Security configuration parameters

Field / Property	Type	Description
user.admin	String	Sets the default superuser ID. By default the superuser ID is okmAdmin. okmAdmin
user.assign.document.creation	Boolean	By default, when a user creates a node, they are added to the node with full permissions. You can disable this behavior by setting this parameter to false. By default, the parameter is set to true. true
user.password.expiration	Integer	Indicates the number of days to force users to change their password. A value of 0 indicates the feature is disabled. 0
user.password.reset	Boolean	Sometimes the user loses or forgets their password. When this option is enabled, users on the landing page have the option to reset their password and be notified of a new one by email. By default, this option is set to false. false
system.antivir	String	Path to the antivirus. An antivirus can decrease performance, taking several seconds to analyze each document and consuming a lot of CPU resources.
security.access.manager	String	Sets the security access manager that determines how security is evaluated. The default value is “simple”. Values: - simple. - recursive. - read_recursive. simple Take a look at Security configuration
security.search.evaluation	String	Sets the security search manager and determines how security is evaluated by the search engine. Values: - lucene. - am_more, am_window, or am_limited. Take a look at Security configuration
security.extended.mask	Integer	Security evaluation can be extended to downloaded files, starting workflows, adding, removing, or modifying property groups (metadata), or compacting history. The default value is empty. Values: - DOWNLOAD = 1024; - START_WORKFLOW = 2048; - COMPACT_HISTORY = 4096; - PROPERTY_GROUP = 8192; For example, to enable download and property groups, set the mask to 9216 (1024+8192). 9216 Take a look at Security configuration
security.live.change.node.limit	Integer	When security changes affect more than the value set in this property, the security changes are applied as a background task. 100 Take a look at Security configuration
system.login.lowercase	Boolean	By default it is empty. If connecting to AD (Microsoft Active Directory), it must be set to “true”, which forces all users to log in with lowercase user IDs. The reason is OpenKM is case-sensitive and Microsoft Active Directory is not.
principal.adapter	String	You must restart the OpenKM service after you change this parameter. OpenKM can handle user access using the Spring Security framework. OpenKM needs an available method for reading users and roles, so when users are stored in a database (as is the default), the class DatabasePrincipalAdapter does this job. com.openkm.plugin.principal.DatabasePrincipalAdapter If you configure OpenKM to authenticate against an LDAP server, you need to configure another principal adapter like LdapPrincipalAdapter. More information at: - LDAP configuration. - Creating your own login module.
principal.identifier.validation	String	Sets a regular expression to validate user names and role names on creation. ^[a-zA-Z0-9_]+$ Sample regular expression for Arabic: ^[\u0600-\u06FF]+$ This parameter can only be used in combination with the “principal.adapter” parameter value “com.openkm.plugin.principal.DatabasePrincipalAdapter”.
browser.password.autocompletion	Boolean	By default, it is true (autocompletion allowed). This parameter allows disabling password autocompletion in the login frame. This is a security measure on untrusted clients.
default.security.recursive.role	String	Sets the role that is used to identify which users are able to set recursive security. ROLE_SECURITY_RECURSIVE
secure.file.delete	Boolean	Enables safe file deletion from the file system. The process ensures the document can be recovered later from the file system. false
security.login.failed.attempts	Integer	Number of failed login attempts before the user is locked. A value of 0 indicates unlimited failed attempts and the user will never be locked. 0
default.task.manager.admin.role	String	Sets the role that is used to identify which users can manage all OpenKM tasks. ROLE_TASK_MANAGER_ADMIN
default.version.admin.role	String	Sets the role that is used to identify users who can change the version of a node. ROLE_VERSION_ADMIN
default.user.hidden.role	String	Sets the role that is used to identify users who are hidden in the user list. ROLE_USER_HIDDEN
repository.content.encryption	Boolean	Encrypts document content and extracted text at rest (AES-256-GCM), transparent to the application — it protects against an attacker who gains access to the storage medium (filesystem or S3) directly. A single key is used for all content. Content already on disk when this is enabled stays readable as plaintext; only content written from that point on is encrypted, so a mix of encrypted and plaintext content is normal and handled transparently. Requires a restart to take effect. Note: cached preview renditions (e.g. PDF previews of Office files) are not covered yet. false
repository.content.encryption.key	String (Hidden)	Base64-encoded 256-bit key used by repository.content.encryption. If left unset, OpenKM generates one automatically the first time the application starts and stores it internally — this is enough for most installations. To set it explicitly instead (for example, to control key management yourself), add it to openkm.properties encrypted with Jasypt ENC(…), the same way as jwt.secret.key. Losing this key makes all encrypted content permanently unreadable — back it up together with the database.