Settings Reference¶
Every setting in config/settings.defaults.php as of Poweradmin 4.6.0, with its
shipped default. This page is generated from the source file, so it is complete by
construction - but it is an index, not an explanation. The pages under Configuration
describe what these settings actually do and when to change them.
Override any of them in config/settings.php; see Basic Configuration.
api¶
| Setting | Default | Description | Added in |
|---|---|---|---|
api.enabled |
false |
Enable API functionality (including API keys) | - |
api.basic_auth_enabled |
false |
Enable HTTP Basic Authentication for public API endpoints | - |
api.basic_auth_realm |
'Poweradmin API' |
Realm name for HTTP Basic Authentication | - |
api.docs_enabled |
false |
Enable API documentation at /api/docs endpoint | - |
api.max_keys_per_user |
5 |
Maximum number of API keys per user (admin users have no limit) | - |
approval¶
| Setting | Default | Description | Added in |
|---|---|---|---|
approval.enabled |
false |
Route changes of request-only users through review | 4.6.0 |
approval.require_review_for_all |
false |
Every zone change becomes a request, even for editors and admins | 4.6.0 |
approval.allow_self_approval |
true |
False: a requester cannot approve their own change request | 4.6.0 |
database¶
| Setting | Default | Description | Added in |
|---|---|---|---|
database.host |
'localhost' |
- | - |
database.port |
'' |
- | - |
database.user |
'poweradmin' |
- | - |
database.password |
'your_password' |
AVOID: quotes, backslashes, line breaks | - |
database.name |
'powerdns' |
- | - |
database.type |
'mysql' |
Options: 'mysql', 'pgsql', 'sqlite' (mysqli added in 2.1.5, sqlite in 2.1.6) | - |
database.charset |
'latin1' |
or 'utf8' | 2.1.8 |
database.file |
'' |
Only used for SQLite, provide full path to database file | 2.1.6 |
database.debug |
false |
Show all SQL queries | 2.1.6 |
database.pdns_db_name |
'' |
Separate database for PowerDNS, MySQL/MariaDB only | 3.8.0 |
database.ssl |
false |
Enable SSL/TLS connection | - |
database.ssl_verify |
false |
Verify server SSL certificate (requires ssl=true) | - |
database.ssl_ca |
'' |
Path to CA certificate file for server verification | - |
database.ssl_key |
'' |
Path to client private key file (for client certificate auth) | - |
database.ssl_cert |
'' |
Path to client certificate file (for client certificate auth) | - |
dns¶
| Setting | Default | Description | Added in |
|---|---|---|---|
dns.backend |
'sql' |
DNS data backend: 'sql' (default, direct database) or 'api' (PowerDNS REST API) | 4.3.0 |
dns.hostmaster |
'hostmaster.example.com' |
Default hostmaster email address | - |
dns.ns1 |
'ns1.example.com' |
- | - |
dns.ns2 |
'ns2.example.com' |
- | - |
dns.ns3 |
'' |
- | - |
dns.ns4 |
'' |
- | - |
dns.ttl |
86400 |
Default TTL for new records (86400 = 24 hours) | - |
dns.ttl_reverse |
null |
Default TTL for PTR records in reverse zones; null falls back to dns.ttl | 4.4.0 |
dns.soa_refresh |
28800 |
8 hours | - |
dns.soa_retry |
7200 |
2 hours | - |
dns.soa_expire |
604800 |
1 week | - |
dns.soa_minimum |
86400 |
24 hours (SOA settings added in 2.2.3) | - |
dns.soa_edit |
'' |
SOA-EDIT metadata for new zones, e.g. 'INCEPTION-INCREMENT'; empty = not set | 4.5.0 |
dns.soa_edit_api |
'' |
SOA-EDIT-API metadata for new zones, e.g. 'EPOCH'; 'OFF' disables, empty = server default | 4.5.0 |
dns.soa_edit_api_options |
null |
SOA-EDIT-API values offered in the add-zone selector and metadata editor; null = all, [] hides them | 4.5.0 |
