Parameter list

Click on a column header to sort table. The attribute key name can be used directly in lemonldap-ng.ini or in Perl scripts to override configuration parameters (see configuration location).

Main parameters

Key name Documentation Portal Handler Manager ini file only
ADPwdExpireWarning AD password expire warning ✔
ADPwdMaxAge AD password max age ✔
AuthLDAPFilter LDAP filter for auth search ✔
LDAPFilter Default LDAP filter ✔
SMTPAuthPass Password to use to send mails ✔
SMTPAuthUser Login to use to send mails ✔
SMTPPort Fix SMTP port ✔
SMTPServer SMTP Server ✔
SMTPTLS TLS protocol to use with SMTP ✔
SMTPTLSOpts TLS/SSL options for SMTP ✔
SSLAuthnLevel SSL authentication level ✔
SSLVar ✔
SSLVarIf ✔
activeTimer Enable timers on portal pages ✔
apacheAuthnLevel Apache authentication level ✔
applicationList Applications list ✔
authChoiceAuthBasic Auth module used by AuthBasic handler ✔
authChoiceModules Hash list of Choice strings ✔
authChoiceParam Applications list ✔
authentication Authentication module ✔
autoSigninRules List of auto signin rules ✔
available2F Available second factor modules ✔ ✔
available2FSelfRegistration Available self-registration modules for second factor ✔ ✔
browsersDontStorePassword Avoid browsers to store users password ✔
bruteForceProtection Enable brute force attack protection ✔
bruteForceProtectionMaxAge Brute force attack protection -> Max age between last and first allowed failed login ✔ ✔
bruteForceProtectionMaxFailed Brute force attack protection -> Max allowed failed login ✔ ✔
bruteForceProtectionTempo Brute force attack protection -> Tempo before try again ✔ ✔
captcha_login_enabled Captcha on login page ✔
captcha_mail_enabled Captcha on password reset page ✔
captcha_register_enabled Captcha on account creation page ✔
captcha_size Captcha size ✔
casAccessControlPolicy CAS access control policy ✔
casAppMetaDataOptions Root of CAS app options ✔ [1]
casAttr Pivot attribute for CAS ✔
casAttributes CAS exported attributes ✔
casAuthnLevel CAS authentication level ✔
casSrvMetaDataOptions Root of CAS server options ✔ [1]
casStorage Apache::Session module to store CAS user data ✔
casStorageOptions Apache::Session module parameters ✔
cda Enable Cross Domain Authentication ✔ ✔
certificateResetByMailCeaAttribute ✔
certificateResetByMailCertificateAttribute ✔
certificateResetByMailReplyTo URL of certificate reset page ✔
certificateResetByMailSender URL of certificate reset page ✔
certificateResetByMailStep1Body Custom Certificate reset mail body ✔
certificateResetByMailStep1Subject Mail subject for certificate reset email ✔
certificateResetByMailStep2Body Custom confirm Certificate reset mail body ✔
certificateResetByMailStep2Subject Mail subject for reset confirmation ✔
certificateResetByMailURL URL of certificate reset page ✔
certificateResetByMailValidityDelay ✔
cfgAuthor Name of the author of the current configuration ✔ ✔
cfgAuthorIP Uploader IP address of the current configuration ✔ ✔
cfgDate Timestamp of the current configuration ✔ ✔
cfgLog Configuration update log ✔ ✔
cfgNum Enable Cross Domain Authentication ✔ ✔
cfgVersion Version of LLNG which build configuration ✔ ✔
checkState Enable CheckState plugin ✔
checkStateSecret Secret token for CheckState plugin ✔
checkTime Timeout to check new configuration in local cache ✔ ✔ ✔
checkUser Enable check user ✔
checkUserDisplayEmptyValues Display session empty values ✔
checkUserDisplayPersistentInfo Display persistent session info ✔
checkUserHiddenAttributes Attributes to hide in CheckUser plugin ✔
checkUserIdRule checkUser identities rule ✔
checkUserSearchAttributes Attributes used for retrieving sessions in user DataBase ✔
checkXSS Check XSS ✔
