can find a sample configuration and a full list of options:

{
 "port": 443,
 "hostname": "example.com",
 "tls": {
   "key": "/config/certs/example-com-key.pem",
   "cert": "/config/certs/example-com-cert.pem"
 },
 "secretKey": "lalilulelo",
 "authentication": {
   "corporate": {
     "type": "ldap",
     "label": "ACME Inc",
     "url": "ldaps://ipa.acme.com:636",
     "bindDn": "uid=serviceaccount,cn=accounts,dc=acme",
     "bindCredentials": "BF95KPnVD9FxyGPh",
     "searchBase": "cn=accounts,dc=acme",
     "searchFilter": "(uid={{username}})",
     "groupSearchBase": "dc=acme",
     "groupSearchFilter": "(member={{dn}})",
     "groupAttribute": ["cn"]
   }
 }
}

LDAP configuration options

{info} Note: All options described in the base library documentation are supported with further examples and descriptions given at: node-ldapauth

Setting up SAML authentication

This application uses HTTP Redirect Binding for its AuthnRequests, and expects to receive the messages back via the HTTP POST binding.

Configuration

First, you’ll need to configure the application with a host. You can do this by setting port, and hostname. Next, it’s strongly recommended to setup HTTPS with the tls settings, to make sure any login details are only transmitted over a secure channel. config.json:

{
 "port": 443,
 "hostname": "example.com",
 "tls": {
   "key": "/config/certs/example-com-key.pem",
   "cert": "/config/certs/example-com-cert.pem"
 }
}

Next, add a secretKey and configure your identity provider in authentication: config.json:

{
 "port": 443,
 "hostname": "example.com",
 "tls": {
   "key": "/config/certs/example-com-key.pem",
   "cert": "/config/certs/example-com-cert.pem"
 },
 "secretKey": "lalilulelo",
 "authentication": {
   "internal": {
     "type": "saml",
     "label": "Example",
     "entryPoint": "http://idp.example.com/oam/SSORedirect/metaAlias/apps/idp"
   }
 }
}

Registering as Service Provider

Using the domain chosen in the authentication settings, in the above example internal, the Design Hub service can be registered in the SAML provider. To help this, a service metadata descriptor is available at the following address:

https://example.com/domains/internal/metadata

The service’s issuer / entity ID is marvin-live-app and the callback URL is generated from the tls, hostname, port and domain name options.

<?xml version="1.0"?>
<EntityDescriptor xmlns="urn:oasis:names:tc:SAML:2.0:metadata" xmlns:ds="http://www.w3.org/2000/09/xmldsig#" entityID="marvin-live-app">
  <SPSSODescriptor protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol">
    <KeyDescriptor/>
    <NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified</NameIDFormat>
    <AssertionConsumerService index="1" isDefault="true" Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="https://example.com/domains/internal/callback"/>
  </SPSSODescriptor>
</EntityDescriptor>

SAML specific parameters

Further options are available, please see this third-party module’s options.

Setting up OpenID Connect authentication

The application supports OpenID Connect authentication. Below you can find a sample configuration and a full list of options:

{
 "port": 443,
 "hostname": "example.com",
 "tls": {
   "key": "/config/certs/example-com-key.pem",
   "cert": "/config/certs/example-com-cert.pem"
 },
 "secretKey": "lalilulelo",
 "authentication": {
   "corporate": {
     "type": "openId",
     "label": "ACME Inc",
     "issuer": "https://myissuer.com",
     "clientID": "dh-client",
     "clientSecret": "password",
     "callbackUrlBase": "https://example.com"
   }
 }
}

OpenID Connect specific configuration options

Marvin JS configuration

This option configures Marvin JS’s display options and services (API reference). An object is passed as configuration with the following attributes:

Reference: https://marvinjs-demo.chemaxon.com/latest/jsdoc.html

Example:

section of config.json:

...
"marvinjs": {
  "templates": "./templates.mrv",
  "webservices": {
     "clean2dws": "/rest-v1/util/convert/clean",
     "molconvertws": "/rest-v1/util/calculate/molExport",
     "reactionconvertws": "/rest-v1/util/calculate/reactionExport",
     "stereoinfows": "/rest-v1/util/calculate/cipStereoInfo"
  },
  "displaySettings": {
     "toolbars": "reporting"
  }
}
...

Groups, roles and permissions

From v20.13.0, the role based access control system can be used to assign authenticated users of the system to groups and roles/permissions can be assigned to groups.

Definings group and permissions of users

Company plugins

Design Hub's customization option - company plugins - provide scriptable interfaces to obtain the project and group membership of each user during login. This is the most versatile option to integrate with corporate resources.

See: Design Hub developer guide - company support plugins

Property of user's login information

In some cases, the user's group associations are available as an attribute of the user record. This is typically the case of ldap / Active Directory, but often it's available on JWT when using openId.

To obtain the groups of a user from the user record, please use the groupAttribute value. See

Local authentication

By adding a groups section to the domain configuration, individual groups can be added with a name (e.g. READERS or WRITERS) and a list of permissions. With local authentication, individual accounts can be assigned to a group by referencing the assigned group name on each account record.

{
  ...
  "authentication":
    "access-readonly": {
      "type": "local",
      "label": "Read-only authorization scheme",
      "groups": {
          "READERS": [
              "ACCESS_HYPOTHESES",
              "READ_NONASSIGNED_CONTENT",
              "READ_NONASSIGNED_PROJECTS",
              "JOIN_PROJECTS"
          ],
          "WRITERS": [
              "ACCESS_HYPOTHESES",
              "ADD_PROJECTS",
              "CREATE_CONTENT",
              "WRITE_NONASSIGNED_CONTENT",
              "WRITE_NONASSIGNED_PROJECTS"
              "JOIN_PROJECTS"
          ]
      },
      "accounts": [
          {"username": "vip", "password": "vip", "group": "VIP"},
          {"username": "reader", "password": "reader", "group": "READERS"},
          {"username": "writer", "password": "writer", "group": "WRITERS"}
      ]
    }
  }
  ...
}

Defining groups on the admin interface

By logging in to the admin interface and selecting the appropriate domain, the list of users and groups are displayed in small tables. These can be used to check the list of groups available in the system, permissions assigned to each group, and the group membership of users. Using the buttons in the top-right corner of the groups table, new groups can be added, and using the actions for each group, further modifications can be made.

Available permissions

Structure search advanced configuration

Design Hub is using JChem Microservices DB for indexing and searching chemical structures.

By default, the initial structure search maximum hit count is limited (limitStructureSearch) for performance reasons. In case this limit is reached Design Hub tries to refine the search by limiting the results to a subset of the whole dataset (limitFilterToIds) and running the search on the subset again still with a maximum hit count (limitFilteredStructureSearch).

The following settings are available for fine-tuning performance and correctness: