The following table provides definitions and sample data for the settings in the integrationserver.ini configuration file. This table displays the INI settings under group headings in brackets, for example, [General], in the order the groups appear in the INI file. Each setting offers two or more options, which are defined in the table below along with a description of each setting and its options. Use this table as a guide when customizing the file.
| Group | Setting | Options | Description |
|---|---|---|---|
| General | server.ip.address | Any valid and explicit IP address |
The IP address of the Perceptive Content server to use. For example, server.ip.address=localhost |
| General | server.port | Any valid port |
Specifies the port number of the Perceptive Content Server. For example, server.port=6000 The default is 6000. |
| General | session.cookie.samesite.policy |
UNSET NONE LAX STRICT |
Specifies the SameSite policy set on session cookies. The default is UNSET. |
| General | session.load.balancer.cookie.enabled |
TRUE FALSE |
Enables setting session affinity cookies on Integration Server
client requests. This cookie sets when a user session is
established. After a session is established this cookie must be
provided with subsequent requests to Integration Server. Note: Ensure session.cookie.samesite.policy is
set appropriately based on whether clients need to support
cross-domain requests.
The default is FALSE. |
| General | session.load.balancer.cookie.name | Any valid RFC6265 compliant cookie name |
The name of the load balancer session affinity cookie that is set when session.load.balancer.cookie.enabled is TRUE. Each instance of a discrete Integration Server load balancing pool should use the same cookie name and each discrete Integration Server load balancing pool should use a unique cookie name. The default is ISLBPOOL01. |
| General | session.load.balancer.cookie.httponly |
TRUE FALSE |
Specifies the HttpOnly flag on session affinity cookies. Disabling this setting allows load balancer cookies to be exposed as document cookies for JavasScript web clients. The default is TRUE. |
| General | session.timeout | Any positive number |
Specifies the connection timeout in minutes. For example, session.timeout=60 The default is 60. |
| General | session.csrf.query.parameter.enabled |
TRUE FALSE |
Enables support for accepting anti-CSRF tokens as query parameters. When disabled, the anti-CSRF token must be provided as a request header when using cookie authentication. The default is TRUE. |
| General | connection.timeout.logon | Any positive number |
Specifies how many seconds to wait for successful logon before terminating the connection. The default is 30. |
| General | connection.timeout.search | Any positive number |
Specifies how many seconds to wait for search calls before terminating the connection. The default is 30. |
| General | connection.timeout.erm | Any positive number |
Specifies how many seconds to wait for ERM before terminating the connection. The default is 30. |
| General | connection.timeout.default | Any positive number |
Specifies how many seconds to wait for server calls before terminating the connection. The default is 30. |
| General | connection.socket.keep.alive.enabled |
TRUE FALSE |
Sets the SO_KEEPALIVE socket option on server connections. This enables keep-alive packets for the socket connection. The default is FALSE. |
| General | connection.timeout.socket | Any positive number |
Specifies how many seconds to wait for a successful socket connection to Perceptive Content Server before terminating the connection. The default is 1. |
| General | connection.use.generic.login.error.messages |
TRUE FALSE |
Specifies whether to return generic error messages when login errors occur. When disabled, allows more detailed error messages to be returned. Detailed error messages are always logged regardless of this setting. TRUE = Enable generic login error messages. FALSE = Disable generic login error messages and allow more detailed error messages. We recommend you enable this setting in production environments. The default is TRUE. |
| General | ratelimiter.tracking.period.max.requests | Any positive number |
Specifies the number of times each rate limited endpoint can be called within a thirty minute interval. If this limit is exceeded than all clients will receive a 429 status code until the current time interval has expired. The default is 560. |
| General | server.call.retry.count | Any positive number or 1 |
Specifies the number of times the system attempts a call after a read timeout occurs. If you set the value to 0, the system will not attempt a retry. The default is 1. |
| General | server.call.timeout.retry.enabled |
TRUE FALSE |
