Users can change the default functionality related configurations by editing the <PRODUCT_HOME>/repository/conf/identity.xml file using the information given below.
XML Elements
| XML element | Description | Data type | Default value | Mandatory/Optional | Sample |
| <Server> | |||||
| <JDBCPersistenceManager> | Identity related data source configuration | ||||
| <DataSource> | |||||
| <Name> | Include a data source name (jndiConfigName) from the set of data sources defined in master-datasources.xml | String | N/A | Mandatory | |
| <SkipDBSchemaCreation> | If the identity database is created from another place and if it is required to skip schema initialization during the server start up, set the property to "true". | Boolean | FALSE | Optional | |
| <OpenID> | Open ID related Configurations | ||||
| <OpenIDServerUrl> | Url that open id server (servlet) is running | String | N/A | Mandatory | |
| <OpenIDUserPattern> | Url that pattern that can be configured for user's openId | String | N/A | Mandatory | |
| <OpenIDSkipUserConsent> | Set to false if the users must be prompted for approval | Boolean | FALSE | Optional | |
| <OpenIDRememberMeExpiry> | Expiry time of the OpenID RememberMe token in minutes | Int | 0 Minutes | Optional | |
| <UseMultifactorAuthentication> | Multifactor Authentication configuration | Boolean | FALSE | Optional | |
| <DisableOpenIDDumbMode> | To enable or disable openid dumb mode | Boolean | FALSE | Optional | |
| <SessionTimeout> | OpenID session timeout in seconds | Int | 36000 Seconds | Optional | |
| <AcceptSAMLSSOLogin> | Skips authentication if valid SAML2 Web SSO browser session is available | Boolean | FALSE | Optional | |
| <ClaimsRetrieverImplClass> | User claim retrieving module for OpenID | ||||
| <OAuth> | |||||
| <AuthorizationCodeDefaultValidityPeriod> | Default validity period for Authorization Code in seconds | Int | 300 Seconds | Optional | |
| <AccessTokenDefaultValidityPeriod> | Default validity period for Access Token in seconds | Int | 3600 Seconds | Optional | |
| <TimestampSkew> | Timestamp skew in seconds | Int | 300 Seconds | Optional | |
| <EnableOAuthCache> | Enable OAuth caching. This cache has the replication support. | Boolean | TRUE | Optional | |
| <TokenPersistencePreprocessor> | Configure the security measures needs to be done prior to storing the token in the database, such as hashing, encrypting, etc. | String | org.wso2.carbon.identity.oauth.preprocessor.PlainTokenPersistencePreprocessor | Optional | |
| <SupportedResponseTypes> | Supported OAuth2.0 respose types | String values with Comma separated | token,code | Optional | |
| <SupportedGrantTypes> | Supported OAuth2.0 grant types | String values with Comma separated | authorization_code,password,refresh_token,client_credentials,urn:ietf:params:oauth:grant-type:saml2-bearer | Optional | |
| <OAuthCallbackHandlers> | |||||
| <OAuthCallbackHandler> | OAuth callback handler module class name | String | N/A | Mandatory | |
| <EnableAssertions> | Assertions can be used to embed parameters into the access token. | ||||
| <UserName> | Whether to add user name as addtional parameter | Boolean | FALSE | Optional | |
| <EnableAccessTokenPartitioning> | This should be set to true when using multiple user stores and keys should saved into different tables according to the user store. By default all the application keys are saved in to the same table. UserName Assertion should be 'true' to use this. | Boolean | FALSE | Optional | |
| <AccessTokenPartitioningDomains> | This includes the user store domain names and mapping to the new table name. E.g.: if you provide 'A:foo.com', foo.com should be the user store domain name and 'A' represents the relavant mapping of the token store table, i.e., tokens will be added to a table called IDN_OAUTH2_ACCESS_TOKEN_A. | String values with Comma separated | N/A | Optional | |
| <AuthorizationContextTokenGeneration> | |||||
| <Enabled> | This mentions whether token generation is enabled or not | Boolean | FALSE | Optional | |
| <TokenGeneratorImplClass> | Token generation class name | String | org.wso2.carbon.identity.oauth2.token.JWTTokenGenerator | Optional | |
| <ClaimsRetrieverImplClass> | Claim retrieving class name for generating token | org.wso2.carbon.identity.oauth2.token.DefaultClaimsRetriever | Optional | ||
| <ConsumerDialectURI> | Claim Dialect Uri that is used for claim retrieving | http://wso2.org/claims | Optional | ||
| <SignatureAlgorithm> | Signature algorithm used for sign the token | SHA256withRSA | Optional | ||
| <AuthorizationContextTTL> | Token time to live value | Long | 15 Minutes | Optional | |
| <SAML2Grant> | Configuration related to SAML2 Grant type | ||||
| <OpenIDConnect> | |||||
