Users can change the default configurations by editing the <PRODUCT_HOME>/repository/conf/identity.xml file using the information given below.
Click on the table and use the left and right arrow keys to scroll horizontally.
XML Elements
| XML element | Attribute | Description | Data type | Default value | Mandatory/Optional | Sample |
| <Server> | ||||||
| xmlns | ||||||
| _<JDBCPersistenceManager> | Identity related data source configuration. | |||||
| __<DataSource> | ||||||
| ____<Name> | Include a data source name (jndiConfigName) from the set of data sources defined in master-datasources.xml. | String | N/A | Mandatory | <Name>jdbc/WSO2CarbonDB</Name> | |
| ___<SkipDBSchemaCreation> | If the identity database is created from another place and if it is required to skip schema initialization during the server start up, set the property to "true". | Boolean | FALSE | Optional | <SkipDBSchemaCreation>false</SkipDBSchemaCreation> | |
| _<OpenID> | OpenID related configurations. | |||||
| __<OpenIDServerUrl> | This is the URL that the OpenID server (servlet) is running in. | String | N/A | Mandatory | <OpenIDServerUrl>https://localhost:9443/openidserver</OpenIDServerUrl> | |
| __<OpenIDUserPattern> | URL of the pattern that can be configured for the user's OpenID. | String | N/A | Mandatory | <OpenIDUserPattern>https://localhost:9443/openid/</OpenIDUserPattern> | |
| __<OpenIDSkipUserConsent> | Set to false if the users must be prompted for approval. | Boolean | FALSE | Optional | <OpenIDSkipUserConsent>false</OpenIDSkipUserConsent> | |
| __<OpenIDRememberMeExpiry> | Expiry time of the OpenID RememberMe token in minutes. | Int | 0 Minutes | Optional | <OpenIDRememberMeExpiry>7200</OpenIDRememberMeExpiry> | |
| __<UseMultifactorAuthentication> | Multifactor authentication configuration. | Boolean | FALSE | Optional | <UseMultifactorAuthentication>false</UseMultifactorAuthentication> | |
| __<DisableOpenIDDumbMode> | To enable or disable OpenID dumb mode. | Boolean | FALSE | Optional | <DisableOpenIDDumbMode>false</DisableOpenIDDumbMode> | |
| __<SessionTimeout> | OpenID session timeout in seconds. | Int | 36000 Seconds | Optional | <SessionTimeout>36000</SessionTimeout> | |
| __<AcceptSAMLSSOLogin> | Skips authentication if the valid SAML2 Web SSO browser session is available. | Boolean | FALSE | Optional | <AcceptSAMLSSOLogin>false</AcceptSAMLSSOLogin> | |
| __<ClaimsRetrieverImplClass> | User claim retrieving module for OpenID. | <ClaimsRetrieverImplClass>org.wso2.carbon.identity.provider.openid.claims.DefaultClaimsRetriever</ClaimsRetrieverImplClass> | ||||
| _<OAuth> | OAuth related configurations. | |||||
| __<AuthorizationCodeDefaultValidityPeriod> | Default validity period for Authorization Code in seconds. | Int | 300 Seconds | Optional | <AuthorizationCodeDefaultValidityPeriod>300</AuthorizationCodeDefaultValidityPeriod> | |
| __<AccessTokenDefaultValidityPeriod> | Default validity period for Access Token in seconds. | Int | 3600 Seconds | Optional | <AccessTokenDefaultValidityPeriod>3600</AccessTokenDefaultValidityPeriod> | |
| __<TimestampSkew> | Timestamp skew in seconds. | Int | 300 Seconds | Optional | <TimestampSkew>300</TimestampSkew> | |
| __<EnableOAuthCache> | Enable OAuth caching. This cache has the replication support. | Boolean | TRUE | Optional | <EnableOAuthCache>true</EnableOAuthCache> | |
| __<TokenPersistencePreprocessor> | Configure the security measures needed to be done prior to storing the token in the database, such as hashing, encrypting, etc. | String | org.wso2.carbon.identity.oauth.preprocessor.PlainTokenPersistencePreprocessor | Optional | <TokenPersistencePreprocessor>org.wso2.carbon.identity.oauth.preprocessor.PlainTextTokenPersistencePreprocessor</TokenPersistencePreprocessor> | |