Specifies if a server call should be retried after a socket timeout occurs. For example, server.call.timeout.retry.enabled=true The default is TRUE. |
| General | stream.cutoff.size | Any positive number |
Specifies the maximum size in bytes of a file transfer that will be stored within memory. File transfers exceeding this value are written to a temporary file instead. The default is 1048576. |
| General | stream.transfer.chunk.size | Any positive number |
Specifies the chunked data size in bytes to use when buffering an uploaded file during an Integration Server call. This setting should be smaller than the stream.cutoff.size. The default is 61440. |
| Logging | log.level | 0 through 7 |
This setting specifies the verboseness of the logging that Integration Server uses to log errors for troubleshooting. The higher the number, the more verbose the logging. Typically, set a minimal logging level unless debugging an issue. If logging is increased, make sure the logging level is reset to a lower level after the debugging is finished. Failure to do so can greatly affect performance and disk space. 0 = Logging is turned off (do not use) 1 = FATAL 2 = ERROR 3 = WARN 4 = INFO 5 = DEBUG 6 = TRACE 7 = ALL A logging level logs all information for that level and the lower levels. For example, if logging is set to 4, logging is turned on for levels 4, 3, 2, and 1. The default is 2. |
| Logging | log.level.thirdparties | 0 through 7 |
Specifies the level Integration Server uses to logs messages from third-party libraries, such as the Spring Framework. The higher the number, the more verbose the logging. Typically, set a minimal logging level unless debugging an issue. If logging is increased, make sure the logging level is reset to a lower level after the debugging is finished. Failure to do so can greatly affect performance and disk space. Setting log.level.thirdparties is not recommended in production environments. This setting may result in sensitive information being logged. 0 = Logging is turned off (do not use) 1 = FATAL 2 = ERROR 3 = WARN 4 = INFO 5 = DEBUG 6 = TRACE 7 = ALL A logging level logs all information for that level and the lower levels. For example, if logging is set to 4, logging is turned on for levels 4, 3, 2, and 1. The default is 2. |
| Logging | log.timing.enabled |
TRUE FALSE |
Specifies if timing logging should be enabled. Timing logging outputs a small message when a request or response is transmitted. FALSE = Timing logging is disabled TRUE = Timing logging is enabled The default is FALSE. |
| Logging | log.interceptor.enabled |
TRUE FALSE |
Specifies if interceptor logging should be enabled. Interceptor logging outputs the full request and response messages transmitted, which aids in debugging. FALSE = Interceptor logging is disabled TRUE = Interceptor logging is enabled The default is FALSE. |
| Logging | log.line.pattern | Any conversion pattern (including literal text) using valid specifiers and modifiers. | This setting formats the output of a logging event as a string of
literal text. Each conversion specifier starts with a percent sign
(%) and is followed by optional format modifiers and a conversion
pattern name. The conversion pattern name specifies the type of
data, such as logger, level, date, and so on. The format modifiers
control such things as field width, padding, and justification. Note: This pattern adheres to the Log4j
PatternLayout standard.
|
| Logging | log.directory | Any valid path |
Specifies the path to the directory that contains the log files. It is assumed that the Integration Server is installed and running on the same system as Perceptive Content Server. The default is C:/inserver/logs |
| Logging | log.rolling.interval | MONTH, DAY, or HOUR |
This setting specifies the amount of time data is stored in a log file before the data is archived to another file. This keeps log files from becoming too large. The default is DAY. |
| Logging | log.max.history | Any positive number. |
This setting is a threshold for the maximum number of log files that are retained. One file is created each day, hour, or month depending on the log.rolling.interval setting. Note: This setting excludes the log file that
is currently being used to record events. For example, if
log.max.history is set to 3 and the log.rolling.interval is set
to DAY, then today’s log file plus three additional log files
exist for four log files.
The default is 28. Giving this setting a value of 0 indicates that there should be no maximum number of log files retained. In other words, log files will not be automatically deleted. |
| Logging | log.memory.time.travel.logging.enabled |
TRUE FALSE |
This setting specifies if the last 200 lines of log should be
held in memory, for each connection. CAUTION: Enabling this setting has a large impact on
memory usage.