| <IDTokenBuilder> | IDToken generator implementation class name | String | org.wso2.carbon.identity.openidconnect.DefaultIDTokenBuilder | Optional | |
| <IDTokenIssuerID> | The value of TokenIssuerID of the IDToken. This is an unique value and should be changed according to the deployment values. | String | OIDCAuthzServer | Optional | |
| <IDTokenSubjectClaim> | This is the claim used as the subject of the IDToken. You can use different claims such as http://wso2.org/claims/emailaddress" | String | http://wso2.org/claims/fullname | Optional | |
| <IDTokenCustomClaimsCallBackHandler> | Claim callback implementation class name.This is used to return custom claims with the IDToken. | String | org.wso2.carbon.identity.openidconnect.SAMLAssertionClaimsCallback | Optional | |
| <IDTokenExpiration> | The expiration of the IDToken in seconds. | Int | 300 Seconds | Optional | |
| <UserInfoEndpointClaimDialect> | Defines which claim dialect should be returned from the User Endpoint. | String | http://wso2.org/claims/fullname | Optional | |
| <UserInfoEndpointClaimRetriever> | Defines the implemenation name of the class which builds the claims for the user info endpoint's response. | String | org.wso2.carbon.identity.oauth.endpoint.user.impl.UserInfoUserStoreClaimRetriever | Optional | |
| <UserInfoEndpointRequestValidator> | Implemenation name of the class that validates the user info request against the specification | String | org.wso2.carbon.identity.oauth.endpoint.user.impl.UserInforRequestDefaultValidator | Optional | |
| <UserInfoEndpointAccessTokenValidator> | Implementation name of the class that validates the access token | String | org.wso2.carbon.identity.oauth.endpoint.user.impl.UserInfoISAccessTokenValidator | Optional | |
| <UserInfoEndpointResponseBuilder> | Implementation name of the class that build the user info request | String | org.wso2.carbon.identity.oauth.endpoint.user.impl.UserInfoJSONResponseBuilder | Optional | |
| <SkipUserConsent> | Set to false if the users must be prompted for approval | Boolean | FALSE | Optional | |
| <MultifactorAuthentication> | |||||
| <XMPPSettings> | XMPP setting for multifactor authentication | ||||
| <XMPPConfig> | |||||
| <XMPPProvider> | XMPP provider name | String | N/A | Mandatory | |
| <XMPPServer> | XMPP server name | String | N/A | Mandatory | |
| <XMPPPort> | XMPP server's port | Int | N/A | Mandatory | |
| <XMPPExt> | XMPP domain | String | N/A | Mandatory | |
| <XMPPUserName> | User name for login to XMPP server | String | N/A | Mandatory | |
| <XMPPPassword> | Password for login to XMPP server | String | N/A | Mandatory | |
| <SSOService> | |||||
| <IdentityProviderURL> | Unique identifier for IDP. This would be passed as Issuer in SAML2 response | String | N/A | Mandatory | |
| <SingleLogoutRetryCount> | Number of retries that must be done, if single logout request is not received from a SP | Int | 5 | Optional | |
| <SingleLogoutRetryInterval> | Interval between two re-tries | Int | 60 Seconds | Optional | |
| <TenantPartitioningEnabled> | This would add the tenant domain as parameter in to ACS url | Boolean | FALSE | Optional | |
| <SessionTimeout> | Remember me session timeout in seconds | Int | 36000 Seconds | Optional | |
| <AttributeStatementBuilder> | This configuration is not used now. this is needed to remove | ||||
| <AttributesClaimDialect> | Claim Dialect Uri that is used for claim retrieving | String | http://wso2.org/claims | Optional | |
| <AcceptOpenIDLogin> | Skips authentication if valid Open ID login session is available | Boolean | FALSE | Optional | |
| <ClaimsRetrieverImplClass> | Claim retrieving class name for generating token | String | N/A | Mandatory | |
| <SAMLResponseValidityPeriod> | SAML Token validity period in minutes. | Int | 5 Minutes | Optional | |
| <EntitlementSettings> | |||||
| <ThirftBasedEntitlementConfig> | Thrift transport configurations for entitlement service | ||||
| <EnableThriftService> | Enable thrift transport | Boolean | FALSE | Optional | |
| <ReceivePort> | Thrift listening port | Int | N/A | Mandatory | |
| <ClientTimeout> | Thrift session time out in seconds | Int | N/A | Mandatory | |
| <KeyStore> | Thrift key store configurations used for SSL | ||||
| <Location> | Key store location | String | N/A | Mandatory | |
| <Password> | Key Store password | String | N/A | Mandatory | |
| <SCIMAuthenticators> | |||||
| <Authenticator> | Defines implementations of SCIM authenticator | String | org.wso2.carbon.identity.scim.provider.auth.BasicAuthHandler and org.wso2.carbon.identity.scim.provider.auth.OAuthHandler | Optional | |
| <Property> | Configuration properties of each autenticator implementation | String | N/A | Optional |