> For the complete documentation index, see [llms.txt](https://docs.openiam.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.openiam.com/administration-guide/reference/system-properties.md). # System property reference Every system property OpenIAM ships, with its category, type, shipped default and Webconsole label. ## What this is, and when you need it Every setting on **Administration → System Configuration** is a row in the `PROPERTY_FILE_VALUES` table, seeded by a Flyway migration. This page lists all **203** non-audit properties OpenIAM ships, grouped by the `CATEGORY` column — which is also the Webconsole tab the setting appears on. Audit-retention properties are a separate, generated family of 502 keys; see [Audit actions and retention](/administration-guide/reference/audit-actions-and-retention.md). The shipped default is not necessarily the value your services are reading. Four sources can supply one property, and the one that decides behaviour is not always the one on screen: an `OPENIAM_PROP_*` environment variable on the container is invisible from the Webconsole, so a screen can show one value while the running service uses another. Establish which source is in play before concluding that a property does not work — see [Where a property value actually comes from](#where-a-property-value-actually-comes-from). ## How to read this reference | Column | Meaning | | ------------------- | ------------------------------------------------------------------------------------------------------------------------------ | | **Property** | The `PROPERTY_ID`. This is the name to use in a `OPENIAM_PROP_*` container override. | | **Label** | The text rendered in the Webconsole, from `messages_en.properties`, reproduced verbatim. Use this to find the field on screen. | | **Type** | The `PROPERTY_TYPE` column, which decides the editor the Webconsole renders. | | **Shipped default** | The value in a freshly migrated database. `_(empty)_` means the column is `NULL`. | {% hint style="info" %} Labels are quoted exactly as the product renders them, including where the product's own wording is inconsistent with the documentation style guide — several labels read "Self-Service" where the canonical term is "SelfService". Search on the label you can see on screen, not the one you expect. {% endhint %} {% hint style="info" %} A shipped default is what a **new** installation gets. An upgraded or customer-modified system can differ. Capture the current value before you change anything — see [Change configuration safely](/administration-guide/start/change-safely.md). {% endhint %} ## Where a property value actually comes from A property has up to four sources. Later entries win: 1. The application `.properties` file baked into the service image — the compiled-in fallback. 2. The `PROPERTY_FILE_VALUES` row seeded by migration — the value this page lists. 3. An `OPENIAM_PROP_` environment variable in Docker or Kubernetes. 4. An edit made in **Administration → System Configuration**, which writes back to the DB row. So a value shown in the Webconsole is authoritative for DB-backed settings, but a container override can make a *service* behave differently from what the screen shows. See [Where settings live](/administration-guide/start/where-settings-live.md). ## Secret properties keep their value in Vault, not in the database Three properties are of type `Secret`: `org.openiam.default.password`, `org.openiam.smtp.vault.secret.mail.password` and `org.openiam.smtp.vault.secret.mail.username`. They do not behave like the other 200. Saving one writes the value to HashiCorp Vault under the property's own ID, inside a `propertyvalue` namespace, and leaves the `PROPERTY_VALUE` column holding an empty string: {% code overflow="wrap" %} ``` secret/openiam/propertyvalue/org.openiam.default.password ``` {% endcode %} The namespace is what keeps a property ID from colliding with a key the platform reserves for its own secrets — see [Rotate service credentials](/administration-guide/security/rotate-service-credentials.md#the-key-convention-and-the-one-thing-that-defeats-it), where every other key begins `vault.secret.`. Two consequences follow from the column being empty: * **A stored secret shows as `******`.** The Webconsole cannot show you the value, so it shows the same mask every other screen holding a credential uses; a field left blank means no secret is stored. Use the reveal control beside the field to read the value itself. * **Saving the mask back does not wipe the secret.** The mask is recognised on save and not written through, which is what stops an unrelated edit on the same tab from destroying a stored credential. The corollary is that a secret can be replaced but not cleared from the Webconsole; to remove one, delete the Vault entry. ### Read a secret back Given the property ID, the Webconsole returns the stored value as a JSON string: {% code overflow="wrap" %} ``` GET /webconsole/rest/api/property/secret/org.openiam.default.password ``` {% endcode %} It answers only for a property that really is of type `Secret`, so it cannot be turned into a way to read an arbitrary Vault key, and it answers with an empty body when nothing is stored. Every call is recorded under the `VIEW_SECRET_PROPERTY_VALUE` audit event — see [Audit actions and retention](/administration-guide/reference/audit-actions-and-retention.md) — so the audit trail says who revealed which property and when. The event records the request and deliberately not the response: the trail exists to show that a secret was read, not to become a second place to read it from. The same values are reachable with the Vault command line: {% code overflow="wrap" %} ```bash vault kv get secret/openiam/propertyvalue/org.openiam.default.password vault kv put secret/openiam/propertyvalue/org.openiam.default.password value="" vault kv delete secret/openiam/propertyvalue/org.openiam.default.password ``` {% endcode %} ### The default password generates itself `org.openiam.default.password` is the password the platform falls back on when it has to set one and none was supplied. It ships empty, but a deployment never runs without one: on the first start that finds no value in Vault, OpenIAM generates a random 15-character alphanumeric password and stores it. That happens once for the whole deployment, on whichever node starts first, and never again while a value is present — so a password you set yourself is not overwritten on the next restart. Deleting the Vault entry makes the next restart generate a new one. {% hint style="warning" %} **Upgrading relocates the two SMTP secrets.** Before this release the Webconsole wrote the SMTP username and password to `secret/openiam/vault.secret.mail.username` and `…mail.password`, which bore no relation to the IDs of the properties holding them. The first node to start after the upgrade moves whichever of the two is still present into the `propertyvalue` namespace and deletes the old entry. It runs once for the deployment and needs no intervention, but it is worth knowing if you are looking for a key that has moved. {% endhint %} ## Authentication Sign-in routing, break-glass, FIDO and certificate behaviour. Category value in the database: `Authentication` — 15 properties. | Property | Label | Type | Shipped default | | ----------------------------------------------------------- | ------------------------------------------------- | ------- | ----------------------- | | `org.openiam.api.calls.base.domain` | API base domain | String | `http://localhost:8080` | | `org.openiam.approve.new.device.message.approve.link` | Send approval link email for new device | Boolean | `false` | | `org.openiam.approve.new.device.message.info` | Notify user of new device login | Boolean | `false` | | `org.openiam.approve.new.ip.message.approve.link` | Send approval link email for new IP address | Boolean | `false` | | `org.openiam.approve.new.ip.message.info` | Notify user of new IP address login | Boolean | `false` | | `org.openiam.approve.new.location.message.approve.link` | Send approval link email for new location | Boolean | `false` | | `org.openiam.approve.new.location.message.info` | Notify user of new location login | Boolean | `false` | | `org.openiam.challenge.response.custom.validator` | Challenge Response Validator | Groovy | *(empty string)* | | `org.openiam.idm.fido.auth.rp.name` | Relying Party Name | String | `OpenIAM` | | `org.openiam.include.oauth.authorize.url.in.consent.scopes` | Include OAuth2 Authorization URL in Consent Scope | Boolean | `false` | | `org.openiam.password.policy.resolver.script` | Password Policy Resolver Script | Groovy | *(empty string)* | | `org.openiam.saml.time.threshold.minutes` | Time Threshold for SAML Responses | Integer | `10` | | `org.openiam.send.user.activation.link` | Send Activation Link to New Users | Boolean | `true` | | `org.openiam.session.max.concurrent` | Maximum Concurrent Sessions | Integer | `0` | | `org.openiam.webconsole.defaultBaseDomain` | Default Base Domain | String | *(empty string)* | ## Challenge Response Security-question challenge behaviour. Category value in the database: `ChallengeResponse` — 5 properties. | Property | Label | Type | Shipped default | | --------------------------------------------------- | ------------------------------------------------------------ | ---------------------- | --------------- | | `org.openiam.am.helpdesk.mfa` | Activate Multi-Factor Authentication for helpdesk validation | Boolean | `false` | | `org.openiam.am.helpdesk.possibly.asked.attributes` | Select validation attributes for helpdesk inquiries | MultiSelect | *(empty)* | | `org.openiam.am.helpdesk.role.id` | Help Desk Protected Role | Role | *(empty)* | | `org.openiam.selfservice.challenge.response.group` | Default Security Question Group | ChallengeResponseGroup | `GLOBAL` | | `org.openiam.ui.challenge.answers.secured` | Are Security Question Answers Secured? | Boolean | `true` | ## Custom Redirect Post-action redirect targets and allow-listing. Category value in the database: `CustomRedirect` — 7 properties. | Property | Label | Type | Shipped default | | --------------------------------------------------------------- | ---------------------------------------------------------------------- | ------ | ---------------- | | `org.openiam.custom.redirect.challenge.response.questions` | After successfully answering security questions and resetting password | String | *(empty string)* | | `org.openiam.custom.redirect.change_password.after_first_login` | Change password after first login | String | *(empty string)* | | `org.openiam.custom.redirect.edit_profile.after_success_save` | After successfully saving profile | String | *(empty string)* | | `org.openiam.custom.redirect.logout.redirect` | Post-Logout Redirect | String | *(empty)* | | `org.openiam.custom.redirect.reset_password.activate_link` | After activating link | String | *(empty string)* | | `org.openiam.custom.redirect.selfregistration_redirect` | — | String | *(empty string)* | | `org.openiam.custom.redirect.selfservice_redirect` | After login on SelfService page | String | *(empty string)* | ## Directory Lookup Columns and behaviour of the SelfService people directory. Category value in the database: `DirectoryLookup` — 12 properties. | Property | Label | Type | Shipped default | | -------------------------------------------------------------- | --------------------------------------- | -------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `org.openiam.ui.dir.lookup.address.search.result.columns` | Address Search Result Columns | OrderableValue | `bldgNumber,address1,address2,city,country,state,description,type,isDefault,active,published` | | `org.openiam.ui.dir.lookup.email.search.result.columns` | Email Search Result Columns | OrderableValue | `type,email,description,isDefault,active,published` | | `org.openiam.ui.dir.lookup.organization.search.result.columns` | Organization Search Result Columns | OrderableValue | `abbreviation,name,symbol,description,organizationTypeName,domainName,ldapStr` | | `org.openiam.ui.dir.lookup.organization.view.fields` | Organization Details Fields | OrderableValue | `title,jobCodeId,classification,employeeId,userTypeInd,employeeTypeId,locationCd,costCenter` | | `org.openiam.ui.dir.lookup.phone.search.result.columns` | Phone Search Result Columns | OrderableValue | `areaCd,countryCd,phoneExt,phoneNbr,description,type,isDefault,isForSMS,active,published` | | `org.openiam.ui.dir.lookup.subordinates.search.result.columns` | Subordinate Search Result Columns | OrderableValue | `firstName,lastName,userStatus,accountStatus,nickname,birthdateAsStr,maidenName,suffix,gender,middleInit,jobCodeId,title,locationCd,classification,costCenter` | | `org.openiam.ui.dir.lookup.superiors.search.result.columns` | Superior Search Result Columns | OrderableValue | `firstName,lastName,userStatus,accountStatus,nickname,birthdateAsStr,maidenName,suffix,gender,middleInit,jobCodeId,title,locationCd,classification,costCenter` | | `org.openiam.ui.dir.lookup.user.contact.published.only` | Show Only Published Contact Info | OrderableValue | `email,phone,address` | | `org.openiam.ui.dir.lookup.user.view.fields` | User Profile Fields to Display | OrderableValue | `profilePic,firstName,lastName,middleInit,maidenName,nickname,birthdateAsStr,suffix,gender,userStatus,accountStatus` | | `org.openiam.ui.dir.lookup.user.view.show.section` | Show User Info Sections | OrderableValue | `user,organization,emails,phones,addresses,organizations,supervisors,subordinates,alternateContact` | | `org.openiam.ui.user.dir.lookup.search.result.columns` | Directory Lookup Search Result Columns | OrderableValue | `name,title,department,phone,email,location` | | `org.openiam.ui.user.view.user.search.result.columns` | Directory Reports Search Result Columns | OrderableValue | `name,phone,email,organization,department` | ## Gateway Access Gateway (rProxy) behaviour driven from OpenIAM rather than Apache. Category value in the database: `Gateway` — 16 properties. | Property | Label | Type | Shipped default | | ---------------------------------------------- | ----------------------------------------------------------- | ------- | -------------------------------- | | `org.openiam.smtp.mail.defaultSender` | Default sender address (typically the same as the username) | String | *(empty string)* | | `org.openiam.smtp.mail.defaultSubjectPrefix` | Default subject prefix | String | `[OpenIAM Notification]` | | `org.openiam.smtp.mail.host` | SMTP Hostname | String | `smtp.gmail.com` | | `org.openiam.smtp.mail.imap.port` | IMAP Port | Integer | `993` | | `org.openiam.smtp.mail.imap.ssl.enable` | Enable IMAP SSL? | Boolean | `true` | | `org.openiam.smtp.mail.inbox.folder.name` | Inbox folder name | String | `INBOX` | | `org.openiam.smtp.mail.incoming.mail.host` | Incoming mail hostname | String | *(empty string)* | | `org.openiam.smtp.mail.optionalBccAddress` | Optional BCC address | String | *(empty string)* | | `org.openiam.smtp.mail.port` | SMTP Port | Integer | `465` | | `org.openiam.smtp.mail.smtp.auth` | SMTP Authentication | Boolean | `true` | | `org.openiam.smtp.mail.smtp.starttls.enable` | Enable STARTTLS? | Boolean | `true` | | `org.openiam.smtp.mail.socketFactory.class` | Socket factory class | String | `javax.net.ssl.SSLSocketFactory` | | `org.openiam.smtp.mail.socketFactory.fallback` | Socket factory fallback | Boolean | `false` | | `org.openiam.smtp.mail.socketFactory.port` | Socket factory port | Integer | `465` | | `org.openiam.smtp.vault.secret.mail.password` | SMTP Password | Secret | *(empty string)* | | `org.openiam.smtp.vault.secret.mail.username` | SMTP Username | Secret | *(empty string)* | ## IDM Identity-management defaults and extension-script bindings. Category value in the database: `IDM` — 9 properties. | Property | Label | Type | Shipped default | | --------------------------------------------------- | ----------------------------------------------- | ------ | ----------------------------------------------------------- | | `org.openiam.idm.connector.response.handler.script` | Connector Response Custom Groovy Script Handler | Groovy | `prov-helper/CustomConnectorResponseListenerHandler.groovy` | | `org.openiam.idm.eventProcessor.groovy.script` | IDM Data Validation Script | Groovy | `prov-helper/DefaultProvisionServiceEventProcessor.groovy` | | `org.openiam.idm.postProcessor.groovy.script` | User Post-Processor Script | Groovy | `prov-helper/ProvisionServicePostProcessor.groovy` | | `org.openiam.idm.postProcessor.group.groovy.script` | Group Post-Processor Script | Groovy | `prov-helper/ProvisionServiceGroupPostProcessor.groovy` | | `org.openiam.idm.preProcessor.groovy.script` | User Pre-Processor Script | Groovy | `prov-helper/ProvisionServicePreProcessor.groovy` | | `org.openiam.idm.preProcessor.group.groovy.script` | Group Pre-Processor Script | Groovy | `prov-helper/ProvisionServiceGroupPreProcessor.groovy` | | `org.openiam.manage.identities.refresh` | Refresh Identity Data | Groovy | `sync/identities/refreshIdentity.groovy` | | `org.openiam.ui.terminated.user.report` | Terminated User Report | Groovy | `reports/GetTerminatedUsersForReport.groovy` | | `org.openiam.user.conversion.script` | User Conversion Script | Groovy | `user-conversion/UserTypeConversion.groovy` | ## IP Geo-IP resolution used by adaptive authentication. Category value in the database: `IP` — 6 properties. | Property | Label | Type | Shipped default | | -------------------------------------------- | ------------------------------------- | ------- | ------------------------------------------------------------ | | `org.openiam.adaptive.risk.geo.location.use` | Activate Geolocation in Adaptive Risk | Boolean | `false` | | `org.openiam.ip.geo.custom.api.groovy` | Custom IP Location API Script | Groovy | `geo/IPGeoAPIDefaultScript.groovy` | | `org.openiam.ip.geo.db.for.upload` | Geo IP Database for Upload | String | `/data/openiam/conf/iamscripts/geo/db/dbip-city-lite.csv.gz` | | `org.openiam.ip.geo.first.search.in.db` | Search IP Location in Local DB | Boolean | `false` | | `org.openiam.ip.geo.save.new.in.db` | Save New IP Location in Local DB | Boolean | `true` | | `org.openiam.ip.geo.use.custom.api` | Use Custom IP Geolocation API | Boolean | `true` | ## Notifications Notification dispatch behaviour. Category value in the database: `Notifications` — 2 properties. | Property | Label | Type | Shipped default | | ---------------------------------------- | --------------------------------- | ------- | ---------------- | | `org.openiam.system.notification.public` | Show notification on login page | Boolean | `false` | | `org.openiam.system.notification.value` | System Notification On Login page | String | *(empty string)* | ## Organization Organization type IDs and hierarchy behaviour. Category value in the database: `Organization` — 7 properties. | Property | Label | Type | Shipped default | | ----------------------------------------------------------------------- | --------------------------------------------------- | ------------------------- | ------------------------------------ | | `org.openiam.affiliation.primary.type.id` | Primary Affiliation Type | Organization | `100` | | `org.openiam.automatic.organization.hierarchy.assignment.enabled` | Automatic Organization Hierarchy Assignment | Boolean | `true` | | `org.openiam.department.type.id` | Define the Object That Represents a 'Department' | OrganizationType | `DEPARTMENT` | | `org.openiam.division.type.id` | Define the Object That Represents a 'Division' | OrganizationType | `DIVISION` | | `org.openiam.idm.leaver.script` | Termination Script | Groovy | `batch/LeaverProcess.groovy` | | `org.openiam.organization.type.id` | Define the Object That Represents an 'Organization' | OrganizationType | `ORGANIZATION` | | `org.openiam.selfservice.organization.membership.user.screen.hierarchy` | Organization Hierarchy for UI Templating Engine | OrganizationTypeHierarchy | `ORGANIZATION->DIVISION->DEPARTMENT` | ## Password Password change, unlock and recovery behaviour. Category value in the database: `Password` — 17 properties. | Property | Label | Type | Shipped default | | --------------------------------------------------------------------- | ----------------------------------------------------------------- | -------- | ------------------------------ | | `org.openiam.change.password.all` | Show Managed