Property | Requires Configuration | Default Value | Explanation |
|---|
login.defaultForm=local | Often | local | Selects the form displayed when a user connects. local - only allows local authentication. full - allows selecting any of the enabled authentication methods. auto - if SAML SSO is enabled allows logging in without displaying the login form if the user is already authenticated. activedirectory - supports active directory login only. |
login.default=local | Often | local | The default domain for login. |
login.local.enabled=true | Rarely | true | Allows disabling support of local login. This will prevent any local administrator accounts from being used. |
login.saml.enabled=false | Often | false | Configures whether SAML login is enabled |
login.saml.key= <none> | Often | <none> | Configures the identity provider's entity id . |
login.saml.attribute.domain= <none> | Often | <none> | Configures the domain of the saml users. |
login.saml.label=Single Sign In | Rarely | Single Sign In | The label to display |
login.saml.attributeMap=authenticationOnly | Often | authenticationOnly | Configures the integration method. authenticationOnly - SAML used for authentication but PhixFlow manages user details and permissions. okta - configured to support Okta based authentication and details. userDetails - allows configuration of authentication and user details to be provided by saml. |
login.saml.keystore.file= | Often | classpath:keystore/samlKeystore.jks | Often | Configures the location of the saml keystore |
login.saml.keystore.password=<none> | Often | <none> | Configures the password to the saml keystore. |
login.saml.keystore.key.password=<none> | Often | <none> | Configures the password to the secret in the saml keystore |
login.saml.keystore.key.alias=samlKey | Rarely | samlKey | Configures the alias of the secret stored in the saml keystore |
login.saml.url.host=localhost | Often | localhost | Configures the externally resolvable hostname of the PhixFlow server. If behind a reverse proxy this will be the proxy’s hostname. |
login.saml.url.port=443 | Occasionally | 443 | Configures the port of the PhixFlow server, or that of the reverse proxy if it is being used. |
login.saml.url.includePort=false | Rarely | false | Whether the port should be included in the generated url. |
login.saml.url.path= | Occasionally | /phixflowOccasionally | Path that the webapp is installed under. If behind a reverse proxy this should be the path that the proxy forwards. |
login.saml.metadata.entityId= | Rarely | https://${login.saml.url.host}/${login.saml.url.path}Rarely | The value that globally identifies the PhixFlow instance. |
login.saml.metadata.entityBaseUrl= | Rarely | https://${login.saml.url.host}/${login.saml.url.path}Rarely | The public facing URL of the PhixFlow instance. |
login.saml.metadata.file= | Often | file:/opt/phixflow/data/saml-metadata/idp-metadata.xmlOften | Path to the Identity Provider Metadata file. |
login.saml.metadata.trustCheck=true | Rarely | true | Whether to validate incoming signatures. |
login.saml.attribute.username=nameid | Occasionally | nameid | Used with the authenticationOnly and userDetails attribute map to define the appropriate mapping from the incoming metadata. |
login.saml.attribute.fullname=displayname | Occasionally | displayname | Used with the userDetails attribute map to define the appropriate mapping from the incoming metadata. |
login.saml.attribute.firstname=givenname | Occasionally | givenname | Used with the userDetails attribute map to define the appropriate mapping from the incoming metadata. |
login.saml.attribute.lastname=surname | Occasionally | surname | Used with the userDetails attribute map to define the appropriate mapping from the incoming metadata. |
login.saml.attribute.phonenumber=phonenumber | Occasionally | phonenumber | Used with the userDetails attribute map to define the appropriate mapping from the incoming metadata. |
login.saml.attribute.company=company | Occasionally | company | Used with the userDetails attribute map to define the appropriate mapping from the incoming metadata. |
login.saml.attribute.department=department | Occasionally | department | Used with the userDetails attribute map to define the appropriate mapping from the incoming metadata. |
login.saml.attribute.email=email | Occasionally | email | Used with the userDetails attribute map to define the appropriate mapping from the incoming metadata. |
login.saml.attribute.groups=group | Occasionally | group | Used with the userDetails attribute map to define the appropriate mapping from the incoming metadata. |
login.saml.attribute.globalLogout=false | Occasionally | false | Used with the authenticationOnly and userDetails attribute map to determine whether logging out of PhixFlow should also trigger a logout of the identity provider. |
login.activeDirectory.enabled=false | Often | false | Whether Active Directory integration is enabled. |
login.activeDirectory.domain= | Often | example.comOften | The domain being logged into. |
login.activeDirectory.url= | Often | ldaps://ldap.example.comOften | Space separated list of domain LDAP servers. |
login.activeDirectory.dn= | Often | ou=user accounts,dc=example,dc=comOften | The root distinguished name to search under. |
login.activeDirectory.timeout= | Rarely | 5000Rarely | Timeout for attempt to authenticate against each server. |
login.activeDirectory.authenticationOnly=false | Occasionally | false | Whether only authentication is used from active directory, with user permissions and details being stored in PhixFlow. |