TRUE = Additional memory is used to store the last 200 lines of log in memory. FALSE = No additional memory is used to store log messages in memory. The default is FALSE. |
| Preferences | preferences.service.url | Any valid URL |
This setting specifies the base URL for the Preferences Service. The default ishttp://localhost:5600/ |
| Preferences | preferences.service.jwt.key.id | Any valid string |
This setting specifies the JWT kid (key ID) header value that Integration Server sends to the Preferences Service. This value must match a configured key in the Preferences Service configuration. There is no default value. |
| Preferences | preferences.service.jwt.hash.algorithm | Any valid JWT signing algorithm identifier supported by the Preferences Service (for example, RS256) |
This setting specifies the JWT alg (algorithm) header value that Integration Server uses when generating JWTs for the Preferences Service. There is no default value. |
| Preferences | preferences.service.keystore.location | Any valid file path location |
This setting specifies the file path location of the Java keystore that contains the private key used to sign JWTs for the Preferences Service. A forward slash (/) should be used as the file separator. There is no default value. |
| Preferences | preferences.service.keystore.password | Any valid password |
This setting specifies the password used to open the Java keystore defined by preferences.service.keystore.location. There is no default value. |
| Preferences | preferences.service.key.alias | Any valid string |
This setting specifies the alias of the private key stored in the Java keystore defined by preferences.service.keystore.location. This key is used to sign JWTs for the Preferences Service. There is no default value. |
| Preferences | preferences.service.key.password | Any valid password |
This setting specifies the password required to access the private key identified by preferences.service.key.alias in the keystore defined by preferences.service.keystore.location. There is no default value. |
| Preferences | preferences.service.max.requests | Any positive number |
This setting specifies the maximum number of concurrent requests that can be made to the Preferences Service. If this limit is exceeded, additional requests will be blocked until current operations are completed. The default is 8. |
| Preferences | preferences.service.connectionpool.enabled | TRUE or FALSE |
This setting enables or disables connection pooling for Preferences Service requests. When enabled (TRUE), connections to the Preferences Service are pooled and can be reused. Pooled connections are cleaned up based on the preferences.service.connectionpool.connection.cleanup.interval.seconds and preferences.service.connectionpool.connection.cleanup.after.idle.seconds settings. When disabled (FALSE), a new connection is created for each Preferences Service request, and all preferences.service.connectionpool.* settings are ignored. The default is TRUE. |
| Preferences | preferences.service.connectionpool.connection.cleanup.interval.seconds | Any positive number |
This setting controls how often (in seconds) Integration Server checks for expired and idle connections in the Preferences Service connection pool and cleans them up. The default is 3. |
| Preferences | preferences.service.connectionpool.connection.cleanup.after.idle.seconds | Any positive number |
This setting controls how long (in seconds) a connection can remain idle in the Preferences Service connection pool before it is eligible for cleanup. The default is 25. |
| Preferences | preferences.service.keepalive.interval.seconds |
Any positive number but at least two seconds less than the difference of preferences.service.connectionpool.connection.cleanup.after.idle.seconds and preferences.service.connectionpool.connection.cleanup.interval.seconds e.g., With the default pool settings (idle=25s, cleanup=3s) the maximum safe value is 20s. |
Specifies how often (in seconds) a keepalive ping is sent to the Preferences Service to prevent pooled connections from being closed by the idle eviction timer. The default is 20. |
| Capture Settings | capture.work.directory | Any valid directory |
The temporary directory to use for document captures and transfers. For example, capture.work.directory=C:/inserver/temp |
| Forms | forms.transform.output.method |
html xml |
Specifies the output method to use for forms transform. html = forms transform uses the html output method. xml = forms transform uses the xml output method. The default is xml. |
| Forms | forms.fallback.transform.output.method |
html xml |
Specifies the output method to use if forms transform fails. The fallback only occurs if this value differs from forms.transform.output.method. html = forms transform uses the html output method. xml = forms transform uses the xml output method. The default is xml. |
| Forms | forms.xsltcache.filesystem.size | 0 or any positive number |
Specifies the number of compiled xslt revisions the system saves to the file system for each presentation or form. Enabling a file system cache allows the system to use the cache between restarts of the service. Setting the value to 0 disables the file system cache. Any positive number enables the cache. We recommend setting the value to 2 to help performance when xslts are updated. The default is 0. |