| __<SupportedResponseTypes> | Supported OAuth2.0 respose types. | String values with Comma separated | token, code | Optional | <SupportedResponseTypes>token,code</SupportedResponseTypes> | |
| __<SupportedGrantTypes> | Supported OAuth2.0 grant types. | String values with Comma separated | authorization_code,password,refresh_token,client_credentials,urn:ietf:params:oauth:grant-type:saml2-bearer | Optional | <SupportedGrantTypes>authorization_code,password,refresh_token,client_credentials,urn:ietf:params:oauth:grant-type:saml2-bearer</SupportedGrantTypes> | |
| __<OAuthCallbackHandlers> | ||||||
| ____<OAuthCallbackHandler> | OAuth callback handler module class name. | String | N/A | Mandatory | <OAuthCallbackHandler class="org.wso2.carbon.identity.oauth.callback.DefaultCallbackHandler"/> | |
| __<EnableAssertions> | Assertions can be used to embed parameters into the access token. | |||||
| ______<UserName> | This enables you to add the user name as an additional parameter if you require it. | Boolean | FALSE | Optional | <UserName>false</UserName> | |
| __<EnableAccessTokenPartitioning> | This should be set to true when using multiple user stores and keys should be saved into different tables according to the user store. By default, all the application keys are saved into the same table. UserName Assertion should be 'true' to use this. | Boolean | FALSE | Optional | <EnableAccessTokenPartitioning>false</EnableAccessTokenPartitioning> | |
| __<AccessTokenPartitioningDomains> | This includes the user store domain names and mapping to the new table name. E.g., if you provide 'A:foo.com', foo.com should be the user store domain name and 'A' represents the relavant mapping of the token store table, i.e., tokens will be added to a table called IDN_OAUTH2_ACCESS_TOKEN_A. | String values with Comma separated | N/A | Optional | ||
| __<AuthorizationContextTokenGeneration> | ||||||
| _____<Enabled> | This mentions whether token generation is enabled or not. | Boolean | FALSE | Optional | <Enabled>false</Enabled> | |
| _____<TokenGeneratorImplClass> | Token generation class name. | String | org.wso2.carbon.identity.oauth2.token.JWTTokenGenerator | Optional | <TokenGeneratorImplClass>org.wso2.carbon.identity.oauth2.authcontext.JWTTokenGenerator</TokenGeneratorImplClass> | |
| _____<ClaimsRetrieverImplClass> | Claim retrieving class name for generating a token. | org.wso2.carbon.identity.oauth2.token.DefaultClaimsRetriever | Optional | <ClaimsRetrieverImplClass>org.wso2.carbon.identity.oauth2.authcontext.DefaultClaimsRetriever</ClaimsRetrieverImplClass><AuthorizationContextTTL>15</AuthorizationContextTTL> | ||
| _____<ConsumerDialectURI> | Claim Dialect URI that is used for claim retrieving. | http://wso2.org/claims | Optional | <ConsumerDialectURI>http://wso2.org/claims</ConsumerDialectURI> | ||
| _____<SignatureAlgorithm> | Signature algorithm used for sign the token. | SHA256withRSA | Optional | <SignatureAlgorithm>SHA256withRSA</SignatureAlgorithm> | ||
| _____<AuthorizationContextTTL> | Token time to live value. | Long | 15 Minutes | Optional | <AuthorizationContextTTL>15</AuthorizationContextTTL> | |
| __<SAML2Grant> | Configuration related to SAML2 Grant type. | |||||
| __<OpenIDConnect> | ||||||
| _____<IDTokenBuilder> | IDToken generator implementation class name. | String | org.wso2.carbon.identity.openidconnect.DefaultIDTokenBuilder | Optional | <IDTokenBuilder>org.wso2.carbon.identity.openidconnect.DefaultIDTokenBuilder</IDTokenBuilder> | |
