# PingFederate Initialization Properties File

# The properties in this file control the administrative console as well as
# the runtime server (transaction-processing) behavior, and deployment, 
# including server clustering. Changes are optional. For detailed information, 
# refer to the Administrator's Manual and the Server Clustering Guide.

# ---------------------------------
# Administrative Console Properties
# ---------------------------------
#
# This property defines the port on which the PingFederate administrative 
# console and API runs. Default is 9999.
pf.admin.https.port=9999

# This property defines the URL that PingFederate's administrative node will use
# to populate resource references in Administrative API responses
# and for the redirect URL the node will send to an OP for administrator OIDC login
# (for example, https://pingfederate-admin.example.com or, if the load balancer uses
# a custom port, https://pingfederate-admin.example.com:8443).
#
# This property should be used because pf.admin.hostname has been deprecated.
# If pf.admin.hostname is defined in run.properties, it will be ignored
# if pf.admin.baseurl is specified. But if only pf.admin.hostname is defined,
# then the URL will be constructed the same way as in versions of PingFederate
# before 10.3.
pf.admin.baseurl=

#
# This property defines the IP address over which the PingFederate 
# administrative console communicates. Use for deployments where multiple 
# network interfaces are installed on the machine running PingFederate.
# The bind addresses can be ipv6 compliant: use "::" as a replacement
# for "0.0.0.0".
pf.console.bind.address=0.0.0.0

#   HTML page title
#   ---------------
# This property defines the browser window or tab title for the administrative 
# console, used to make separate instances identifiable.
pf.console.title=PingFederate

#
# This property defines the name of the PingFederate environment that will be
# displayed in the administrative console, used to make separate environments
# easily identifiable.
pf.console.environment=

#   HTML page background image
#   ---------------
# This property enables image background for administrative console
pf.console.show.background.images=true

#   PingOne unified admin settings
#   -----------------------
# These properties set the URL of the PingOne unified admin icon in the PingFederate administrative console.

# This property should be set based on the region of your PingOne organization.
#   Valid values are:
#     com     - indicates the North America region at console.pingone.com
#     eu      - indicates the Europe region at console.pingone.eu
#     asia    - (Deprecated) Please use com.au instead. Indicates the Asia region at console.pingone.asia
#     ca      - indicates the Canada region at console.pingone.ca
#     com.au  - indicates the Australia region at console.pingone.com.au
#     sg      - indicates the Singapore region at console.pingone.sg
pf.pingone.admin.url.region=

# The ID of your PingOne organization's environment.
pf.pingone.admin.url.environment.id=

#   Admin Console UI Timeout
#   ------------------------
#
# This property defines the length of time (in minutes) until an inactive 
# administrative console times out. The minimum setting is 1 minute; maximum is 
# 8 hours (480 minutes). 
# Default is 30 minutes.
pf.console.session.timeout=30

#   Login Mode
#   ----------
#
# This property indicates whether more than one Admin user may access the 
# administrative console at one time. 
#   Valid values are:
#     single   - Only one Admin user may log on at a time.
#     multiple - More than one Admin user may log on simultaneously.
# Default is multiple.
pf.console.login.mode=multiple

#   Authentication Mechanism
#   ------------------------
# This property defines whether administrators log on to PingFederate using 
# credentials managed internally, by PingFederate, or externally. Single sign-on
# via the PingOne admin console is also available, and is independent of the
# mechanism chosen here.
#   Valid values are:
#     none   - No direct login method is available.
#     native - Internal password file authentication.
#     LDAP   - External LDAP authentication.
#     cert   - X509 certificate-based authentication.
#     RADIUS - External RADIUS authentication.
#     OIDC   - External or Internal OIDC authentication.
# Default is native.
pf.console.authentication=native

# Authentication methods for the Admin API.
#   Valid values are:
#     none   - No direct login method is available.
#     native - Internal password file authentication.
#     LDAP   - External LDAP authentication.
#     cert   - X509 certificate-based authentication.
#     RADIUS - External RADIUS authentication.
#     OAuth2 - External or Internal OAuth2 authorization.
#     JWT    - External JWT bearer tokens for authentication.
# Default is native.
#
# Administrators may also configure OAuth2 or JWT authorization together with
# a basic authentication method by separating the values with a comma.
# Basic authentication methods include native, LDAP, and RADIUS.
#   Example:
#      pf.admin.api.authentication=OAuth2,LDAP
#   Note:
#    - The values are case-insensitive.
#    - The order of the values is not important. PingFederate will use the HTTP
#      Authorization request header to determine the AuthN/AuthZ scheme. Only one
#      Authorization header is allowed in a request.
#    - none and cert cannot be used with any other authentication methods.
#    - If any invalid value or more than two authentication methods are defined,
#      PingFederate will fail on startup.
# Please find the documentation for details about using multiple authentication
# sources.
pf.admin.api.authentication=native