combModules Combination module description ✔
combination Combination rule ✔
configStorage Configuration storage ✔ ✔ ✔ ✔
confirmFormMethod HTTP method for confirm page form ✔
contextSwitchingIdRule Context switching identities rule ✔
contextSwitchingRule Context switching activation rule ✔
contextSwitchingStopWithLogout Stop context switching by logout ✔
cookieExpiration Cookie expiration ✔ ✔
cookieName Name of the main cookie ✔ ✔
corsAllow_Credentials Allow credentials for Cross-Origin Resource Sharing ✔
corsAllow_Headers Allowed headers for Cross-Origin Resource Sharing ✔
corsAllow_Methods Allowed methods for Cross-Origin Resource Sharing ✔
corsAllow_Origin Allowed origine for Cross-Origin Resource Sharing ✔
corsEnabled Enable Cross-Origin Resource Sharing ✔
corsExpose_Headers Exposed headers for Cross-Origin Resource Sharing ✔
corsMax_Age MAx-age for Cross-Origin Resource Sharing ✔
cspConnect Authorized Ajax destination for Content-Security-Policy ✔
cspDefault Default value for Content-Security-Policy ✔
cspFont Font source for Content-Security-Policy ✔
cspFormAction Form action destination for Content-Security-Policy ✔
cspImg Image source for Content-Security-Policy ✔
cspScript Javascript source for Content-Security-Policy ✔
cspStyle Style source for Content-Security-Policy ✔
customAddParams Custom additional parameters ✔
customAuth Custom auth module ✔
customFunctions List of custom functions ✔ ✔ ✔
customPassword Custom password module ✔
customPlugins Custom plugins ✔
customPluginsParams Custom plugins parameters ✔
customRegister Custom register module ✔
customToTrace Session parameter used to fill REMOTE_CUSTOM ✔ ✔
customUserDB Custom user DB module ✔
dbiAuthChain ✔
dbiAuthLoginCol ✔
dbiAuthPassword ✔
dbiAuthPasswordCol ✔
dbiAuthPasswordHash ✔
dbiAuthTable ✔
dbiAuthUser ✔
dbiAuthnLevel DBI authentication level ✔
dbiDynamicHashEnabled ✔
dbiDynamicHashNewPasswordScheme ✔
dbiDynamicHashValidSaltedSchemes ✔
dbiDynamicHashValidSchemes ✔
dbiExportedVars DBI exported variables ✔
dbiPasswordMailCol ✔
dbiUserChain ✔
dbiUserPassword ✔
dbiUserTable ✔
dbiUserUser ✔
decryptValueFunctions Custom function used for decrypting values ✔
decryptValueRule Decrypt value activation rule ✔
demoExportedVars Demo exported variables ✔
disablePersistentStorage Enabled persistent storage ✔
domain DNS domain ✔ ✔
dontCompactConf Don t compact configuration ✔
exportedAttr List of attributes to export by SOAP or REST servers ✔
exportedVars Main exported variables ✔
ext2FSendCommand Send command of External second factor ✔
ext2FValidateCommand Validation command of External second factor ✔
ext2fActivation External second factor activation ✔
ext2fAuthnLevel Authentication level for users authentified by External second factor ✔
ext2fCodeActivation OTP generated by Portal ✔
ext2fLabel Portal label for External second factor ✔
ext2fLogo Custom logo for External 2F ✔
facebookAppId ✔
facebookAppSecret ✔
facebookAuthnLevel Facebook authentication level ✔
facebookExportedVars Facebook exported variables ✔
facebookUserField ✔
failedLoginNumber Number of failures stored in login history ✔
forceGlobalStorageIssuerOTT Force Issuer tokens to be stored into Global Storage ✔ ✔
forceGlobalStorageUpgradeOTT Force Upgrade tokens be stored into Global Storage ✔ ✔
formTimeout Token timeout for forms ✔
globalLogoutRule Global logout activation rule ✔
globalLogoutTimer Global logout auto accept time ✔
globalStorage Session backend module ✔ ✔
globalStorageOptions Session backend module options ✔ ✔
gpgAuthnLevel GPG authentication level ✔
gpgDb GPG keys database ✔
grantSessionRules Rules to grant sessions ✔
groups Groups ✔