| Forms | forms.xsltcache.memory.size | 0 or any positive number |
Specifies the number of compiled xslt revisions the system keeps in memory for each presentation or form. Enabling the memory cache reduces the file system IO when file system cache is enabled. It can also be used as the only cache. Setting the value to 0 disables the memory cache. Any positive number enables the cache. We recommend setting the value to 2 to help performance when xslts are updated. The default is 2. |
| Forms | forms.xsltcache.background.enabled |
TRUE FALSE |
Specifies if the system should compile the xslt forms in the background when a compiled version already exists. This may return old xslt forms when they have been updated. The default is FALSE. |
| Forms | forms.xsltcache.directory | Any valid directory |
Specifies in which directory the system builds the xslt caches. The cache may create several subdirectories such as xsltcache/forms/{presentation_id}/{unique_id} The default is xsltcache. |
| Render Settings | render.fileimageservice.url | URL |
This setting specifies the base URL for the File Conversion Service. For example, render.fileimageservice.url=http://localhost:1337 You can request the rendering of raster content from Perceptive Content through the GET: /document/{id}/page/{pageID}/rendition Integration Server call. The call retrieves a PNG rendition of a document page. |
| Render Settings | render.renderingconversionservice.apikey | Any valid string |
This setting specifies the apiKey to be sent in the X-Api-Key header when making requests to the Hyland Rendering and Conversion Service. In HyRCS, you can configure API Key authentication which prevents access to the API unless one of the configured ApiKeys is provided by the X-Api-Key HTTP header. |
| Render Settings | render.renderingconversion.maxrequests | Any positive number |
This setting specifies the maximum amount of concurrent requests that can be made to the Hyland Rendering and Conversion Service. If this limit is exceeded then the operation will be blocked until the current operations are completed. |
| Render Settings | render.renderingconversion.connectionpool.enabled |
TRUE FALSE |
This setting enables or disables connection pooling for Hyland Rendering and Conversion Service requests. When enabled, connections to the Hyland Rendering and Conversion Service will be pooled and can be reused. These connections will be cleaned up after the render.renderingconversionservice.connectionpool.connection.cleanup.after.idle.seconds interval. When disabled, a new connection to the Hyland Rendering and Conversion Service will be made for each request and all render.renderingconversionservice.connectionpool.* settings will be ignored. The default is TRUE. |
| Render Settings | render.renderingconversionservice.connectionpoool.connection.cleanup.interval.seconds | Any positive number |
This setting controls the cleanup interval, in seconds, for expired and idle File Conversion Service pooled connections. The default is 3. |
| Render Settings | render.renderingconversionservice.connectionpool.connection.cleanup.after.idle.seconds | Any positive number |
This setting controls the period of time that idle connections can remain in the Hyland Rendering and Conversion Service connection pool. The default is 25. |
| Render Settings | render.renderingconversionservice.default.graphicdpi | Auto or any positive number |
This setting controls the dpi of the rendered image, can be AUTO or a number. |
| Render Settings | render.renderingconversionservice.keepalive.interval.seconds |
Any positive number but at least two seconds less than the difference of render.renderingconversionservice.connectionpool.connection.cleanup.after.idle.seconds and render.renderingconversionservice.connectionpool.connection.cleanup.interval.seconds e.g., With the default pool settings (idle=25s, cleanup=3s) the maximum safe value is 20s. |
This setting controls the frequency of the keepalive ping is sent to the Rendering Conversion Service to prevent the pooled connection from being reaped by the idle-eviction timer. The default is 20 |
| SSO | sso.enabled |
TRUE FALSE |
This setting specifies whether Single Sign On is enabled. The default is FALSE. |
| SSO | sso.keystore.location | Any valid file path location | This setting specifies the file path location of the key store to be used for Single Sign On authentication. A forward slash should be used as the file separator. |
| SSO | sso.keystore.password | At least 6 characters | This setting specifies the password to verify the integrity of the key store. |
| SSO | sso.privatekey.alias | Any valid string | This setting specifies the alias for the key pair to be used for Single Sign On authentication. |
| SSO | sso.privatekey.password | At least 6 characters | This setting specifies the password for the private key to be used for Single Sign On authentication. |
| SSO | sso.authenticator.class | Any valid fully qualified class |
This setting specifies the fully qualified class used to determine authorization from an external provider. This class must be in the application class path. Optional built-in classes provided for this purpose are: com.imagenow.authentication.translator.HTTPHeaderTranslator com.imagenow.authentication.translator.x509ldap.X509LDAPAuthenticationTranslator |