#
# When LDAP administrative-console authentication is enabled, this property 
# indicates the name of the file containing configuration properties.
ldap.properties.file=ldap.properties

#
# When certificate-based authentication is enabled, this property indicates the 
# name of the file containing configuration properties.
cert.properties.file=cert_auth.properties

#
# When RADIUS-based authentication is enabled, this property indicates the 
# name of the configuration properties file.
radius.properties.file=radius.properties

#
# When OIDC administrative-console authentication is enabled, this property
# indicates the name of the file containing configuration properties.
oidc.properties.file=oidc.properties

#
# When OAuth 2.0 administrative-API authentication is enabled, this property
# indicates the name of the file containing configuration properties.
oauth2.properties.file=oauth2.properties

#
# When JWT administrative-API authentication is enabled, this property
# indicates the name of the file containing configuration properties.
jwt.properties.file=jwt.properties

# -------------------------
# Runtime Server Properties
# -------------------------
#
# To turn off an HTTP listener, set the port to a value of less than zero.
# You should always use SSL. Turning on "pf.http.port" is not recommended. 
# If you do want to turn on "pf.http.port" for testing purposes, you will 
# need to update data/config-store/session-cookie-config.xml 
# to turn off the secure cookie.
pf.http.port=-1

#
# This property defines the port on which PingFederate listens for 
# encrypted HTTPS (SSL/TLS) traffic. 
# Default is 9031.
pf.https.port=9031

# This property defines a secondary HTTPS port that can be used for mutual SSL/TLS
# (client X.509 certificate) authentication for both end users and protocol
# requests (SAML, WS-Trust and OAuth). Set its value to the desired inbound
# listening TCP port.
# A value of -1 disables this feature.
pf.secondary.https.port=-1

#
# This property defines the IP address over which the PingFederate server 
# communicates with partner federation gateways. Use for deployments where 
# multiple network interfaces are installed on the machine running PingFederate.
# The bind addresses can be ipv6 compliant: use "::" as a replacement
# for "0.0.0.0".
pf.engine.bind.address=0.0.0.0

#
# This property defines the IP address over which JMX
# communicate with PingFederate. Use for deployments where multiple network 
# interfaces are installed on the machine running PingFederate.
# The bind addresses can be ipv6 compliant: use "::" as a replacement
# for "0.0.0.0".
pf.monitor.bind.address=0.0.0.0

#
# This property defines the protocol to be used by PingFederate. 
# Valid values are: 
#   true  - Enables use of ipv_4 only. 
#   false - Enables use of both ipv_4 and ipv_6.
# Default is true.
pf.engine.prefer_ipv4=true

# This property defines the context path used for the PingFederate
# runtime application.
# Note: If this property is changed, the path must also be added to
# the base URL for your PingFederate system protocol settings.
# The default is "/", which is the root of the server.
# Both, "/sso" and "/sso/" are valid values for this property.
pf.runtime.context.path=/

#
# This property defines the network path to the output location of log files. 
# Default is: 
#  <pf_install>/pingfederate/log
#pf.log.dir=

#
# This property enables detailed event logging where changes to the components are logged. 
# Default is false
#
pf.log.eventdetail=false

#
# This property enables detailed system monitoring information to be made available 
# in the heartbeat endpoint 
#
pf.heartbeat.system.monitoring=false

#
# This property sets the maximum request body size for inbound runtime requests.
# Default is 200000 if one is not specified. Units are in bytes.
#
pf.runtime.http.maxRequestBodySize=200000

# ---------------------
# Deployment Properties
# ---------------------

#   Operational Mode
#   ----------------
# This property indicates the operational mode of the runtime server (protocol
# engine) from a clustering standpoint. 
#   Valid values are:
#     STANDALONE        - This server is a standalone instance that runs both 
#                       the UI console and protocol engine (default).
#     CLUSTERED_CONSOLE - This server is part of a cluster and runs only the 
#                       administration console.
#     CLUSTERED_ENGINE  - This server is part of a cluster and runs only the 
#                       protocol engine. 
# Note: Only one node in a cluster can run the administrative console unless
# the active/passive administrative console feature is enabled.
# Default is STANDALONE.
pf.operational.mode=STANDALONE