groupsBeforeMacros Compute groups before macros, so that a macro may refer to $groups or $hGroups ✔
handlerInternalCache Handler internal cache timeout ✔ ✔ ✔
handlerServiceTokenTTL Handler ServiceToken timeout ✔ ✔ ✔
hiddenAttributes Name of attributes to hide in logs ✔
hideOldPassword Hide old password in portal ✔
httpOnly Enable httpOnly flag in cookie ✔ ✔
https Use HTTPS for redirection from portal ✔
impersonationHiddenAttributes Attributes to skip ✔
impersonationIdRule Impersonation identities rule ✔
impersonationMergeSSOgroups Merge spoofed and real SSO groups ✔
impersonationPrefix Prefix to rename real session attributes ✔ ✔
impersonationRule Impersonation activation rule ✔
impersonationSkipEmptyValues Skip session empty values ✔
infoFormMethod HTTP method for info page form ✔
issuerDBCASActivation CAS server activation ✔
issuerDBCASPath CAS server request path ✔
issuerDBCASRule CAS server rule ✔
issuerDBGetActivation Get issuer activation ✔
issuerDBGetParameters List of virtualHosts with their get parameters ✔
issuerDBGetPath Get issuer request path ✔
issuerDBGetRule Get issuer rule ✔
issuerDBOpenIDActivation OpenID server activation ✔
issuerDBOpenIDConnectActivation OpenID Connect server activation ✔
issuerDBOpenIDConnectPath OpenID Connect server request path ✔
issuerDBOpenIDConnectRule OpenID Connect server rule ✔
issuerDBOpenIDPath OpenID server request path ✔
issuerDBOpenIDRule OpenID server rule ✔
issuerDBSAMLActivation SAML IDP activation ✔
issuerDBSAMLPath SAML IDP request path ✔
issuerDBSAMLRule SAML IDP rule ✔
issuersTimeout Token timeout for issuers ✔
jsRedirect Use javascript for redirections ✔
key Secret key ✔
krbAuthnLevel Null authentication level ✔
krbByJs Launch Kerberos authentication by Ajax ✔
krbKeytab Kerberos keytab ✔
krbRemoveDomain Remove domain in Kerberos username ✔
ldapAllowResetExpiredPassword Allow a user to reset his expired password ✔
ldapAuthnLevel LDAP authentication level ✔
ldapBase LDAP search base ✔
ldapChangePasswordAsUser ✔
ldapExportedVars LDAP exported variables ✔
ldapGroupAttributeName LDAP attribute name for member in groups ✔
ldapGroupAttributeNameGroup LDAP attribute name in group entry referenced as member in groups ✔
ldapGroupAttributeNameSearch LDAP attributes to search in groups ✔
ldapGroupAttributeNameUser LDAP attribute name in user entry referenced as member in groups ✔
ldapGroupBase ✔
ldapGroupDecodeSearchedValue Decode value before searching it in LDAP groups ✔
ldapGroupObjectClass LDAP object class of groups ✔
ldapGroupRecursive LDAP recursive search in groups ✔
ldapITDS Support for IBM Tivoli Directory Server ✔
ldapPasswordResetAttribute LDAP password reset attribute ✔
ldapPasswordResetAttributeValue LDAP password reset value ✔
ldapPort LDAP port ✔
ldapPpolicyControl ✔
ldapPwdEnc LDAP password encoding ✔
ldapRaw ✔
ldapSearchDeref "deref" param of Net::LDAP::search() ✔
ldapServer LDAP server (host or URI) ✔
ldapSetPassword ✔
ldapTimeout LDAP connection timeout ✔
ldapUsePasswordResetAttribute LDAP store reset flag in an attribute ✔
ldapVersion LDAP protocol version ✔
linkedInAuthnLevel LinkedIn authentication level ✔
linkedInClientID ✔
linkedInClientSecret ✔
linkedInFields ✔
linkedInScope ✔
linkedInUserField ✔
localSessionStorage Local sessions cache module ✔
localSessionStorageOptions Sessions cache module options ✔
localStorage Local cache ✔ ✔ ✔ ✔
localStorageOptions Local cache parameters ✔ ✔ ✔ ✔
log4perlConfFile Log4Perl logger configuration file ✔ ✔ ✔ ✔
logLevel Log level, must be set in .ini ✔ ✔ ✔ ✔
logger technical logger ✔ ✔ ✔ ✔
loginHistoryEnabled Enable login history ✔
logoutServices Send logout trough GET request to these services ✔
lwpOpts Options given to LWP::UserAgent ✔