| SSO | sso.httpheader.name | Any valid HTTP header field name | This setting specifies the name of the HTTP request header to be used by the built-in class HTTPHeaderTranslator plugin to map authentication information from an external provider. |
| SSO | agent.legacy.authentication.method.enabled |
TRUE FALSE |
This setting specifies whether the legacy authentication method for agent connections is enabled. The default is TRUE. |
| SSO | agent.token.authentication.enabled |
TRUE FALSE |
This setting specifies whether token-based authentication for agent connections is enabled. The default is FALSE. |
| SSO | agent.token.keystore.location | Any valid path | This setting specifies the file path location of the key store to be used for token-based authentication for agent connections. A forward slash should be used as the file separator. |
| SSO | agent.token.keystore.password | Any valid password | Optional. This setting specifies the password to verify the integrity of the key store. |
| SSO | forms.server.authentication.token | Any valid token | Optional. This setting specifies an authentication token for Forms Server to use when making connections. |
| SSO | user.bearer.token.authentication.strict.header.validation |
TRUE FALSE |
Optional. This setting specifies whether strict header checks should be enabled when using bearer token authentication. If enabled, ensure that X-IntegrationServer-Username and X-IntegrationServer-Password headers are not present on a request using bearer token authentication. The default is TRUE. |
| SSO | introspection.token.value.max.length | Any positive number |
Optional. Specifies the maximum allowable size in bytes of the token form parameter to be introspected. Example: introspection.token.value.max.length=3000 The default is 3000. |
| SSO | introspection.bearer.token.value.max.length | Any positive number |
Optional. Specifies the maximum allowable size in bytes of the bearer token used to authenticate introspection. Example: introspection.bearer.token.value.max.length=3000 The default is 3000. |
| OpenID Connect Login Profiles | sso.openid.login.enabled |
TRUE FALSE |
Specifies whether OpenID Connect authentication is enabled. FALSE = OpenID Connect authentication is disabled. TRUE = OpenID Connect authentication is enabled. The default is FALSE. |
| OpenID Connect Login Profiles | sso.openid.profiles | Any alphanumeric characters | A comma separated list of OpenID Connect authentication profile names. Profile names must only contain lower alphanumeric characters. |
| OpenID Connect Login Profiles | sso.openid.profile.<profileName>.authorization.endpoint | URL | The OpenID Provider authorization endpoint URL. The authorization endpoint performs authentication of the end user. |
| OpenID Connect Login Profiles | sso.openid.profile.<profileName>.client.id | Any valid client identifier | A valid client identifier that is registered with the OpenID Provider. |
| OpenID Connect Login Profiles | sso.openid.profile.<profileName>.grant.type | authorization_code |
Optional. The authorization grant type to use for OpenID Connect authentication requests. authorization_code = Authorization Code grant type. The default is authorization_code. |
| OpenID Connect Login Profiles | sso.openid.profile.<profileName>.use.pkce |
TRUE FALSE |
Optional. Specifies whether OpenID Connect authentication requests use a Proof Key for Code Exchange (PKCE). FALSE = Authentication requests do not use a Proof Key for Code Exchange (PKCE). TRUE = Authentication requests use a Proof Key for Code Exchange (PKCE). The default is TRUE. |
| OpenID Connect Login Profiles | sso.openid.profile.<profileName>.scope | openid |
Optional. A list of space separated, case sensitive strings that specify the scope of OpenId Connect authentication requests. openid = Required. Specifies an OpenID Connect authentication request. The default is openid. |
| OpenID Connect Login Profiles | sso.openid.profile.<profileName>.max.age | Any positive number or -1 |
Optional. Specifies the allowable elapsed time in seconds since the last time the end user was actively authenticated by the OpenID Provider. A value of -1 specifies that a max age should not be enforced. The default is -1. |
| OpenID Connect Login Profiles | sso.openid.profile.<profileName>.acr.values | Any valid ACR values | Optional. A list of space separated Authentication Context Class Reference values that are added to authentication requests. |
| OpenID Connect Login Profiles | sso.openid.profile.<profileName>.response.mode |
query form_post |
Optional. Specifies the mechanism for returning responses from the OpenID Provider. query = Response parameters are encoded in the query string. form_post = Response parameters are encoded as HTML form values and utilize the HTTP POST method. The default is form_post. |
| OpenID Connect Login Profiles | sso.openid.profile.<profileName>.post.login.redirect.uri | URL |
