Credential Provider (CP) configuration files

The name of the Safe where the main configuration file is stored.

Default value: AppProviderConf

The name of the folder in the configuration Safe where the main configuration file is stored.

Default value: Root

The name of the main configuration file.

Default value: main_appprovider.conf. <platform>.<version>

The full pathname of the Vault.ini file. For more information about this file’s location, see:

• Windows: The Windows environment on the Credential Provider machine.

• Linux/AIX: The UNIX environment on the Credential Provider machine.

Default value: Default location of the installation

The full pathname of the CP’s credential file used to access the Vault.

Default value: Default location of the installation

Enables FIPS-complaint cryptography in the CP.

Default value: No

The name of the Safe where the PAM configuration files are stored.

dsf

Default value: PVWAConfig

The folder in the PAM configuration Safe where the PAM configuration files are stored.

Default value: Root

The name of the PAM configuration file.

Default value: PVConfiguration.xml

The name of the platform configuration file.

Default value: Policies.xml

The folder where the CP log files will be stored.

Default value: Default location of the installation

The path of the temporary files folder.

Default value: Default location of the installation

The folder where the configuration file backed up.

Default value: Default location of the installation

The folder where the general caches’ persistent files will reside.

Acceptable value: A folder path

Default value: --

The number of seconds that the CP will wait until its next attempt to update offline operations in the Vault.

Type: Numeric

Default value: 1800

The maximum number of retries that will be performed to update an offline operation in the Vault.

Type: Numeric

Default value: 600

The number of threads in the CP that will handle Credential Provider password requests.

Acceptable value: Numeric

Default value: 40

The number of days that log files will be saved in the CP’s Logs folder. A value of ‘-1’ indicates that log files will not be deleted.

Type: Numeric

Default: 30

The number of days that log files will be saved in the \Old subfolder of the CP’s Logs folder. A value of ‘-1’ indicates that log files will not be deleted.

Type: Numeric

Default value: 90

Whether or not authentication warning and info logs show in AppConsole.log and the Windows Event Viewer.

Acceptable value: Yes/No

Default value: Yes

The number of minutes after which the authentication security standard is checked. The default is every 24 hours.

Acceptable value: 0-10080. A value of 0 indicates continuous checks. A value of 10080 indicates a once per week check.

Default value: 1440 (24 hours)

The frequency (in seconds) that the CP will refresh the main configuration file stored on the CP machine from the file in the Vault.

Type: Numeric

Default value: 3600

The frequency (in seconds) that the CP takes to refresh the connection to the Vault and log in again. After logging in, the user's password is changed in the Vault and updated in its credential file."appprovideruser.cred".

This process runs as part of the AutomaticParmsRefresh background job and therefore the frequency of this process depends on the AutomaticParmsRefreshInterval's value as well.

The default is every 24 hours

Type: Numeric

Default value: 86400 (24 hours)

The size in MB of log files when it will be moved to the ‘Old’ folder. A new log file will be started in its place.

Type: Numeric

Default value: 25

The number of minutes after which a log file will be moved to the ‘Old’ folder.

Type: Numeric

Default value: 0

The number of seconds that the CP will wait to terminate pending requests when shutting down.

Type: Numeric

Default value: 180

Whether exceptions will be handled by the operating system during a system crash or an error will be written to the CP log but the error will not be handled.

Acceptable value: Yes/No

Default value: Yes

Enables CPs to use a user provided hostname/IP, instead of relying on the NIC. This is useful when there is a large number of NICs on the server, and will significantly shorten the time it takes the CP to start.

Specify a list of one or more hostnames or IP addresses separated by a comma.

Recommended: Add this parameter to a Provider specific configuration file.

Acceptable value: One or more IP addresses, separated by a comma

Default value: --

Whether or not verbose error logs will be shown in responses and the Windows Event Viewer.

Acceptable value: Yes/No

Default value: No

The level of Provider debug. You can set several values, separated by commas.

Acceptable values: 0,1,2,3,4,5

Default value: 0

The level of cache debug. You can set several values, separated by commas.

Acceptable values: 0,1,2

Default value: 0

The frequency (in seconds) that the CP cache is refreshed by the background process.

Best practice:

This value has an impact on the ChangeNotificationPeriod parameter value defined in the Central Policy Manager, and on the LocalCacheLifespan parameter value defined in Application Server Credential Provider.

We recommend using the following values for these parameters:

• CacheRefreshInterval= 1500 seconds

• ChangeNotificationPeriod = 3001 seconds (calculated from (CacheRefreshInterval* 2) + 1). That is, there will be at least 2 refresh cycles before the password is released.

• LocalCacheLifeSpan = ((CacheRefreshInterval/ 2) - 1) = 749 seconds, that is, the Application Server Credential Provider 2nd-level cache will refresh twice as frequently as the Credential Provider cache.

That being said, you should configure these values based on your organization's needs.

For example:

• If your organization requires a shorter time for the immediate password change to occur, then lower the CacheRefreshInterval value.

  • CacheRefreshInterval= 180 seconds
  • ChangeNotificationPeriod = (CacheRefreshInterval*2) + 1 = 361 seconds.
  • LocalCacheLifeSpan = ((CacheRefreshInterval/ 2) - 1) = 89 seconds

• If your organization wants more certainty that the cache refresh succeeded and that at least 3 cycles of refresh cache occur before the password changes, you could define following configuration:

  • CacheRefreshInterval= 1500 seconds
  • ChangeNotificationPeriod = (CacheRefreshInterval*3) + 1 = 4501 seconds.
  • LocalCacheLifeSpan = ((CacheRefreshInterval/ 2) - 1) = 749 seconds

Type: Numeric

Default value: 1500

The time (in seconds) after the most recent retrieval of a password in cache from the Vault until it expires.

A password that expires is updated by the Credential Provider.

Specify -1 to ensure that passwords in the cache never expire.

Type: Numeric

Default value: 31536000 (1 year)

The type of cache level that will be implemented on the CP.

Acceptable values: None, Memory, Persistent

Default value: Persistent

(For CacheLevel=Persistent)

Where the cache file encryption key is stored.

If set to Vault, the key is stored in the Vault in a dedicated Safe. This mode requires a more stable connection to the Vault. For more information, see Persistent cache level.

Acceptable values: Local, Vault

Default value: Local

The port number that the CP uses to listen for application requests from Password SDKs.

Acceptable values: 1-65536

Default value: 18923