System parameters Portal & Organization

The following tables cover the system parameters of the "Portal & Organization" module. In their respective areas they cause system-wide changes in behavior and should only be changed if you have complete knowledge of the resulting change in behavior, or if this has been clarified with the responsible Workflow consultant.

Some parameters (especially of the beans PoOptions and PoPasswordQuality) are only the system-wide default value: If a value is set in the client's settings, it takes precedence (noted in the table).

The parameters are grouped by the bean in which they are displayed in the "System parameters" form. Parameters that no longer exist are listed in a separate table at the end.

Overview of the groups

• Login and security

  • AuthenticationOptions: login method, login page, lockout after failed attempts, two-factor authentication, SSO header, system administrator
  • AuthenticationLDAP: connection to the LDAP server/Active Directory
  • LoginTokenUtils: validity of login tokens

• Passwords

  • PoPasswordQuality: password criteria, validity of passwords and reset links
  • PoPasswordResetPolicy: resetting the password by the administrator
  • PoPasswordResetMail: e-mail for "Forgot password?"

• User interface, layout and language

  • GlobalAdminLayoutOptions: display of persons and groups in the administration
  • GlobalUserLayoutOptions: display of persons and groups in user actions, browser notices
  • PoLanguageServiceTarget: default language

• General portal options (PoOptions): user interface and skin, logo in reports, session and start, deputies and organization

• E-mail dispatch

  • PoMailServerConfiguration: SMTP server and default sender
  • PoMailServiceTarget: e-mail dispatch on/off

• Jobs, logging, licenses and internal parameters

  • PoJobServiceTarget: execution of jobs on this server
  • PoLogServiceImpl: logging of actions and users
  • PoLicenceInterceptor: notification about license utilization
  • performanceLogInterceptor: logging of slow calls
  • LockController: internal edit locks

• Removed parameters: parameters that no longer exist, with a note on the replacement

Login and security

AuthenticationOptions

This determines how users log in: login method (DB, LDAP or SSO) including backup method, login page options ("Forgot password?", "stay logged in", login with e-mail address), lockout after failed logins, two-factor authentication, login via an SSO header, as well as the password, name and e-mail address of the system administrator (sadmin). For two-factor authentication, the client setting "Enforce two-factor authentication" takes precedence; the other values apply system-wide.

Property	Explanation	Possible value(s)
authenticationMode	Authentication mode (formerly bean Authentication; the value was adopted automatically during the update).	DB/LDAP/SSO (default: DB)
backupAuthenticationMode	Backup authentication mode: If the primary authentication does not know the user, login is attempted with this mode (e.g. DB with SSO for users who are not in Active Directory). If the value is the same as the primary mode, there is no backup authentication. Formerly bean AuthenticationBackupForSSO, property authenticationMode.	DB/LDAP/SSO (default: DB)
allowPasswordResetByUser	If the parameter is set to true, the user has the "Forgot password?" link available on the login page. The user then receives an e-mail (see PoPasswordResetMail) with a link through which they can set a new password themselves. This parameter only makes sense in combination with authentication mode DB. Formerly bean Authentication.	true/false (default: true)
allowRememberMe	If true, the "stay logged in" option is offered on the login page (see Password criteria and system parameters).	true/false (default: true)
allowMailAdressAsLoginUserName	If true, users can log in with their e-mail address instead of their user name.	true/false (default: true)
useSingleGenericMessageForLoginProblems	If true, the same generic error message is displayed for all login problems (e.g. unknown user, wrong password).	true/false (default: true)
maxNumberOfFailedLoginAttempts	Number of failed login attempts within maxNumberOfSecondsBetweenFailedLoginAttempts seconds after which the user is locked; the user receives an e-mail about this (bean PoLockUserMail). Via "Forgot password?" the user can set a new password and is thereby unlocked again. 0 = no lockout. The system administrator (sadmin) is never locked.	Number (default: 0)
maxNumberOfSecondsBetweenFailedLoginAttempts	Period in seconds in which the failed login attempts are counted for maxNumberOfFailedLoginAttempts.	Number (default: 60)
allow2ndFactorPerUser	If true, users can activate or deactivate two-factor authentication themselves in their security settings. If "Enforce two-factor authentication" is activated for the client, two-factor authentication applies to all users of the client regardless of this parameter.	true/false (default: false)
cutDomain	If the parameter is set to true, the Webdesk user name does not have to include the Windows domain (a user name in the form DOMAIN\user is shortened to user). Formerly bean AuthenticationSSO.	true/false (default: true)
ssoHeaderNameRemoteUser	Name of the HTTP header in which an upstream system passes the Webdesk user name when the authentication mode is SSO. The user is only logged in if the request URL begins with the value of ssoHeaderAuthenticationValidationUrl.	Text (default: X-Remote-User)
ssoHeaderAuthenticationValidationUrl	Beginning of the URL with which the request URL must begin for a login via the header from ssoHeaderNameRemoteUser to take place (e.g. https://personalwolke.at/webdesk3-sso/).	URL (default: empty)
sysAdminPassword	Password of the system administrator (sadmin), stored encrypted. Formerly bean Authentication.
sysAdminPasswordMinLength	Minimum length of the system administrator's password.	Number (default: 12)
sysAdminPasswordRequiresUpperAndLowerCharacters	If true, the system administrator's password must contain uppercase and lowercase letters.	true/false (default: true)
sysAdminPasswordMinNumberOfSpecialChars	Minimum number of special characters in the system administrator's password.	Number (default: 1)
sysAdminCommonName	Displayed name of the system administrator. Formerly bean Authentication.	Full System Administrator
sysAdminEmail	E-mail address of the system administrator; among other things, a warning is sent to it if there are too many failed login attempts with the user sadmin.	E-mail address (default: support@workflow.at)

AuthenticationLDAP

Connection data for the LDAP server or Active Directory (server addresses including backup server, technical user, TLS) and the search for the user in the directory (base DN, search query). These parameters are only effective if the authentication mode or backup authentication mode in AuthenticationOptions is LDAP; they apply system-wide.

Property	Explanation	Possible value(s)
tlsEnabled	TLS encryption of the LDAP query is activated	true/false (default: false)
ldapUser	LDAP user name	myLdapUser
ldapPassword	LDAP password
ldapProviderUrl	LDAP provider URL	ldap://192.168.1.2
ldapProviderBackupUrl	URL of a second LDAP server that is used if the server from ldapProviderUrl is not reachable.	ldap://192.168.1.3
ldapBaseDn	Base DN of the LDAP query. A list of base DNs can be specified, which are searched in order.	List, e.g. CN=Workflow
ldapSearchSubTree	Should the entire LDAP tree below the base DN be searched?	true/false (default: true)
ldapSearchQuery	Query that uniquely returns objects of type person and contains the binding object; {0} is replaced by the entered user name.	Default: (|(cn={0})(mail={0})(uid={0})(sAMAccountName={0}))

LoginTokenUtils

Validity of the short-lived login tokens that Webdesk sends to the client at login. Applies system-wide.

Property	Explanation	Possible value(s)
timeToLiveLoginToken	Number of seconds a login token is valid once it is sent to the client.	10

Passwords

The password criteria and how they interact with the client settings are described in detail in Password criteria and system parameters. These parameters only affect users who log in with authentication mode DB.

PoPasswordQuality

Requirements for new passwords (length, digits, special characters, uppercase and lowercase letters, reuse of earlier passwords), validity period of passwords and validity of the link for setting a new password. These values are the system-wide default: For the parameters noted in the table, a value in the client's password settings takes precedence.

Property	Explanation	Possible value(s)
minimalDigitsCount	Required number of digits in the new password. A value in the client's password settings takes precedence.	Number (default: 0)
minimalLength	The minimum length of the new password. A value in the client's password settings takes precedence.	Number (default: 0)
minimalSpecialCharactersCount	Required number of special characters such as "@" or "!" in the new password. A value in the client's password settings takes precedence.	Number (default: 0)
numberOfDifferingLatestPasswords	Minimum number of different passwords before one may be reused. A value in the client's password settings takes precedence.	Number (default: 0)
requiresUpperAndLowerCharacters	If true, both lowercase and uppercase characters must occur in the new password. A value in the client's password settings takes precedence.	true/false (default: false)
validityDays	The number of days after which the password must be changed	Number (default: 30), e.g. 365 for password is valid for 365 days-1 for passwords that never expire (otherwise the smallest sensible value is 1)Details: here
resetPasswordTokenValidityInHours	Validity in hours of the link that the user receives by e-mail for setting a new password ("Forgot password?", first login of new persons). A value in the client setting "Reset password token validity (hours)" takes precedence.	Number (default: 24)

PoPasswordResetPolicy

Behavior when a password is reset by the administrator: which password it is reset to (user name or fixed default password) and whether the user must change it at the next login. Applies system-wide.

Property	Explanation	Possible value(s)
forcePasswordChangeAfterReset	If activated, after the administrator resets the password (to the user name or standardResetPassword) the user must change their password at the next login	true/false (default: true)
forcePasswordChangeAfterResetToRandomPassword	Has no effect: When resetting by e-mail, a random password is no longer assigned; the user sets a new password themselves via the link.	true/false (default: false)
standardResetPassword	Default password to which the password is reset if useUsernameAsStandardPassword is set to false	webdesk
useUsernameAsStandardPassword	As an alternative to standardResetPassword, the user name can be used as the default password	true/false (default: true)

PoPasswordResetMail

Sender, subject and text of the e-mail that a user receives via "Forgot password?" on the login page (see AuthenticationOptions.allowPasswordResetByUser). The default text must be adapted before use so that it contains the link for setting the new password.

Property	Explanation	Possible value(s)
explicitRecipient	Recipient of the mail, if the e-mail address stored for the person is not to be used.	E-mail address (default: empty)
senderMailAddress	The mail address to be used as sender	E-mail address (default: office@workflow.at)
subject	Subject of the mail sent to the user when they reset their password	Your webdesk password has been reset
templateBody	Content of the mail sent to the user when they reset their password. The mail no longer contains a password, but a link through which the user sets a new password. The text can contain the Velocity variables $person.xxx (person data) and $resetId; the link must be included in the text, e.g. <Webdesk-URL>/changepassword?resetId=$resetId.	Free text; the default text (English) does not yet contain a link and must be adapted.

User interface, layout and language

GlobalAdminLayoutOptions

How persons and groups are labeled in selection lists of the administration (e.g. permission control). The values are Velocity expressions and apply system-wide.

Property	Explanation	Possible value(s)
personLabelLayout	Velocity expression for the label of a person in selection lists of the administration (e.g. permission control). Replaces the former property personSelectionlistLayout.	e.g. ${fullName} (${orgUnit.shortName}) (default: empty)
groupLabelLayout	Velocity expression for the label of a group in selection lists of the administration.	e.g. ${shortName} (${name}) (default: empty)

GlobalUserLayoutOptions

How persons and groups are labeled in user actions (Velocity expressions), the notice for a browser zoom above 100%, and an internal parameter for troubleshooting. Applies system-wide.

Property	Explanation	Possible value(s)
personLabelLayout	Velocity expression for the label of a person in user actions.	e.g. ${fullName} (${orgUnit.shortName}) (default: empty)
groupLabelLayout	Velocity expression for the label of a group in user actions.	e.g. ${shortName} (${name}) (default: empty)
debugAjax	Internal parameter for troubleshooting; only change after consulting Workflow.	true/false (default: false)
showZoomNotificationInIE	Notice that appears when the browser has been set to a zoom above 100% (true); the notice is deactivated with "false".	true/false (default: true)

PoLanguageServiceTarget

The default language of the system. It is used when the default languages are created in the database (at first start).

Property	Explanation	Possible value(s)
standardDefaultLangCode	Setting of the default language	de

General portal options (PoOptions)

The bean PoOptions combines general portal settings. Some values are only the system-wide default and can be overridden in the client's settings (noted in the table).

PoOptions: User interface and skin

Behavior and appearance of the user interface: skin, context menu, dimming while loading and display of JavaScript errors. Some older parameters have no effect in the current user interface (noted in the table).

Property	Explanation	Possible value(s)
jsErrorHandling	Used to report JavaScript errors more clearly. If true, a JS dialog box is displayed when a JS error is caught.	true/false (default: true)
hideContextMenu	Hides the context menu in general.	true/false (default: false)
allowSkins	Technical parameter with no practical effect: The only skin in use is the Responsive Skin; users can no longer select a skin of their own. During the update to the Responsive Skin the value was set to false; do not change.	true/false (default: false)
defaultSkin	Name of the skin in use. The Classic Skin is no longer supported (even though it is still technically defined); the value must remain "responsive".	responsive (default)
progressOpacityInPercent	Dimming value for the loading process (between 0 and 100) -> 0... no dimming, 100 -> black	Number (default: empty)
pathToWelcomeLogo	A path to a logo can be defined here. Images must always be specified with a leading images. The sitemap forwards the logo to the specified paths	The sitemap forwards the logo, namely to the paths:custom/resources/images/{1}resource://at/workflow/webdesk/po/resources/images/{1}{1} in this case stands for the path that is specified.
pathToStaticPages	No longer used (no effect).
headerText	Text formerly displayed for users in the top bar (formerly bean PoOrganisationServiceTarget). No longer displayed in the current user interface (no effect).	PersonalNr: $getEmployeeId$

PoOptions: Logo and company name in reports

Company logo (image file and height) and company name in the header of reports. For all three parameters, a value in the client's settings takes precedence.

Property	Explanation	Possible value(s)
logoImageFilePath	Path of the image file for the company logo in the header of reports (URL, file path or classpath). A value in the client setting "File path to logo" takes precedence.	Default: at/workflow/webdesk/po/resources/images/workflow_reports_logo.png
logoImageHeight	Height of the company logo in reports. A value in the client setting "Logo height" takes precedence.	e.g. 20mm, 0.5in (default: 18mm)
logoName	Company name for the header of reports. A value in the client setting "Company name" takes precedence.	Text (default: Workflow)

PoOptions: Session, start and system environment

The action opened at start, the session timeout, the external address of Webdesk (e.g. for links in e-mails), the rule for calendar weeks, and the cluster nodes for assigning jobs. webdeskURL must be set per system.

Property	Explanation	Possible value(s)
firstAction	Name of the action that is opened automatically when Webdesk starts. If empty, 'po_welcome.act' is opened. The action is only opened if the user is authorized for it (or for a configuration derived from it); the parameter does not apply to the system administrator.
sessionTimeout	Duration of inactivity in minutes after which the session of a logged-in user expires.	Number (default: 1440)
webdeskURL	External address (URL) of Webdesk, e.g. for links in e-mails from jobs that send evaluations. Must be set per system. A value in the client setting "Application URL for SSO/SAML login" takes precedence.	URL, e.g. https://webdesk.yourcompany.at (default: empty)
localeForWeekOfYearAndDayOfWeek	Language code (2-letter ISO 639 code, without country extension) according to which the first week of the year and the first day of the week are determined.	e.g. de, en (default: de)
clusterNodes	List of cluster nodes, used when assigning a job to a cluster node	ClusterNode1

PoOptions: Deputies and organization

Whether users may define deputies for their roles themselves and for how long, as well as the restriction to one cost center per user. For allowUserDeputy, the client setting "Allow deputy definition" takes precedence.

Property	Explanation	Possible value(s)
allowUserDeputy	If true, users may define deputies for their roles themselves in their personal settings. A value in the client setting "Allow deputy definition" takes precedence.	true/false (default: false)
allowUserDeputyForXDaysMax	Maximum number of days for which the definition of a deputy in the personal settings may be valid. 0 = no restriction.	Number (default: 0)
allowOnlySingleCostCenterAssignment	When using cost centers (separate org structure), activating the parameter ensures that a user can only ever belong to one cost center. Formerly bean PoOrganisationServiceTarget.	true/false (default: true)

E-mail dispatch

PoMailServerConfiguration

Connection to the SMTP server through which Webdesk sends all e-mails (address, port, login, encryption with STARTTLS or SSL/TLS), and the default sender address. Applies system-wide.

Property	Explanation	Possible value(s)
adress	Host name or IP address of the SMTP mail server through which mail can be sent.	asterix.workflow.at
defaultSender	Default sender e-mail address for mails (if none is explicitly specified)	E-mail address (default: webdesk@workflow.at)
password	Password for authentication on the SMTP server.
port	Port for the SMTP server	Number (default: 25)
userName	User name for authentication on the SMTP server; if empty, anonymous authentication to the mail server is assumed.
useStartTls	If true, the connection to the SMTP server is encrypted with STARTTLS.	true/false (default: false)
useSSL	If true, the connection to the SMTP server is established via SSL/TLS.	true/false (default: false)

PoMailServiceTarget

Switches e-mail dispatch of the Webdesk server on or off, e.g. to avoid sending e-mails to users on test systems.

Property	Explanation	Possible value(s)
active	If false, Webdesk sends no e-mails (e.g. on test systems).	true/false (default: true)

Jobs, logging, licenses and internal parameters

PoJobServiceTarget

Whether jobs are executed on this Webdesk server and with how many parallel threads. The job scheduler is initialized with these values when the server starts, so changes only take effect after a restart.