# The following properties apply only if "pf.operational.mode"
# is *not* STANDALONE:
pf.cluster.node.index=
# A strong, randomly-generated key (22 or more alphanumerics) is recommended.
# In BCFIPS mode, if encryption is enabled, the minimum length of 22
# characters is enforced.
pf.cluster.auth.pwd=
pf.cluster.encrypt=false

# Specify the key size to use with the AES encryption algorithm that is used
# when encrypting communication among the cluster. The key sizes allowed
# are dependent on the cryptography provider enabled with the JVM.  For
# example, Oracle's Java Cryptography Extension (JCE) Unlimited Strength
# provider supports 128, 192, and 256 bit key sizes.
# Default is 128.
pf.cluster.encryption.keysize=128

# Specify the IP address for cluster communication, or leave as NON_LOOPBACK to
# allow the system to choose an available non-loopback IP address.
pf.cluster.bind.address=NON_LOOPBACK
pf.cluster.bind.port=7600
pf.cluster.failure.detection.bind.port=7700

# Allowed values for the following properties are: tcp/udp. Default is tcp.
# IMPORTANT: For UDP clustering with PingFederate running on Windows using ipv6. 
# You must supply the interface identifier (for example: %11) in the 
# "pf.cluster.bind.address" above.
pf.cluster.transport.protocol=tcp
pf.cluster.mcast.group.address=239.16.96.69
pf.cluster.mcast.group.port=7601

# When TCP is used, this property specifies the list of hosts in the cluster.
# For example: "10.0.1.4[7600],server2.mydomain.com[7600]".
# If only a subset of hosts is included, then you must set
# pf.cluster.TCPPING.return_entire_cache in jgroups.properties to true.
#
# IMPORTANT: For ipv6, DO NOT use brackets ([]) to surround the IP addresses.
#
# For dynamic clusters using tcp as the transport protocol, alternate 
# discovery mechanisms are available. See bin/jgroups.properties for
# further details. If a dynamic discovery mechanism is used, this property
# is ignored.
pf.cluster.tcp.discovery.initial.hosts=

# This property enables/disables adaptive clustering. Please see the
# PingFederate clustering guide for more information on this capability.
#  Valid values are: 
#   true - enable adaptive clustering
#   false - disable adaptive clustering
# Default is true. 
pf.cluster.adaptive=true

# This property enables/disables JGroups cluster diagnostics.
#  Valid values are: 
#	true - enable diagnostics
#	false - disable diagnostics
# Default is false
pf.cluster.diagnostics.enabled=false

# These properties define the IP address and port over which PingFederate communicates
# JGroups diagnostic information.
pf.cluster.diagnostics.addr=224.0.75.75
pf.cluster.diagnostics.port=7500

# The maximum number of threads in JGroups thread pool responsible for
# processing received RPCs.
# For this property to take effect, conf/tcp.xml (if TCP protocol is used)
# or conf/udp.xml (if UDP protocol is used) must be up-to-date.
# Default is 40.
pf.cluster.thread.pool.max.threads=40

# This property defines the tags associated with this PingFederate node.
# Configuration is optional. When configured, PingFederate takes this property
# into consideration when processing requests. For example, tags may be used
# to determine the data store location that this PingFederate
# node communicates with. Administrators may also use tags in conjunction with
# authentication selectors and policies to define authentication requirements.
#
# Administrators may define one tag or a list of space-separated tags.
# Each tag cannot contain any spaces. Other characters are allowed.
#
# Example 1: node.tags=north
# Example 1 defines one tag: 'north'
#
# Example 2: node.tags=1 123 test
# Example 2 defines three tags: '1', '123' and 'test'
#
# Example 3: node.tags=
# Example 3 is also valid because the node.tags property is optional.
node.tags=

#   Hardware Security Module Mode
#   -----------------------------
# This property enables or disables a Hardware Security Module.
#
#  Valid values are:
#    AWSCLOUDHSM - Denotes an AWS CloudHSM (not classic) implementation.
#    NCIPHER     - Denotes an Entrust nShield Connect implementation.
#    LUNA        - Denotes a Thales Luna implementation.
#    BCFIPS      - Denotes a Bouncy Castle FIPS implementation.
#    OFF         - Use the default Sun keystore/JCE implementation.
# Default is OFF.
pf.hsm.mode=OFF

#  Hardware Security Module Hybrid Mode
#  ------------------------------------
#  This property enables or disables Hybrid mode for an HSM setup.  
#
#  When PF is in Hybrid mode, certs/keys can be created either on the local trust store or on the HSM.
#  This can used as a migration strategy towards an HSM setup.
#
#  Valid values are:
#    true - enable Hybrid mode.
#    false - disable Hybrid mode.
# Default is false.
pf.hsm.hybrid=false