System Dropdown on Change Password Screen | Boolean | `true` | | `org.openiam.default.password` | Default Password | Secret | *(empty string)* | | `org.openiam.forgot.username.enabled` | Is Forgot Username Active? | Boolean | `true` | | `org.openiam.idp.unlock.password.email.enabled` | Allow Password Unlock Using Email Address Instead of Principal? | Boolean | `true` | | `org.openiam.saml.authentication.use.password.auth.type.enabled` | Use PASSWORD\_AUTH type for SAML authentication | Boolean | `true` | | `org.openiam.ui.otp.email.require.on.create` | Require an OTP email address when creating a new user? | Boolean | `true` | | `org.openiam.ui.otp.sms.phone.require.on.create` | Require OTP Phone Number When Creating a New User? | Boolean | `true` | | `org.openiam.ui.otp.sms.resource.entitlement.name.skip.id` | Skip SMS OTP Resource | Resource | `SKIP_SMS_OTP` | | `org.openiam.ui.password.unlock.enabled` | Is Password Unlock Active? | Boolean | `true` | | `org.openiam.ui.reset.password.methods` | Reset password methods | Select | `SMS,EMAIL,CHALLENGE_RESPONSE` | | `org.openiam.ui.user.password.show.generic.message.history.rule.flag` | Show generic message for password history rule violations | Boolean | `true` | | `org.openiam.ui.user.reset.password.button.reSync.show` | Show Resync Button on Reset Password Page | Boolean | `true` | | `org.openiam.ui.user.reset.password.displayAfterReset` | Display Password Value After Successful Reset | Boolean | `false` | | `org.openiam.ui.user.reset.password.option.autoGenerate.defaultValue` | Check 'Auto-Generate Password' by Default on Reset Password Page | Boolean | `false` | | `org.openiam.ui.user.reset.password.option.autoGenerate.show` | Show 'Auto-Generate Password' Option on Reset Password Page | Boolean | `true` | | `org.openiam.ui.user.reset.password.option.sendByEmail.defaultValue` | Check 'Send Password via Email' by Default on Reset Password Page | Boolean | `true` | | `org.openiam.ui.user.reset.password.option.sendByEmail.show` | Show 'Send Password via Email' Option on Reset Password Page | Boolean | `true` | ## System Platform-wide behaviour, crypto, tenants and request authorization. Category value in the database: `System` — 32 properties. | Property | Label | Type | Shipped default | | --------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------ | ----------------- | ----------------------------------------------------------------------------------------------------- | | `openiam.audit.log.batch.size` | Audit Log Batch Size | Integer | `10` | | `openiam.default_managed_sys` | Default Managed System | ManagedSystem | `0` | | `org.openiam.authorization.create.request.disabled` | Disable Create Request Category Authorization (backward compatibility — previously all categories were available to all users) | Boolean | `true` | | `org.openiam.authorization.oauth.disabled` | Disable OAuth Client Authorization (backward compatibility — previously all OAuth clients were available to all users) | Boolean | `true` | | `org.openiam.bootstrap.date.format` | Date/Time Picker Format | String | `MM/DD/YYYY` | | `org.openiam.date.format` | Date Format | String | `MM/dd/yyyy` | | `org.openiam.date.time.format` | Date/Time Format | String | `MM/dd/yyyy HH:mm:ss` | | `org.openiam.defaultNotificationGroup` | Connector Status Notification Group | Group | `SYSTEM_NOTIFICATION` | | `org.openiam.email.validation.regexp` | Email Regular Expression | RegularExpression | `^[_A-Za-z0-9-+]+(.[_A-Za-z0-9-+]+)*@[A-Za-z0-9-]+(.[A-Za-z0-9]+)*(\\.[A-Za-z0-9]{1,})?$` | | `org.openiam.email.validation.regexp.login` | Login Regular Expression | RegularExpression | `^[a-zA-Z0-9_,.@-]*$` | | `org.openiam.email.validation.regexp.name.first` | First Name Regular Expression | RegularExpression | `^[a-zA-Z0-9_,]*$` | | `org.openiam.email.validation.regexp.name.last` | Last Name Regular Expression | RegularExpression | `^[a-zA-Z0-9_,]*$` | | `org.openiam.iam.cryptor.algorithm` | Crypto Algorithm Name | String | `AES` | | `org.openiam.provision.service.flag` | Is Provisioning Active? | Boolean | `true` | | `org.openiam.provision.service.user.entitlements.flag` | Is Entitlements via Provisioning Active? | Boolean | `true` | | `org.openiam.selfservice.organization.search.enabled` | Restrict search to organization scope | Boolean | `false` | | `org.openiam.ui.access.hidden.objects` | Roles that grant visibility to all objects (ignoring the 'Is Visible' flag) | Role | `9` | | `org.openiam.ui.api.google.apikey` | Google Translation API Key | String | *(empty)* | | `org.openiam.ui.enabled.duplicate.emails` | Allow duplicate email? | Boolean | `false` | | `org.openiam.ui.enforce.subordinate.check.flag` | Enforce subordinate check for operations | Boolean | `false` | | `org.openiam.ui.oauth.client.application.launcher` | Application Launcher OAuth Client | Select | *(empty)* | | `org.openiam.ui.oauth.client.teams.plugin` | OAuth Client for Teams Plugin | Select | *(empty)* | | `org.openiam.ui.user.fullname.compose.rule` | Full Name Display Order | OrderableValue | `firstName,lastName` | | `org.openiam.ui.user.search.form.additional.criteria` | Additional