lwpSslOpts SSL options given to LWP::UserAgent ✔
macros Macros ✔
mail2fActivation Mail second factor activation ✔
mail2fAuthnLevel Authentication level for users authenticated by Mail second factor ✔
mail2fBody Mail body for second factor authentication ✔
mail2fCodeRegex Regular expression to create a mail OTP code ✔
mail2fLabel Portal label for Mail second factor ✔
mail2fLogo Custom logo for Mail 2F ✔
mail2fSubject Mail subject for second factor authentication ✔
mail2fTimeout Second factor code timeout ✔
mailBody Custom password reset mail body ✔
mailCharset Mail charset ✔
mailConfirmBody Custom confirm password reset mail body ✔
mailConfirmSubject Mail subject for reset confirmation ✔
mailFrom Sender email ✔
mailLDAPFilter LDAP filter for mail search ✔
mailOnPasswordChange Send a mail when password is changed ✔
mailReplyTo Reply-To address ✔
mailSessionKey Session parameter where mail is stored ✔
mailSubject Mail subject for new password email ✔
mailTimeout Mail password reset session timeout ✔
mailUrl URL of password reset page ✔
maintenance Maintenance mode for all virtual hosts ✔
managerDn LDAP manager DN ✔
managerPassword LDAP manager Password ✔
max2FDevices Maximum registered 2F devices ✔ ✔
max2FDevicesNameLength Maximum 2F devices name length ✔ ✔
multiValuesSeparator Separator for multiple values ✔ ✔ ✔
mySessionAuthorizedRWKeys Alterable session keys by user itself ✔ ✔
nginxCustomHandlers Custom Nginx handler (deprecated) ✔
noAjaxHook Avoid replacing 302 by 401 for Ajax responses ✔
notification Notification activation ✔
notificationDefaultCond Notification default condition ✔
notificationServer Notification server activation ✔
notificationServerDELETE Notification server activation ✔
notificationServerGET Notification server activation ✔
notificationServerPOST Notification server activation ✔
notificationServerSentAttributes Prameters to send with notification server GET method ✔
notificationStorage Notification backend ✔
notificationStorageOptions Notification backend options ✔
notificationWildcard Notification string to match all users ✔
notificationXSLTfile Custom XSLT document for notifications ✔
notifyDeleted Show deleted sessions in portal ✔
notifyOther Show other sessions in portal ✔
nullAuthnLevel Null authentication level ✔
oidcAuthnLevel OpenID Connect authentication level ✔
oidcOPMetaDataOptions ✔ [1]
oidcRPCallbackGetParam OpenID Connect Callback GET URLparameter ✔
oidcRPMetaDataOptions ✔ [1]
oidcRPStateTimeout OpenID Connect Timeout of state sessions ✔
oidcServiceAccessTokenExpiration OpenID Connect global access token TTL ✔
oidcServiceAllowAuthorizationCodeFlow OpenID Connect allow authorization code flow ✔
oidcServiceAllowDynamicRegistration OpenID Connect allow dynamic client registration ✔
oidcServiceAllowHybridFlow OpenID Connect allow hybrid flow ✔
oidcServiceAllowImplicitFlow OpenID Connect allow implicit flow ✔
oidcServiceAuthorizationCodeExpiration OpenID Connect global code TTL ✔
oidcServiceDynamicRegistrationExportedVars OpenID Connect exported variables for dynamic registration ✔
oidcServiceDynamicRegistrationExtraClaims OpenID Connect extra claims for dynamic registration ✔
oidcServiceIDTokenExpiration OpenID Connect global ID token TTL ✔
oidcServiceKeyIdSig OpenID Connect Signature Key ID ✔
oidcServiceMetaDataAuthnContext OpenID Connect Authentication Context Class Ref ✔
oidcServiceMetaDataAuthorizeURI OpenID Connect authorizaton endpoint ✔
oidcServiceMetaDataBackChannelURI OpenID Connect Front-Channel logout endpoint ✔
oidcServiceMetaDataCheckSessionURI OpenID Connect check session iframe ✔
oidcServiceMetaDataEndSessionURI OpenID Connect end session endpoint ✔