# Additional allowed security providers for BCFIPS mode.
#
# When operating in BCFIPS mode, PingFederate limits the provider list to the
# minimum required. Additional providers can be allowed by adding their class names
# to the following comma-delimited list.
pf.fips.additional.allowed.providers=

#   Outbound Provisioner Properties
#   ---------------------------
# This property enables or disables Outbound Provisioning. 
# The default is disabled. This property also enables provisioning failover 
# (Separate licensing is required to activate the provisioner.).
#
#   Valid values are:
#     STANDALONE - Turns the provisioner module on, 
#                  standalone mode (no failover).
#     FAILOVER   - Turns the provisioner module on, failover mode.
#     OFF        - Turns the provisioner module off.
# Default is OFF.
# When only one server is in use, set the value to STANDALONE. 
# When more than one server is in use and failover is desired, 
# set the value to FAILOVER for each server.
pf.provisioner.mode=OFF

# In failover mode, each node must have a unique ID. The lower the node ID, the
# higher the priority for that node (only one server can actively handle provisioning
# at one time). If this property is left blank, the cluster node index will be used
# as the provisioner node id.
provisioner.node.id=

# Grace period, in seconds, after which a node is considered dead and failover
# occurs. This value should be larger than the provisioning-frequency cycle.
provisioner.failover.grace.period=600

#   Jetty Customization Properties
#   ---------------------------
# In order to be interoperable with a wide range of external systems PingFederate 
# has been modified to handle special cases related to encoding cookies.
# 
# When setting a cookie, PingFederate will first evaluate 
# 'jetty51.encode.wildcard.session.cookies' and 'jetty51.encode.cookies' to see 
# if the cookie values should be encoded.  If the cookie value should be encoded, 
# PingFederate will then encode the following characters (space included): ;, "
#
# If it's been determined that the cookie shouldn't be encoded, PingFederate will 
# then check for the existence of special characters.  If found, the cookie value 
# will be wrapped in quotes.  The following is a list of characters that would 
# trigger wrapping the value in quotes (space included): \n\r\t\f\b%+ ;="\
#
# If special characters are not detected or the cookie name is defined in 
# 'cookies.skip.quoting' PingFederate will set the cookie value without wrapping 
# or encoding it.  
#
#
# When 'true', PingFederate will encode cookie values for all cookies with names
# that end with "SESSION" (e.g. SMSESSION).
jetty51.encode.wildcard.session.cookies=true

# A comma separated list of cookie names whose values PingFederate will encode
# when the cookie is set.
jetty51.encode.cookies=

# A comma separated list of cookie names whose values should *not* be wrapped
# in quotes when special characters are detected.   
cookies.skip.quoting=_saml_idp

#   SSL Session Cache
#   -----------------
# Sets the size of the SSL session cache used for storing SSLSession objects.  
# 0 means there is no limit.  
javax.net.ssl.sessionCacheSize=5000

#   HTTP Forward Proxy Settings
#   ---------------------------
# Uncomment and set the following Java properties to have outbound HTTP and HTTPS traffic
# sent through a forward proxy. You can also flag additional hosts to bypass the proxy by
# configuring http.nonProxyHosts.
# If proxy authentication is required, specify values for http[s].proxyUser and
# http[s].proxyPassword.
# You should encrypt the http[s].proxyPassword value using the obfuscate.[sh|bat]
# utility. Alternatively, you can specify this property as a secret reference in the form
# OBF:MGR:{secretManagerId}:{secretId}.
# For more information, see the Oracle Java Networking Properties documentation.
#http.proxyHost=<HTTP_PROXY_HOST>
#http.proxyPort=<HTTP_PROXY_PORT>
#http.proxyUser=<HTTP_PROXY_USER>
#http.proxyPassword=<HTTP_PROXY_PASSWORD>
#https.proxyHost=<HTTPS_PROXY_HOST>
#https.proxyPort=<HTTPS_PROXY_PORT>
#https.proxyUser=<HTTPS_PROXY_USER>
#https.proxyPassword=<HTTPS_PROXY_PASSWORD>
#http.nonProxyHosts=*.internal.com|localhost

# You should only use digest authentication with proxy servers. Basic authentication is
# not recommended because the proxy credentials are transmitted to the server without
# encryption. However, if you still want to enable basic authentication for an HTTP target site,
# you can remove 'Basic' from the following line.
jdk.http.auth.proxying.disabledSchemes=Basic