Optional. The URL to redirect end users to following a successful OpenID Connect login. The following values are added onto the redirect URL: state – Optional. Application state, provided it is included in the login request. By default, the system returns values as query parameters. Alternatively, you can use path variables that the system replaces with a value at run time. Path variables are denoted using the value name surrounded by curly braces. Examples Redirect URL using default semantics, values are added onto a query string. https://www.hostname.com/app/callback/ Redirect URL using a path variable, the {state} path variable are replaced at run time. https://www.hostname.com/app/callback/{state} If the post login redirect URL is not set, the following HTTP headers are returned in the callback response: X-IntegrationServer-SSO-App-State - Optional. Application state, provided it is included in the login request. |
| OpenID Connect Login Profiles | sso.openid.profile.<profileName>.error.redirect.uri | URL |
Optional. The URL to redirect to following an unsuccessful OpenID Connect login. The following values are added onto the redirect URL: error - An error code for the unsuccessful login. state - Optional. Application state, provided it is included in the login request. By default, values will be returned as query parameters. Alternatively, path variables may be used which will be replaced with a value at run time. Path variables are denoted using the value name surrounded by curly braces. Examples Redirect URL using default semantics, values will be added onto a query string. https://www.hostname.com/app/callback/ Redirect URL using path variables, the {state} and {error} path variables will be replaced at run time. https://www.hostname.com/app/callback/{state}?error={error} If an error occurs and the error redirect URL is not set, the following HTTP headers are returned in the callback response: X-IntegrationServer-Error-Code - An error code for the unsuccessful login. X-IntegrationServer-Error-Message - An error message. X-IntegrationServer-SSO-App-State - Optional. Application state, provided it is included in the login request. |
| OpenID Connect Login Profiles | sso.openid.profile.<profileName>.state.cookie.domain | Any valid domain |
Optional. Specifies the domain to use when setting state cookies. The default is not to specify the domain when setting state cookies. |
| OpenID Connect Login Profiles | sso.openid.profile.<profileName>.state.cookie.path | Any valid URI path |
Optional. Specifies the path to use when setting state cookies. The default is the Integration Server SSO resource path. |
| OpenID Connect Login Profiles | sso.openid.profile.<profileName>.state.cookie.expiration | Any positive number |
Optional. Specifies the maximum lifetime in seconds of a state cookie. Ensure this value is long enough for end users to complete a valid login. The default is 300. |
| OpenID Connect Login Profiles | sso.openid.profile.<profileName>.same.site.cookies.policy |
UNSET NONE LAX STRICT |
Specifies the SameSite policy set on authentication state cookies. UNSET = State cookies are not explicitly set with the SameSite directive. NONE = State cookies have the SameSite directive set to None. LAX = State cookies have the SameSite directive set to Lax. STRICT = State cookies have the SameSite directive set to Strict. The default is STRICT. |
| OpenID Connect Login Profiles | sso.openid.profile.<profileName>.strict.callback.uri.validation |
TRUE FALSE |
Optional. Specifies whether callback URIs must match the hostname and profile name associated with the originating login request. FALSE = Do not validate callback URIs. TRUE = Enable callback URI validation. The default is TRUE. |
| OpenID Connect Login Profiles | sso.openid.profile.<profileName>.validate.hostname |
TRUE FALSE |
Optional. Specifies whether to disable validation of the hostname specified on the request. This should not be disabled in production environments. TRUE = Always validate hostname values. FALSE = Do not validate hostname values. The default is TRUE. |
| OpenID Connect Login Profiles | sso.openid.profile.<profileName>.max.response.value.size | Any positive number |
Optional. Specifies the maximum allowable size in bytes of each parameter or authentication state value. The default is 3000. Note: If your profile name, the URL to
Integration Server including /integrationserver/v1/sso/, or the
authorization codes produced by the OpenID Provider are longer
than 3000 bytes, update the maximum response value size setting
to the appropriate value.
|
| OpenID Connect Login Profiles | sso.openid.profile.<profileName>.allowed.app.types |
web desktop |
Optional. Comma separated list of one or more application types that are allowed to login through this profile. If no valid application type is specified, then the default value is used. web = Perceptive Content web clients desktop = Perceptive Content desktop clients The default is web. |
| Bearer Token Login Profiles | sso.bearer.profiles | Any alphanumeric characters | A comma separated list of bearer token login profile names. Profile names must only contain alphanumeric characters. |
| Bearer Token Login Profiles | sso.bearer.profile.<profileName>.bearer.token.character.validation |
TRUE FALSE |
Optional. Specifies whether to validate that bearer tokens conform to the expected bearer credentials syntax. FALSE = Do not validate bearer token characters. TRUE = Enable bearer token character validation. The default is TRUE. |
| Bearer Token Login Profiles | sso.bearer.profile.<profileName>.max.bearer.token.size | Any positive number |
Optional. Specifies the maximum allowable size in bytes of bearer tokens. A value of 0 specifies that a maximum bearer token size should not be enforced. The default is 3000. |