oidcServiceMetaDataFrontChannelURI OpenID Connect Front-Channel logout endpoint ✔
oidcServiceMetaDataIntrospectionURI OpenID Connect introspection endpoint ✔
oidcServiceMetaDataIssuer OpenID Connect issuer ✔
oidcServiceMetaDataJWKSURI OpenID Connect JWKS endpoint ✔
oidcServiceMetaDataRegistrationURI OpenID Connect registration endpoint ✔
oidcServiceMetaDataTokenURI OpenID Connect token endpoint ✔
oidcServiceMetaDataUserInfoURI OpenID Connect user info endpoint ✔
oidcServiceOfflineSessionExpiration OpenID Connect global offline session TTL ✔
oidcServicePrivateKeySig ✔
oidcServicePublicKeySig ✔
oidcStorage Apache::Session module to store OIDC user data ✔
oidcStorageOptions Apache::Session module parameters ✔
oldNotifFormat Use old XML format for notifications ✔
openIdAttr ✔
openIdAuthnLevel OpenID authentication level ✔
openIdExportedVars OpenID exported variables ✔
openIdIDPList ✔
openIdIssuerSecret ✔
openIdSPList ✔
openIdSecret ✔
openIdSreg_country ✔
openIdSreg_dob ✔
openIdSreg_email OpenID SREG email session parameter ✔
openIdSreg_fullname OpenID SREG fullname session parameter ✔
openIdSreg_gender ✔
openIdSreg_language ✔
openIdSreg_nickname OpenID SREG nickname session parameter ✔
openIdSreg_postcode ✔
openIdSreg_timezone OpenID SREG timezone session parameter ✔
pamAuthnLevel PAM authentication level ✔
pamService PAM service ✔
passwordDB Password module ✔
passwordPolicyMinDigit Password policy: minimal digit characters ✔
passwordPolicyMinLower Password policy: minimal lower characters ✔
passwordPolicyMinSize Password policy: minimal size ✔
passwordPolicyMinUpper Password policy: minimal upper characters ✔
passwordResetAllowedRetries Maximum number of retries to reset password ✔
pdataDomain pdata cookie DNS domain ✔ ✔ ✔
persistentStorage Storage module for persistent sessions ✔
persistentStorageOptions Options for persistent sessions storage module ✔
port Force port in redirection ✔
portal Portal URL ✔ ✔ ✔
portalAntiFrame Avoid portal to be displayed inside frames ✔
portalCheckLogins Display login history checkbox in portal ✔
portalDisplayAppslist Display applications tab in portal ✔
portalDisplayCertificateResetByMail Display Certificate Reset by mail tab in portal ✔
portalDisplayChangePassword Display password tab in portal ✔
portalDisplayGeneratePassword Display password generate box in reset password form ✔
portalDisplayLoginHistory Display login history tab in portal ✔
portalDisplayLogout Display logout tab in portal ✔
portalDisplayOidcConsents Display OIDC consent tab in portal ✔
portalDisplayPasswordPolicy Display policy in password form ✔
portalDisplayRegister Display register button in portal ✔
portalDisplayResetPassword Display reset password button in portal ✔
portalErrorOnExpiredSession Show error if session is expired ✔
portalErrorOnMailNotFound Show error if mail is not found in password reset process ✔
portalForceAuthn Enable force to authenticate when displaying portal ✔
portalForceAuthnInterval Maximum interval in seconds since last authentication to force reauthentication ✔
portalMainLogo Portal main logo path ✔
portalOpenLinkInNewWindow Open applications in new windows ✔
portalPingInterval Interval in ms between portal Ajax pings ✔
portalRequireOldPassword Old password is required to change the password ✔
portalSkin Name of portal skin ✔
portalSkinBackground Background image of portal skin ✔
portalSkinRules Rules to choose portal skin ✔
portalStatus Enable portal status ✔
portalUserAttr Session parameter to display connected user in portal ✔
protection Manager protection method ✔ ✔ ✔
proxyAuthService ✔
proxyAuthnLevel Proxy authentication level ✔
proxySessionService ✔
proxyUseSoap Use SOAP instead of REST ✔