# Basic authentication is not recommended because the proxy credentials are transmitted to the
# server without encryption. However, if you still want to enable basic authentication for an
# HTTPS target site, you can remove 'Basic' from the following line.
jdk.http.auth.tunneling.disabledSchemes=Basic

# This property determines whether PingFederate omits line breaks in XML digital signatures. If omitted, this setting defaults to "false".
# It is recommended to set this as "true" for improved interoperability with Microsoft products.
org.apache.xml.security.ignoreLineBreaks=true

# These properties determine the default timeouts for outbound java.net.URL connections (in milliseconds).
# These values may be overridden in certain contexts.
# When a more specific configuration option is not available, these defaults are used.
sun.net.client.defaultConnectTimeout=30000
sun.net.client.defaultReadTimeout=30000

#   TLS Protocol Settings
#   ---------------------
# The following properties control the allowed TLS client and server protocols.
# Each property may contain a comma-separated list of allowed TLS protocols.
#
# "pf.tls.client.protocols" property is used by all PingFederate outbound HTTPS connections
# "pf.runtime.tls.server.protocols" property is used by PingFederate for all runtime inbound HTTPS connections
# "pf.admin.tls.server.protocols" property is used by PingFederate for all administrative console inbound HTTPS connections
#
# The default value of "TLSv1.2" will be used if any of these properties are not present
pf.tls.client.protocols=TLSv1.2,TLSv1.3
pf.tls.runtime.server.protocols=TLSv1.2,TLSv1.3
pf.tls.admin.server.protocols=TLSv1.2,TLSv1.3

#   HTTP Server Thread Pool Settings
#   --------------------------------
# The following properties control the minimum and the maximum number of threads used to configure PingFederate thread pools.
#
# Please refer to the performance tuning guide for further tuning guidance.
pf.admin.threads.min=1
pf.admin.threads.max=10
pf.runtime.threads.min=10
pf.runtime.threads.max=200

#   HTTP Connector Queue Size Settings
#   ----------------------------------
# The following properties control the queue size of the HTTP connector.
#
# Please refer to the performance tuning guide for further tuning guidance.
pf.admin.acceptQueueSize=512
pf.runtime.acceptQueueSize=512

#
# HTTP Server Request Handling Settings
# -------------------------------------
#
# buffer size for output
pf.admin.output.buffer.size=32768
pf.runtime.output.buffer.size=32768

# request header buffer size
pf.admin.request.header.size=16384
pf.runtime.request.header.size=16384
# response header buffer size
pf.admin.response.header.size=16384
pf.runtime.response.header.size=16384

# Enable delayed dispatch optimisation
pf.admin.delayDispatchUntilContent=false
pf.runtime.delayDispatchUntilContent=false

# HTTP idle timeout in milliseconds
pf.admin.http.idleTimeout=30000
pf.runtime.http.idleTimeout=30000

# Parameters to control the number and priority of acceptors and selectors
pf.admin.ssl.selectors=1
pf.admin.ssl.acceptors=0
pf.runtime.ssl.selectors=1
pf.runtime.ssl.acceptors=0
pf.runtime.http.selectors=1
pf.runtime.http.acceptors=0
# pf.admin.ssl.acceptorPriorityDelta=0
# pf.runtime.ssl.acceptorPriorityDelta=0
# pf.runtime.http.acceptorPriorityDelta=0

# Parameter to select HTTP compliance modes for Jetty HTTP parsing and handling
# pf.admin.http.compliance=RFC7230_LEGACY
# pf.runtime.http.compliance=RFC7230_LEGACY

# HTTP Server Runtime Request Log Settings
# --------------------------------
# The following property controls the Engine listener's HTTP runtime request log format.
# The following attributes can be added to correlate the request log entries with other log files:
# %{trackingid}attr, %{transactionid}attr, %{httprequestid}attr
jetty.runtime.requestlog.format=%{client}a - %u "%r" %s %O

# HTTP Server Admin Request Log Settings
# --------------------------------
# The following property controls the Engine listener's HTTP admin request log format.
jetty.admin.requestlog.format=%{client}a - %u "%r" %s %O

# This property can include a comma-separated list of paths to exclude. Each path must begin with a "/".
# Example: /pf/heartbeat.ping, /*, /pf/*
jetty.runtime.requestlog.ignorePaths=

# Perform data upgrade on startup
# -------------------------------
# This property controls whether PingFederate will perform a data upgrade on startup.
# The default property value is true.
# The data upgrade will be enabled if the property is not present.
pf.data.upgrade.on.startup=true