//
// Licensed to the Apache Software Foundation (ASF) under one
// or more contributor license agreements.  See the NOTICE file
// distributed with this work for additional information
// regarding copyright ownership.  The ASF licenses this file
// to you under the Apache License, Version 2.0 (the
// "License"); you may not use this file except in compliance
// with the License.  You may obtain a copy of the License at
//
//   http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing,
// software distributed under the License is distributed on an
// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
// KIND, either express or implied.  See the License for the
// specific language governing permissions and limitations
// under the License.
//

==== Configuration Parameters

Most run-time configuration options are available as parameters and can be tuned either via the admin console, CLI or
barely invoking the REST layer through http://curl.haxx.se/[curl^]:

* `password.cipher.algorithm` - which cipher algorithm shall be used for encrypting password values; supported 
algorithms include `SHA-1`, `SHA-256`, `SHA-512`, `AES`, `S-MD5`, `S-SHA-1`, `S-SHA-256`, `S-SHA-512` and `BCRYPT`;
salting options are available in the `security.properties` file;
* `jwt.lifetime.minutes` - validity of https://en.wikipedia.org/wiki/JSON_Web_Token[JSON Web Token^] values used for
<<rest-authentication-and-authorization,authentication>> (in minutes);
* `notificationjob.cronExpression` -
http://www.quartz-scheduler.org/documentation/quartz-2.2.x/tutorials/crontrigger.html[cron^] expression describing how
frequently the pending <<tasks-notification,notification tasks>> are processed: empty means disabled;
[NOTE]
Restarting the Java EE container is required when changing value for this parameter.
* `notification.maxRetries` - how many times the delivery of a given notification should be attempted before giving up;
[NOTE]
Restarting the Java EE container is required when changing value for this parameter.
* `token.length` - the length of the random tokens that can be generated as part of various <<workflow,workflow>>
processes, including <<password-reset,password reset>>;
* `token.expireTime` - the time after which the generated random tokens expire;
* `selfRegistration.allowed` - whether self-registration (typically via the enduser application) is allowed;
* `passwordReset.allowed` - whether the <<password-reset,password reset>> feature (typically via the enduser
application) is allowed;
* `passwordReset.securityQuestion` - whether the <<password-reset,password reset>> feature involves security questions;
* `authentication.attributes` - the list of attributes whose values can be passed as login name for authentication,
defaults to `username`; please note that the related <<plain,plain schemas>> must impose the unique constraint, for this
mechanism to work properly;
* `authentication.statuses` - the list of <<workflow,workflow>> statuses for which users are allowed to authenticate;
[WARNING]
Suspended Users are anyway not allowed to authenticate.
* `log.lastlogindate` - whether the system updates the `lastLoginDate` field of users upon authentication;
* `return.password.value` - whether the hashed password value shall be returned when reading users;
* `identity.recertification.day.interval` - number of days between
<<identity-recertification,identity recertifications>>;
* `connector.conf.history.size` - how many previous configurations shall be kept for each Connector Instance,
for usage with <<connectors-resources-history, connectors and resources configuration history management>>;
* `resource.conf.history.size` - how many previous configurations shall be kept for each External Resource,
for usage with <<connectors-resources-history, connectors and resources configuration history management>>.

Besides this default set, new configuration parameters can be defined to support <<customization,custom>> code.