dns.soa_edit_options |
null |
SOA-EDIT values offered in the metadata editor; null = all, [] hides the kind | 4.5.0 |
dns.zone_type_default |
'MASTER' |
Options: 'MASTER', 'NATIVE' | 2.1.9 |
dns.default_zone_template |
null |
Pre-selected template on the add-zone form. Template id (int) or name (string); null for "none" | 4.4.0 |
dns.zone_ownership_mode |
'both' |
Options: 'both', 'users_only', 'groups_only' | 4.4.0 |
dns.default_max_zones_per_user |
null |
How many zones a user may own directly when the user has no own limit; null = unlimited, 0 = none. Superusers are never limited | 4.6.0 |
dns.default_max_zones_per_group |
null |
How many zones a group may own when the group has no own limit; null = unlimited, 0 = none | 4.6.0 |
dns.sync_zone_owner_to_account |
false |
Mirror the oldest zone owner's username into the PowerDNS account field on ownership changes | 4.4.0 |
dns.adopt_zone_owner_from_account |
false |
Ownerless zones (e.g. from an autoprimary) go to the user their PowerDNS account names: API-mode zone sync, or the consistency repair | 4.6.0 |
dns.strict_tld_check |
false |
Strict validation of TLDs | - |
dns.top_level_tld_check |
false |
Prevent creation of top-level domains | 2.1.7 |
dns.third_level_check |
false |
Prevent creation of third-level domains | 2.1.7 |
dns.parent_zone_ownership_check |
true |
Block creating a zone that overlaps an existing zone (forward or reverse) owned by another user | 4.5.0 |
dns.txt_auto_quote |
false |
Automatically quote TXT records | 3.9.2 |
dns.prevent_duplicate_ptr |
true |
Prevent creation of multiple PTR records for same IP in batch operations | 4.0.0 |
dns.bump_serial_on_unchanged_save |
true |
false = leave the SOA serial alone when a save changes no record; true keeps save-to-NOTIFY | 4.6.0 |
dns.custom_tlds |
[] |
Whitelist of non-IANA TLDs allowed in hostnames and CNAME targets when strict_tld_check is on (e.g., ['lan', 'corp', 'dn42']) | - |
dns.domain_record_types |
null |
Uses default domain zone record types | - |
dns.reverse_record_types |
null |
Uses default reverse zone record types | - |
dns.top_record_types |
null |
null = alphabetical only | - |
dnssec¶
| Setting | Default | Description | Added in |
|---|---|---|---|
dnssec.enabled |
false |
Enable DNSSEC functionality | 2.1.7 |
health¶
| Setting | Default | Description | Added in |
|---|---|---|---|
health.enabled |
false |
Enable unauthenticated health endpoint at /api/health | 4.5.0 |
health.ping_enabled |
false |
Enable unauthenticated liveness endpoint at /ping | 4.5.0 |
health.db_timeout |
2 |
Database connect timeout in seconds used by the health check | 4.5.0 |
health.pdns_timeout |
2 |
PowerDNS API timeout in seconds used by the health check | 4.5.0 |
interface¶
| Setting | Default | Description | Added in |
|---|---|---|---|
interface.language |
'en_EN' |
Default language for the interface | - |
interface.enabled_languages |
'ar_SA,bg_BG,bs_BA,cs_CZ,da_DK,de_DE,el_GR,en_EN,es_ES,et_EE,fa_IR,fi_FI,fr_FR,ga_IE,he_IL,hi_IN,hr_HR,hu_HU,id_ID,it_IT,ja_JP,ko_KR,lt_LT,lv_LV,ms_MY,nb_NO,nl_NL,pl_PL,pt_BR,pt_PT,ro_RO,ru_RU,sk_SK,sl_SI,sq_AL,sr_RS,sv_SE,th_TH,tr_TR,uk_UA,vi_VN,zh_CN,zh_TW' |
Added in 3.8.0 | - |
interface.title |
'Poweradmin' |
Application title (browser tab and header logo). Useful for distinguishing multiple server instances | 2.1.5 |
interface.session_timeout |
1800 |
Session timeout in seconds (30 minutes); must be above 0, the timeout cannot be disabled | - |
interface.rows_per_page |