Property	Explanation	Possible value(s)
active	If false, no jobs are executed on this Webdesk server.	true/false (default: true)
noOfSchedulerThreads	Number of scheduler threads per Webdesk server, i.e. how many jobs can be processed simultaneously. 0 switches off the execution of jobs on this server.	1

PoLogServiceImpl

Which actions and which users are written to the database logs. The lists are normally maintained via the "Log settings" form and not edited directly.

Property	Explanation	Possible value(s)
actionsToLog	List of actions to be logged. This system parameter is set automatically by the 'Log settings' form. Formerly bean PoLogServiceTarget.	e.g. ta_getOrgAccounts
logAllActions	Should all actions be logged (to the DB logs)? Formerly bean PoLogServiceTarget.	true/false (default: false)
logAllUsers	Should all users be logged (to the DB logs)? Formerly bean PoLogServiceTarget.	true/false (default: false)
usersToLog	List of Webdesk users (user names) to be logged. This system parameter is set automatically by the 'Log settings' form. Formerly bean PoLogServiceTarget.	ABELS

PoLicenceInterceptor

E-mail notification of the license manager when the number of licenses in use exceeds a threshold. Without an e-mail address, no license notifications are sent.

Property	Explanation	Possible value(s)
licenceManagerEmail	E-mail address of the license manager. If it is empty, no license notifications are sent.	E-mail address (default: empty)
sendMailToLicenceManagerIfTresholdReached	If true, the license manager (licenceManagerEmail) receives an e-mail when the number of licenses in use exceeds the threshold (tresholdFactor) (at most once in 24 hours).	true/false (default: true)
tresholdFactor	Threshold as a proportion of the licensed number, above which the e-mail is sent to the license manager (0.95 = 95%).	Number (default: 0.95)

performanceLogInterceptor

Logging of slow calls for performance analysis: Calls that take longer than the specified time are logged if the logger is set to level TRACE.

Property	Explanation	Possible value(s)
loggerName	Name of the logger used for the performance check. If level TRACE is set on this logger, a log entry with a time indication is created when maxMillisBeforeLogging is exceeded	at.workflow.webdesk.performanceLogger
maxMillisBeforeLogging	Time in milliseconds -> if reached, it is logged at log level TRACE. The property treshold previously documented here no longer exists.	50

LockController

Internal parameter for Webdesk's internal edit locks. Only change after consulting Workflow.

Property	Explanation	Possible value(s)
minToLive	Internal parameter: validity (in minutes) of internal edit locks that are no longer refreshed. Only change after consulting Workflow.	3

Removed parameters

The following system parameters were previously described in this document but no longer exist. A value that is still set has no effect; where there is a replacement, it is indicated. Parameters that still exist but have no effect are listed with the note "no effect" at their bean.

Bean.Property	Status/Replacement
Authentication.sysAdminUser	Removed. This system parameter no longer exists. The user name of the system administrator is fixed as "sadmin".
AuthenticationLDAP.ldapUserNameField	Removed. This system parameter no longer exists. Which LDAP fields are used to search for the user is determined via ldapSearchQuery.
GlobalUserLayoutOptions.acceptCaptionLayoutProblemInIE	Removed. This system parameter no longer exists.
GlobalUserLayoutOptions.forcelFullAjax	Removed. This system parameter no longer exists.
PoCacheHibernateUtils.forceReload	Removed. This system parameter no longer exists.
PoMenuServiceTarget.extractPermissionBeforeHand	Removed. This system parameter no longer exists (the bean PoMenuServiceTarget was removed).
PoMenuServiceTarget.resolveViewPermissionsBeforeHand	Removed. This system parameter no longer exists (the bean PoMenuServiceTarget was removed).
PoOptions.skins	Removed. This system parameter no longer exists. The skin in use is determined via defaultSkin.
PoSystemMessageTarget.daysToLive	Removed. This system parameter no longer exists.
ServerParamList.elements	Removed. This system parameter no longer exists in the PO module. The connection parameters for the groupware system are configured in the GW module.
PoUtilServiceTarget.timeToLiveLoginToken	Removed. This system parameter no longer exists. The validity of login tokens is determined via LoginTokenUtils.timeToLiveLoginToken.
StartupListener.firstStartupBeanName	Removed. This system parameter no longer exists.