User Search Criteria | MultiSelect | *(empty)* | | `org.openiam.ui.user.search.result.columns` | Columns Shown in User Search Results | OrderableValue | `name,phone,email,userStatus,accountStatus` | | `org.openiam.ui.webconsole.active.user.status` | Active User Status | MultiSelect | `ACTIVE,LEAVE,LEAVE_OF_ABSENCE,LEAVE_WITH_PAY,PENDING_INITIAL_LOGIN` | | `org.openiam.ui.webconsole.allow.change.own.entitlements` | Allow users to change their own entitlements | Boolean | `false` | | `org.openiam.ui.webconsole.allow.change.own.status` | Allow users to change their own status | Boolean | `false` | | `org.openiam.ui.webconsole.inactive.user.status` | Inactive User Status | MultiSelect | `TERMINATED,INACTIVE,DECEASED` | | `org.openiam.ui.webconsole.prohibited.user.status` | Prohibited User Status from Self-Service | MultiSelect | `CASE WHEN @propertyFlagValue = 'false' THEN '' ELSE 'TERMINATED,INACTIVE,DECEASED' END` | | `org.openiam.user.direct.reports.columns` | Direct Report Columns | OrderableValue | `name,principal,employeeId,emailAddress,employeeTypeName,phone,type,status,secondaryStatus,start,end` | | `org.openiam.virtual.tenant.enabled` | Activate virtual tenant by organization | Boolean | `false` | ## UI SelfService and Webconsole presentation and feature switches. Category value in the database: `UI` — 35 properties. | Property | Label | Type | Shipped default | | ------------------------------------------------------------------------------ | ---------------------------------------------------------------------------- | ----------- | ----------------------------------------------------------------------------------------------------------------------------------------------------- | | `openiam.show.phone.area.code` | Show Area Code on Phone Numbers | Boolean | `true` | | `org.openiam.error.extra.links.script` | Groovy handler for extra links on error pages | Groovy | `selfservice/CustomErrorPageDisplayHandler.groovy` | | `org.openiam.login.extra.links.script` | Extra links on login page (Groovy handler) | Groovy | *(empty)* | | `org.openiam.my.info.show.profile.picture.section` | Show Profile Picture Section on My Profile Page | Boolean | `true` | | `org.openiam.my.info.show.upload.profile.picture.on.header` | Show Upload Profile Picture Button in Header | Boolean | `false` | | `org.openiam.profile.edit.contact.info.groovy.new.user.approver.postprocessor` | New User Contact Info Approver Post-Processor | Groovy | `selfservice/UnauthenticatedContactInfoPostProcessor.groovy` | | `org.openiam.profile.edit.contact.info.groovy.new.user.postprocessor` | New User Contact Info Post-Processor | Groovy | `selfservice/UnauthenticatedContactInfoPostProcessor.groovy` | | `org.openiam.profile.edit.contact.info.groovy.postprocessor` | Contact Info Post-Processor | Groovy | `selfservice/ContactInfoPostProcessor.groovy` | | `org.openiam.profile.edit.contact.info.groovy.preprocessor` | Contact Info Pre-Processor | Groovy | `selfservice/ContactInfoPreProcessor.groovy` | | `org.openiam.profile.edit.contact.info.groovy.self.register.postprocessor` | Self-Registration Contact Info Post-Processor | Groovy | `selfservice/UnauthenticatedContactInfoPostProcessor.groovy` | | `org.openiam.self.register.enabled` | Is Self-Registration Active? | Boolean | `true` | | `org.openiam.selfregistration.sponsor.validator` | — | Groovy | `selfservice/selfregistration/SponsorValidator.groovy` | | `org.openiam.selfservice.confirmation.on.profile.change` | Require users to confirm email and/or phone changes on the edit profile page | Boolean | `false` | | `org.openiam.selfservice.myinfo.fields` | — | MultiSelect | `SUPERVISOR,CURRENT_LOGIN,LAST_LOGIN,PWD_EXP,PWD_CHANGED,ACCESS_RIGHTS,DIRECT_REPORTS,LAST_LOGIN_FROM,IT_POLICY,USER_ATTR,GROUP_MBR,ROLE_MBR,ORG_MBR` | | `org.openiam.selfservice.myinfo.menus` | — | MultiSelect | `ACCESS_REQUEST,APPROVAL_DASHBOARD,MY_INFORMATION` | | `org.openiam.ui.captcha.default.code` | Default CAPTCHA code | String | `123ABC` | | `org.openiam.ui.captcha.enabled` | Enable CAPTCHA? | Boolean | `true` | | `org.openiam.ui.captcha.height` | CAPTCHA height | Integer | `40` | | `org.openiam.ui.captcha.testing.active` | Enable CAPTCHA testing mode | Boolean | `false` | | `org.openiam.ui.captcha.width` | CAPTCHA width | Integer | `150` | | `org.openiam.ui.login.again.show` | Show 'Login again' button on logout page | Boolean | `true` | | `org.openiam.ui.page.check.sms.phone` | Verify SMS phone number | Boolean | `true` | | `org.openiam.ui.page.footer.copyright` | Footer | String | *(empty)* | | `org.openiam.ui.page.footer.copyright.flag` | Activate Footer | Boolean | `false` | | `org.openiam.ui.page.footer.nav` | Footer Navigation | String | *(empty)* | | `org.openiam.ui.page.header.copyright` | Header Copyright Content | String | *(empty)* | | `org.openiam.ui.page.header.nav` | Header Navigation | String | *(empty)* | | `org.openiam.ui.page.title.organization.name` | Organization Name | String | *(empty)* | | `org.openiam.ui.selfservice.after.start.edit.user.profile` | Redirect to the Edit User