10 |
- | - |
interface.theme |
'default' |
Theme name to use (default, custom, etc.) | 4.0.0 |
interface.style |
'light' |
UI Style options: 'light', 'dark' | 4.0.0 |
interface.theme_base_path |
'templates' |
Base path for theme templates | 4.0.0 |
interface.favicon_path |
'' |
Custom favicon path or URL; empty uses the bundled favicon.ico | 4.4.0 |
interface.logo_path |
'' |
Custom header logo path or URL; empty uses the bundled assets/logo.png | 4.4.0 |
interface.base_url_prefix |
'' |
Base URL prefix for deployments (default: '', subdirectory example: '/poweradmin') | 4.1.0 |
interface.application_url |
'' |
Full application URL for emails and absolute links - required for password reset, OIDC and SAML (example: 'https://dns.example.com/poweradmin') | 4.1.0 |
interface.web_enabled |
true |
Serve the web interface; false runs API-only (headless) | 4.5.0 |
interface.show_record_id |
false |
Show record ID column in edit mode | 3.9.0 |
interface.show_add_record_form |
false |
Show or hide add record form | 4.1.0 |
interface.show_record_edit_button |
false |
Show individual edit button per record | 4.1.0 |
interface.show_record_delete_button |
false |
Show individual delete button per record | 4.1.0 |
interface.position_record_form_top |
true |
Position the "Add record" form at the top of the page | 3.9.0 |
interface.position_save_button_top |
false |
Position the "Save changes" button at the top of the page | 3.9.0 |
interface.show_zone_comments |
true |
Show or hide zone comments | 2.2.3 |
interface.show_record_comments |
false |
Show or hide record comments | 3.9.0 |
interface.display_serial_in_zone_list |
false |
- | - |
interface.display_signed_serial_in_zone_list |
false |
Show serial served by PowerDNS (SOA-EDIT applied); requires API backend | 4.5.0 |
interface.display_template_in_zone_list |
false |
- | - |
interface.display_owner_in_zone_list |
true |
Show owner column in zone lists | 4.5.0 |
interface.display_group_in_zone_list |
true |
Show group column in zone lists | 4.5.0 |
interface.show_zone_record_count |
true |
Show record count column in zone lists | 4.5.0 |
interface.show_zone_limit_column |
false |
Show owned zones and zone limit in the users and groups lists | 4.6.0 |
interface.display_fullname_in_zone_list |
false |
Show user's full name instead of username in zone lists | 4.0.0 |
interface.search_group_records |
false |
Group records by name and content in search results | 3.8.0 |
interface.reverse_zone_sort |
'natural' |
Reverse zone sorting algorithm: 'natural' (default) or 'hierarchical' (experimental) | 4.0.0 |
interface.show_pdns_status |
false |
Show PowerDNS server status page and dashboard card | 4.0.0 |
interface.show_dashboard_stats |
true |
Show zone, record, user, and group counts on dashboard | 4.3.0 |
interface.show_forward_zone_associations |
true |
Show associated forward zones in reverse zone list | 4.0.5 |
interface.wide_layout |
false |
Use full browser width instead of a fixed-width page | 4.5.0 |
interface.add_reverse_record |
true |
Enable checkbox to add PTR record from regular zone view | 2.1.7 |
interface.add_domain_record |
true |
Enable checkbox to add A/AAAA record from reverse zone view | - |
interface.display_hostname_only |
false |
Display only hostname part in zone edit form (strips zone suffix) | 4.0.0 |
interface.enable_consistency_checks |
false |
Enable database consistency checks page | 4.0.0 |
interface.avatar_oauth_enabled |
false |
Enable OAuth provider avatar images (default: false) | - |