radius2fActivation Radius second factor activation ✔
radius2fAuthnLevel Authentication level for users authenticated by Radius second factor ✔
radius2fLabel Portal label for Radius 2F ✔
radius2fLogo Custom logo for Radius 2F ✔
radius2fSecret ✔
radius2fServer ✔
radius2fTimeout Radius 2f verification timeout ✔
radius2fUsernameSessionKey Session key used as Radius login ✔
radiusAuthnLevel Radius authentication level ✔
radiusSecret ✔
radiusServer ✔
randomPasswordRegexp Regular expression to create a random password ✔
redirectFormMethod HTTP method for redirect page form ✔
refreshSessions Refresh sessions plugin ✔
registerConfirmSubject Mail subject for register confirmation ✔
registerDB Register module ✔
registerDoneSubject Mail subject when register is done ✔
registerTimeout Register session timeout ✔
registerUrl URL of register page ✔
reloadTimeout Configuration reload timeout ✔
reloadUrls URL to call on reload ✔
remoteCookieName ✔
remoteGlobalStorage Remote session backend ✔
remoteGlobalStorageOptions Apache::Session module parameters ✔
remotePortal ✔
requireToken Enable token for forms ✔
rest2fActivation REST second factor activation ✔
rest2fAuthnLevel Authentication level for users authentified by REST second factor ✔
rest2fInitArgs Args for REST 2F init ✔
rest2fInitUrl REST 2F init URL ✔
rest2fLabel Portal label for REST second factor ✔
rest2fLogo Custom logo for REST 2F ✔
rest2fVerifyArgs Args for REST 2F init ✔
rest2fVerifyUrl REST 2F init URL ✔
restAuthUrl ✔
restAuthnLevel REST authentication level ✔
restClockTolerance How tolerant the REST session server will be to clock dift ✔
restConfigServer Enable REST config server ✔
restExportSecretKeys Allow to export secret keys in REST session server ✔
restPwdConfirmUrl ✔
restPwdModifyUrl ✔
restSessionServer Enable REST session server ✔
restUserDBUrl ✔
samlAttributeAuthorityDescriptorAttributeServiceSOAP SAML Attribute Authority SOAP ✔
samlAuthnContextMapKerberos SAML authn context kerberos level ✔
samlAuthnContextMapPassword SAML authn context password level ✔
samlAuthnContextMapPasswordProtectedTransport SAML authn context password protected transport level ✔
samlAuthnContextMapTLSClient SAML authn context TLS client level ✔
samlCommonDomainCookieActivation SAML CDC activation ✔
samlCommonDomainCookieDomain ✔
samlCommonDomainCookieReader ✔
samlCommonDomainCookieWriter ✔
samlDiscoveryProtocolActivation SAML Discovery Protocol activation ✔
samlDiscoveryProtocolIsPassive SAML Discovery Protocol Is Passive ✔
samlDiscoveryProtocolPolicy SAML Discovery Protocol Policy ✔
samlDiscoveryProtocolURL SAML Discovery Protocol EndPoint URL ✔
samlEntityID SAML service entityID ✔
samlIDPMetaDataOptions ✔ [1]
samlIDPSSODescriptorArtifactResolutionServiceArtifact SAML IDP artifact resolution service ✔
samlIDPSSODescriptorSingleLogoutServiceHTTPPost SAML IDP SLO HTTP POST ✔
samlIDPSSODescriptorSingleLogoutServiceHTTPRedirect SAML IDP SLO HTTP Redirect ✔
samlIDPSSODescriptorSingleLogoutServiceSOAP SAML IDP SLO SOAP ✔
samlIDPSSODescriptorSingleSignOnServiceHTTPArtifact SAML IDP SSO HTTP Artifact ✔
samlIDPSSODescriptorSingleSignOnServiceHTTPPost SAML IDP SSO HTTP POST ✔
samlIDPSSODescriptorSingleSignOnServiceHTTPRedirect SAML IDP SSO HTTP Redirect ✔
samlIDPSSODescriptorWantAuthnRequestsSigned SAML IDP want authn request signed ✔
samlMetadataForceUTF8 SAML force metadata UTF8 conversion ✔
samlNameIDFormatMapEmail SAML session parameter for NameID email ✔
samlNameIDFormatMapKerberos SAML session parameter for NameID kerberos ✔
samlNameIDFormatMapWindows SAML session parameter for NameID windows ✔
samlNameIDFormatMapX509 SAML session parameter for NameID x509 ✔
samlOrganizationDisplayName SAML service organization display name ✔