Profile page after first login | Boolean | `false` | | `org.openiam.ui.selfservice.directory.lookup.show.details` | Directory Lookup Search Toggle Active | Boolean | `true` | | `org.openiam.ui.selfservice.directory.lookup.skip.delegation.filter` | Does Directory Lookup Use the Delegation Filter? | Boolean | `true` | | `org.openiam.ui.selfservice.header.sso.launch.pad.enabled` | SSO Launch Pad Active | Boolean | `true` | | `org.openiam.ui.selfservice.welcome.page` | Default Self-Service Welcome Page | Select | `/selfservice/myInfo` | | `org.openiam.ui.task.requested.for.details` | Show the 'More' button to display user details on the task page | Boolean | `false` | | `org.openiam.ui.webconsole.edit.user.controller` | — | Groovy | `webconsole/EditUserController.groovy` | ## User Entitlements How entitlements are displayed and evaluated for a user. Category value in the database: `UserEntitlements` — 8 properties. | Property | Label | Type | Shipped default | | --------------------------------------------------------- | ------------------------------------- | ------------ | ----------------------------------------------------- | | `org.openiam.batch.reconciliation.script` | Batch Reconciliation Script | Groovy | `batch/reconciliation.groovy` | | `org.openiam.batch.synchronization.script` | Batch Synchronization Script | Groovy | `batch/synchronization.groovy` | | `org.openiam.cart.validation.script` | Self-Service Cart Validation Script | Groovy | `selfservice/CartValidation.groovy` | | `org.openiam.idm.postProcessorOrganization.groovy.script` | Organization Post-Processor Script | Groovy | `prov-helper/OrganizationServicePostProcessor.groovy` | | `org.openiam.idm.preProcessorOrganization.groovy.script` | Organization Pre-Processor Script | Groovy | `prov-helper/OrganizationServicePreProcessor.groovy` | | `org.openiam.ui.user.entitlement.resType.eliminated` | Excluded Resource Type IDs | ResourceType | *(empty string)* | | `org.openiam.ui.user.entitlement.resType.included` | Included Resource Type IDs | ResourceType | *(empty string)* | | `org.openiam.ui.user.entitlement.resType.revoked` | Included Resource Type IDs for Revoke | ResourceType | *(empty string)* | ## Workflow Approval routing, approver resolution and escalation. Category value in the database: `Workflow` — 32 properties. | Property | Label | Type | Shipped default | | ------------------------------------------------------------------------------------------ | ----------------------------------------------------------------------------------- | -------------- | ------------------------------------------------------------------------------ | | `openiam.ui.activiti.thread.timeout.seconds` | Workflow UI Polling Frequency | Integer | `10` | | `org.openiam.activiti.access.certification.helper.groovy.script` | Access Certification Helper Script | Groovy | `/bpm/certification/CustomCertificationHelper.groovy` | | `org.openiam.activiti.create.request.helper.script` | Workflow Request Creation Helper Script | Groovy | `/bpm/CreateUserRequestHelper.groovy` | | `org.openiam.activiti.create.user.request.entitlements.approver.association.groovy.script` | Create Access Request Entitlements Approver Script | Groovy | `/bpm/CustomCreateUserRequestEntitlementsApproverAssociationIdentifier.groovy` | | `org.openiam.activiti.custom.notification.groovy.script` | Workflow Custom Notification Script | Groovy | `bpm/CustomNotificationDelegate.groovy` | | `org.openiam.activiti.edit.user.approver.association.groovy.script` | Edit User Workflow Approver Calculation Script | Groovy | `bpm/CustomDefaultEditUserApproverAssociationIdentifier.groovy` | | `org.openiam.activiti.generic.approver.association.groovy.script` | Basic Workflow Approver Calculation Script | Groovy | `bpm/CustomDefaultGenericWorkflowRequestApproverAssociationIdentifier.groovy` | | `org.openiam.activiti.manage.access.approver.association.groovy.script` | Access Management Approver Script | Groovy | `/bpm/CustomManageAccessApproverAssociationIdentifier.groovy` | | `org.openiam.activiti.new.user.approver.association.groovy.script` | New User Workflow Approver Calculation Script | Groovy | `bpm/CustomDefaultNewHireRequestApproverAssociationIdentifier.groovy` | | `org.openiam.activiti.rbac.membership.approver.association.groovy.script` | RBAC Workflow Approver Calculation Script | Groovy | `bpm/CustomRBACMembershipWorkflowRequestApproverAssociationIdentifier.groovy` | | `org.openiam.activiti.termination.access.approver.association.groovy.script` | Termination Approver Association Script | Groovy | `/bpm/CustomTerminationAccessApproverAssociationIdentifier.groovy` | | `org.openiam.activiti.user.accepted.invite.approver.association.groovy.script` | Fill Profile Info Workflow Approver Calculation Script | Groovy | `bpm/CustomDefaultUserAcceptInviteApproverAssociationIdentifier.groovy` | | `org.openiam.config.remove.roles.and.groups.terminated.users` | Revoke Roles and Groups After Employee Termination | Boolean | `true` | | `org.openiam.idm.activiti.default.approver.association.resource.id` | Default Approver Resource | Resource | `CREATE_USER_REQUEST_APPROVERS_AR` | | `org.openiam.idm.activiti.default.approver.user` | Default Workflow Approver | User | `3000` | | `org.openiam.idm.activiti.merge.custom.approver.with.approver.associations` | Merge Custom Approver with Approver Associations | Boolean | `true` | | `org.openiam.idm.activiti.new.user.approver.association.order` | New Hire Approver Association Order | OrderableValue | `ORGANIZATION,ROLE,GROUP,SUPERVISOR` | | `org.openiam.provision.after.start.date.initializer` | Provisioning After Start Date Initializer | Groovy | `batch/ActivateProcess.groovy` | | `org.openiam.workflow.access.auto.expire` | Use Batch Task for Handling Expiring Access | Boolean | `false` | | `org.openiam.workflow.access.auto.expire.days.reminder` | Number of days before access expires to allow re-request | Integer | `7` | | `org.openiam.workflow.access.auto.expire.reminder.base.url` | Base URL for Access Renewal Request Links | String | `http://localhost:8080` | | `org.openiam.workflow.create.request.rbac.mode` | Use approver association or role/group instead of resource | Boolean | `false` | | `org.openiam.workflow.default.position.attribute.id` | Default Position ID Attribute | Select | `NOT_USED` | | `org.openiam.workflow.default.position.secondary.attribute.id` | Default Secondary Position ID Attribute | Select | `NOT_USED` | | `org.openiam.workflow.initiate.access.requests.for.entitlements` | Initiate access requests for selected roles/groups (New Hire / Edit User) | Boolean | `false` | | `org.openiam.workflow.master.resource` | Workflow 'Master' Resource | Resource | `WORKFLOW_MASTER` | | `org.openiam.workflow.position.change.use.requested.only` | Include Only Service Catalog Roles and Groups in Position Change Requests | Boolean | `false` | | `org.openiam.workflow.request.access.admin.role` | Roles whose members are permitted to cancel and delegate requests for any user | Role | `9` | | `org.openiam.workflow.revoke.access.admin.role` | Roles whose members are permitted to revoke access for any user | Role | `9` | | `org.openiam.workflow.task.decision.details` | Additional information fields on the task view page | MultiSelect | *(empty)* | | `org.openiam.workflow.termination.access.remove` | Remove access when a user is terminated (if 'No', access will be end-dated instead) | Boolean | `false` | | `org.openiam.workflow.termination.with.approver.association` | Terminate user via the approver association flow | Boolean | `false` | ## Properties removed by a later migration These keys were seeded once and deleted by a subsequent migration. They are listed so that a customer database, an old runbook, or a stale document referring to them can be recognised as out of date. **Do not document or set these.** | Property | Removed in | | --------------------------------------------------------- | ---------- | | `oorg.openiam.ui.captcha.testing.active` | 4.2.0.0 | | `org.openiam.access.view.max.level` | 4.2.2.0 | | `org.openiam.affiliation.default.type.id` | 4.0.0.0 | | `org.openiam.affiliation.types` | 4.2.2.0 | | `org.openiam.attestation.exclude.menus` | 4.2.2.0 | | `org.openiam.custom.redirect.email.secure.link` | 4.2.2.0 | | `org.openiam.first.login.with.cert` | 4.2.2.0 | | `org.openiam.idm.fido.auth.rp.icon` | 4.2.2.0 | | `org.openiam.idm.fido.auth.use.first.login` | 4.2.2.0 | | `org.openiam.password.expiration.warnDays` | 4.1.2.0 | | `org.openiam.password.unlock.secure.enabled` | 4.2.2.0 | | `org.openiam.selfservice.show.search.header` | 4.2.0.8 | | `org.openiam.syslog.actions` | 2026.3.1.0 | | `org.openiam.syslog.facility` | 2026.3.1.0 | | `org.openiam.syslog.hostName` | 2026.3.1.0 | | `org.openiam.syslog.ident` | 2026.3.1.0 | | `org.openiam.syslog.message.order` | 2026.3.1.0 | | `org.openiam.syslog.port` | 2026.3.1.0 | | `org.openiam.task.days.before.leaver` | 4.2.1.3 | | `org.openiam.ui.challenge.response.required` | 4.2.0.0 | | `org.openiam.ui.change.password.confirmation.methods` | 4.2.2.0 | | `org.openiam.ui.device.page.description` | 4.2.0.1 | | `org.openiam.ui.login.page.additional.hyperlink.script` | 4.2.2.0 | | `org.openiam.ui.otp.email.enter.allowed` | 4.2.2.0 | | `org.openiam.ui.reset.pwd.challenge.answers.required` | 4.0.0.0 | | `org.openiam.ui.totp.page.description` | 4.2.2.0 | | `org.openiam.ui.use.policy.required` | 4.2.2.0 | | `org.openiam.ui.user.reset.password.defaultManagedSysIds` | 4.2.1.10 | | `org.openiam.ui.user.search.terminated.objects.flag` | 4.2.1.12 | | `org.openiam.workflow.default.approvers` | 4.2.2.0 | Notable examples: `oorg.openiam.ui.captcha.testing.active` was a shipped typo, corrected by deletion; `org.openiam.workflow.default.approvers` was withdrawn in the 4.2.2.0 cleanup and replaced by approver associations; `org.openiam.idm.fido.auth.use.first.login` was removed in `4.2.2.0`, so FIDO first-login behaviour is no longer property-driven. *Applies to OpenIAM 2026.8.1. Last reviewed 14 September 2026.* --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://docs.openiam.com/administration-guide/reference/system-properties.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.