| _____<IDTokenIssuerID> | The value of TokenIssuerID of the IDToken. This is a unique value and should be changed according to the deployment values. | String | OIDCAuthzServer | Optional | <IDTokenIssuerID>https://localhost:9443/oauth2endpoints/token</IDTokenIssuerID> | |
| _____<IDTokenSubjectClaim> | This is the claim used as the subject of the IDToken. You can use different claims such as http://wso2.org/claims/emailaddress. | String | http://wso2.org/claims/fullname | Optional | <IDTokenSubjectClaim>http://wso2.org/claims/givenname</IDTokenSubjectClaim> | |
| _____<IDTokenCustomClaimsCallBackHandler> | Claim callback implementation class name. This is used to return custom claims with the IDToken. | String | org.wso2.carbon.identity.openidconnect.SAMLAssertionClaimsCallback | Optional | <IDTokenCustomClaimsCallBackHandler>org.wso2.carbon.identity.openidconnect.SAMLAssertionClaimsCallback</IDTokenCustomClaimsCallBackHandler> | |
| _____<IDTokenExpiration> | The expiration value of the IDToken in seconds. | Int | 300 Seconds | Optional | <IDTokenExpiration>3600</IDTokenExpiration> | |
| _____<UserInfoEndpointClaimDialect> | Defines which claim dialect should be returned from the User Endpoint. | String | http://wso2.org/claims/fullname | Optional | <UserInfoEndpointClaimDialect>http://wso2.org/claims</UserInfoEndpointClaimDialect> | |
| _____<UserInfoEndpointClaimRetriever> | Defines the implemenation name of the class which builds the claims for the user info endpoint's response. | String | org.wso2.carbon.identity.oauth.endpoint.user.impl.UserInfoUserStoreClaimRetriever | Optional | <UserInfoEndpointClaimRetriever>org.wso2.carbon.identity.oauth.endpoint.user.impl.UserInfoUserStoreClaimRetriever</UserInfoEndpointClaimRetriever> | |
| _____<UserInfoEndpointRequestValidator> | Implemenation name of the class that validates the user info request against the specification. | String | org.wso2.carbon.identity.oauth.endpoint.user.impl.UserInforRequestDefaultValidator | Optional | <UserInfoEndpointRequestValidator>org.wso2.carbon.identity.oauth.endpoint.user.impl.UserInforRequestDefaultValidator</UserInfoEndpointRequestValidator> | |
| _____<UserInfoEndpointAccessTokenValidator> | Implementation name of the class that validates the access token. | String | org.wso2.carbon.identity.oauth.endpoint.user.impl.UserInfoISAccessTokenValidator | Optional | <UserInfoEndpointAccessTokenValidator>org.wso2.carbon.identity.oauth.endpoint.user.impl.UserInfoISAccessTokenValidator</UserInfoEndpointAccessTokenValidator> | |
| _____<UserInfoEndpointResponseBuilder> | Implementation name of the class that builds the user info request. | String | org.wso2.carbon.identity.oauth.endpoint.user.impl.UserInfoJSONResponseBuilder | Optional | <UserInfoEndpointResponseBuilder>org.wso2.carbon.identity.oauth.endpoint.user.impl.UserInfoJSONResponseBuilder</UserInfoEndpointResponseBuilder> | |
| _____<SkipUserConsent> | Set to false if the users must be prompted for approval. | Boolean | FALSE | Optional | <SkipUserConsent>false</SkipUserConsent> | |
| __<MultifactorAuthentication> | ||||||
| ___<XMPPSettings> | XMPP setting for multifactor authentication. | |||||
| ____<XMPPConfig> | ||||||
| ______<XMPPProvider> | XMPP provider name. | String | N/A | Mandatory | <XMPPProvider>gtalk</XMPPProvider> | |
| ______<XMPPServer> | XMPP server name. | String | N/A | Mandatory | <XMPPServer>talk.google.com</XMPPServer> | |
| ______<XMPPPort> | XMPP server's port. | Int | N/A | Mandatory | <XMPPPort>5222</XMPPPort> | |
| ______<XMPPExt> | XMPP domain. | String | N/A | Mandatory | <XMPPExt>gmail.com</XMPPExt> | |