samlOrganizationName SAML service organization name ✔
samlOrganizationURL SAML service organization URL ✔
samlOverrideIDPEntityID Override SAML EntityID when acting as an IDP ✔
samlRelayStateTimeout SAML timeout of relay state ✔
samlSPMetaDataOptions ✔ [1]
samlSPSSODescriptorArtifactResolutionServiceArtifact SAML SP artifact resolution service ✔
samlSPSSODescriptorAssertionConsumerServiceHTTPArtifact SAML SP ACS HTTP artifact ✔
samlSPSSODescriptorAssertionConsumerServiceHTTPPost SAML SP ACS HTTP POST ✔
samlSPSSODescriptorAuthnRequestsSigned SAML SP AuthnRequestsSigned ✔
samlSPSSODescriptorSingleLogoutServiceHTTPPost SAML SP SLO HTTP POST ✔
samlSPSSODescriptorSingleLogoutServiceHTTPRedirect SAML SP SLO HTTP Redirect ✔
samlSPSSODescriptorSingleLogoutServiceSOAP SAML SP SLO SOAP ✔
samlSPSSODescriptorWantAssertionsSigned SAML SP WantAssertionsSigned ✔
samlServicePrivateKeyEnc SAML encryption private key ✔
samlServicePrivateKeyEncPwd ✔
samlServicePrivateKeySig SAML signature private key ✔
samlServicePrivateKeySigPwd SAML signature private key password ✔
samlServicePublicKeyEnc SAML encryption public key ✔
samlServicePublicKeySig SAML signature public key ✔
samlServiceSignatureMethod ✔
samlServiceUseCertificateInResponse Use certificate instead of public key in SAML responses ✔
samlStorage Apache::Session module to store SAML user data ✔
samlStorageOptions Apache::Session module parameters ✔
samlUseQueryStringSpecific SAML use specific method for query_string ✔
secureTokenAllowOnError Secure Token allow requests in error ✔ ✔
secureTokenAttribute Secure Token attribute ✔ ✔
secureTokenExpiration Secure Token expiration ✔ ✔
secureTokenHeader Secure Token header ✔ ✔
secureTokenMemcachedServers Secure Token Memcached servers ✔ ✔
secureTokenUrls ✔ ✔
securedCookie Cookie securisation method ✔ ✔
sentryDsn Sentry logger DSN ✔ ✔ ✔ ✔
sessionDataToRemember Data to remember in login history ✔
sfEngine Second factor engine ✔ ✔
sfExtra Extra second factors ✔
sfRemovedMsgRule Display a message if at leat one expired SF has been removed ✔
sfRemovedNotifMsg Notification message ✔
sfRemovedNotifRef Notification reference ✔
sfRemovedNotifTitle Notification title ✔
sfRemovedUseNotif Use Notifications plugin to display message ✔
sfRequired Second factor required ✔
showLanguages Display langs icons ✔
singleIP Allow only one session per IP ✔
singleSession Allow only one session per user ✔
singleSessionUserByIP Allow only one session per user on an IP ✔
singleUserByIP Allow only one user per IP ✔
skipRenewConfirmation Avoid asking confirmation when an Issuer asks to renew auth ✔
slaveAuthnLevel Slave authentication level ✔
slaveDisplayLogo Display Slave authentication logo ✔
slaveExportedVars Slave exported variables ✔
slaveHeaderContent ✔
slaveHeaderName ✔
slaveMasterIP ✔
slaveUserHeader ✔
soapConfigServer Enable SOAP config server ✔
soapSessionServer Enable SOAP session server ✔
sslByAjax Use Ajax request for SSL ✔
sslHost URL for SSL Ajax request ✔
staticPrefix Prefix of static files for HTML templates ✔ ✔
status Status daemon activation ✔ ✔
stayConnected Enable StayConnected plugin ✔
storePassword Store password in session ✔
successLoginNumber Number of success stored in login history ✔
syslogFacility Syslog logger technical facility ✔ ✔ ✔ ✔
timeout Session timeout on server side ✔
timeoutActivity Session activity timeout on server side ✔
timeoutActivityInterval Update session timeout interval on server side ✔
tokenUseGlobalStorage Enable global token storage ✔
totp2fActivation TOTP activation ✔
totp2fAuthnLevel Authentication level for users authentified by password+TOTP ✔
totp2fDigits Number of digits for TOTP code ✔
totp2fDisplayExistingSecret Display existing TOTP secret in registration form ✔
totp2fInterval TOTP interval ✔
totp2fIssuer TOTP Issuer ✔
totp2fLabel Portal label for TOTP 2F ✔
totp2fLogo Custom logo for TOTP 2F ✔
totp2fRange TOTP range (number of interval to test) ✔
totp2fSelfRegistration TOTP self registration activation ✔
totp2fTTL TOTP device time to live ✔
totp2fUserCanChangeKey Authorize users to change existing TOTP secret ✔
totp2fUserCanRemoveKey Authorize users to remove existing TOTP secret ✔
trustedDomains Trusted domains ✔
twitterAppName ✔
twitterAuthnLevel Twitter authentication level ✔
twitterKey ✔
twitterSecret ✔
twitterUserField ✔
u2fActivation U2F activation ✔
u2fAuthnLevel Authentication level for users authentified by password+U2F ✔
u2fLabel Portal label for U2F ✔
u2fLogo Custom logo for U2F ✔
u2fSelfRegistration U2F self registration activation ✔
u2fTTL U2F device time to live ✔
u2fUserCanRemoveKey Authorize users to remove existing U2F key ✔
upgradeSession Upgrade session activation ✔
useRedirectOnError Use 302 redirect code for error (500) ✔
useRedirectOnForbidden Use 302 redirect code for forbidden (403) ✔
useSafeJail Activate Safe jail ✔ ✔
userControl Regular expression to validate login ✔
userDB User module ✔
userLogger User actions logger ✔ ✔ ✔ ✔
userPivot ✔
userSyslogFacility Syslog logger user-actions facility ✔ ✔ ✔ ✔
utotp2fActivation UTOTP activation (mixed U2F/TOTP module) ✔
utotp2fAuthnLevel Authentication level for users authentified by password+(U2F or TOTP) ✔
utotp2fLabel Portal label for U2F+TOTP ✔
utotp2fLogo Custom logo for U2F+TOTP ✔
vhostOptions ✔ [1]
viewerAllowBrowser Allow configuration browser ✔ ✔
viewerAllowDiff Allow configuration diff ✔ ✔
viewerHiddenKeys Hidden Conf keys ✔ ✔
webIDAuthnLevel WebID authentication level ✔
webIDExportedVars WebID exported variables ✔
webIDWhitelist ✔
whatToTrace Session parameter used to fill REMOTE_USER ✔ ✔
wsdlServer Enable /portal.wsdl server ✔
yubikey2fActivation Yubikey second factor activation ✔
yubikey2fAuthnLevel Authentication level for users authentified by Yubikey second factor ✔
yubikey2fClientID Yubico client ID ✔
yubikey2fLabel Portal label for Yubikey second factor ✔
yubikey2fLogo Custom logo for Yubikey 2F ✔
yubikey2fNonce Yubico nonce ✔
yubikey2fPublicIDSize Yubikey public ID size ✔
yubikey2fSecretKey Yubico secret key ✔
yubikey2fSelfRegistration Yubikey self registration activation ✔
yubikey2fTTL Yubikey device time to live ✔
yubikey2fUrl Yubico server ✔
yubikey2fUserCanRemoveKey Authorize users to remove existing Yubikey ✔
zimbraAccountKey Zimbra account session key ✔ ✔
zimbraBy Zimbra account type ✔ ✔
zimbraPreAuthKey Zimbra preauthentication key ✔ ✔
zimbraSsoUrl Zimbra local SSO URL pattern ✔ ✔
zimbraUrl Zimbra preauthentication URL ✔ ✔

[1]: complex nodes

Configuration backend parameters

Full name Key name Configuration backend
Configuration load timeout confTimeout all backends (default: 10)
Directory dirName File
DBI connection string dbiChain CDBI / RDBI
DBI user dbiUser
DBI password dbiPassword
DBI table name dbiTable
Storage directory dirName File / YAML
LDAP server ldapServer LDAP
LDAP port ldapPort
LDAP base ldapConfBase
LDAP bind dn ldapBindDN
LDAP bind password ldapBindPassword
LDAP ObjectClass ldapObjectClass
LDAP ID attribute ldapAttributeId
LDAP content attribute ldapAttributeContent
Certificate authorities file caFile
Certificate authorities directory caPath
MongoDB database dbName MongoDB
MongoDB collection collectionName
REST base URL baseUrl REST
REST realm realm
REST user user
REST password password
SOAP server location (URL) proxy SOAP
LWP::UserAgent parameters proxyOptions
SOAP user User
SOAP password Password