| ______<XMPPUserName> | User name for login to XMPP server. | String | N/A | Mandatory | <XMPPUserName>multifactor1@gmail.com</XMPPUserName> | |
| ______<XMPPPassword> | Password for login to XMPP server. | String | N/A | Mandatory | <XMPPPassword>wso2carbon</XMPPPassword> | |
| __<SSOService> | ||||||
| ______<IdentityProviderURL> | Unique identifier for IDP. This would be passed as Issuer in SAML2 response. | String | N/A | Mandatory | <IdentityProviderURL>https://localhost:9443/samlsso</IdentityProviderURL> | |
| ______<SingleLogoutRetryCount> | Number of retries that must be done if a single logout request is not received from the SP. | Int | 5 | Optional | <SingleLogoutRetryCount>5</SingleLogoutRetryCount> | |
| ______<SingleLogoutRetryInterval> | Interval between two re-tries. | Int | 60 Seconds | Optional | <SingleLogoutRetryInterval>60000</SingleLogoutRetryInterval> | |
| ______<TenantPartitioningEnabled> | This would add the tenant domain as parameter into the ACS URL. | Boolean | FALSE | Optional | <TenantPartitioningEnabled>false</TenantPartitioningEnabled> | |
| ______<SessionTimeout> | Remember me session timeout in seconds. | Int | 36000 Seconds | Optional | <SessionTimeout>36000</SessionTimeout> | |
| ______<AttributesClaimDialect> | Claim Dialect URI that is used for claim retrieving. | String | http://wso2.org/claims | Optional | <AttributesClaimDialect>http://wso2.org/claims</AttributesClaimDialect> | |
| ______<AcceptOpenIDLogin> | Skips authentication if the valid OpenID login session is available. | Boolean | FALSE | Optional | <AcceptOpenIDLogin>false</AcceptOpenIDLogin> | |
| ______<ClaimsRetrieverImplClass> | Claim retrieving class name for generating a token. | String | N/A | Mandatory | <ClaimsRetrieverImplClass>org.wso2.carbon.identity.sso.saml.builders.claims.DefaultClaimsRetriever</ClaimsRetrieverImplClass> | |
| ______<SAMLResponseValidityPeriod> | SAML Token validity period in minutes. | Int | 5 Minutes | Optional | <SAMLResponseValidityPeriod>5</SAMLResponseValidityPeriod> | |
| ______<UseAuthenticatedUserDomainCrypto> | When set to true, this is useful in tenant mode setup with older versions of API Manager. This indicates that the SAML2 SSO SAML Response must be signed using the authenticated user's tenant keystore. | Boolean | FALSE | |||
| __<EntitlementSettings> | ||||||
| ____<ThirftBasedEntitlementConfig> | Thrift transport configurations for entitlement service. | |||||
| ______<EnableThriftService> | Enable thrift transport. | Boolean | FALSE | Optional | <EnableThriftService>true</EnableThriftService> | |
| _______<ReceivePort> | Thrift listening port. | Int | N/A | Mandatory | <ReceivePort>${Ports.ThriftEntitlementReceivePort}</ReceivePort> | |
| _______<ClientTimeout> | Thrift session time out in seconds. | Int | N/A | Mandatory | <ClientTimeout>10000</ClientTimeout> | |
| _______<KeyStore> | Thrift key store configurations used for SSL. | |||||
| __________<Location> | Key store location | String | N/A | Mandatory | <Location>${carbon.home}/repository/resources/security/wso2carbon.jks</Location> | |
| ___________<Password> | Key store password | String | N/A | Mandatory | <Password>wso2carbon</Password> | |
| __<SCIMAuthenticators> | ||||||
| ____<Authenticator> | Defines implementations of SCIM authenticator. | String | org.wso2.carbon.identity.scim.provider.auth.BasicAuthHandler and org.wso2.carbon.identity.scim.provider.auth.OAuthHandler | Optional | Authenticator class="org.wso2.carbon.identity.scim.provider.auth.BasicAuthHandler"> | |
| ______<Property> | Configuration properties of each autenticator implementation. | String | N/A | Optional | <Property name="Priority">5</Property> |