interface.avatar_gravatar_enabled |
false |
Enable Gravatar integration (default: false) | - |
interface.avatar_priority |
'oauth' |
Avatar priority when both enabled: 'oauth' or 'gravatar' | - |
interface.avatar_size |
40 |
Default avatar size in pixels | - |
ldap¶
| Setting | Default | Description | Added in |
|---|---|---|---|
ldap.enabled |
false |
Enable LDAP authentication | 2.1.7 |
ldap.debug |
false |
Enable LDAP debug logging | 2.1.7 |
ldap.uri |
'ldap://domaincontroller.example.com' |
LDAP server URI | 2.1.7 |
ldap.base_dn |
'ou=users,dc=example,dc=com' |
Base DN where users are stored | 2.1.7 |
ldap.bind_dn |
'cn=admin,dc=example,dc=com' |
Bind DN for LDAP authentication | 2.1.7 |
ldap.bind_password |
'some_password' |
AVOID: quotes, backslashes, line breaks | - |
ldap.user_attribute |
'uid' |
User attribute (uid for OpenLDAP, sAMAccountName for Active Directory) | 2.1.7 |
ldap.protocol_version |
3 |
LDAP protocol version | 2.1.7 |
ldap.search_filter |
'' |
Additional search filter | 2.1.7 |
ldap.sync_user_info |
false |
Sync fullname/email from LDAP on every login | 4.5.0 |
ldap.fullname_attribute |
'displayName' |
LDAP attribute for full name (displayName for AD, cn for OpenLDAP) | 4.5.0 |
ldap.email_attribute |
'mail' |
LDAP attribute for email address | 4.5.0 |
ldap.auto_provision |
false |
Create missing users on first successful LDAP login | 4.5.0 |
ldap.allow_superuser_provisioning |
false |
Let LDAP mappings grant user_is_ueberuser | 4.5.0 |
ldap.default_permission_template |
'Guest' |
Template for auto-provisioned users when no mapping matches | 4.5.0 |
ldap.groups_attribute |
'memberOf' |
LDAP attribute holding group memberships | 4.5.0 |
ldap.permission_template_mapping |
[] |
- | - |
ldap.group_mapping |
[] |
- | - |
ldap.session_cache_timeout |
300 |
Session cache timeout in seconds (5 minutes). Set to 0 to disable caching | 4.1.0 |
logging¶
| Setting | Default | Description | Added in |
|---|---|---|---|
logging.type |
'null' |
Options: 'null' (disabled), 'native' (PHP error_log) | 3.9.0 |
logging.level |
'info' |
Options: 'debug', 'info', 'notice', 'warning', 'error', 'critical', 'alert', 'emergency' | 3.9.0 |
logging.database_enabled |
false |
Write audit events to database log tables (log_users, log_zones, log_groups, log_record_changes) | 3.2.0 |
logging.require_change_comment |
false |
Require a reason for bulk record changes and change requests | 4.5.0 |
logging.api_request_logging |
false |
Log every public API request; permission violations (401/403) are logged regardless | 4.5.0 |
logging.api_log_retention_days |
0 |
Days to keep API log rows; 0 = keep forever | 4.5.0 |
logging.syslog_enabled |
false |
Write audit events to syslog | 2.1.6 |
logging.syslog_identity |
'poweradmin' |
Syslog identity | 2.1.6 |
logging.syslog_facility |
LOG_USER |
Syslog facility | 2.1.6 |
mail¶
| Setting | Default | Description | Added in |
|---|---|---|---|
mail.enabled |
true |
Enable email functionality | - |
mail.from |
'poweradmin@example.com' |
Default "from" address | - |
mail.from_name |
'' |
Default "from" name | - |
mail.return_path |
'poweradmin@example.com' |
Default "Return-Path" address | - |
mail.transport |
'php' |
Transport method: smtp, sendmail, php, or logger | - |
mail.host |
'smtp.example.com' |
SMTP server hostname | - |
mail.port |
587 |
SMTP server port | - |
mail.username |
'' |
SMTP authentication username | - |
mail.password |
'' |
SMTP password - AVOID: quotes, backslashes, line breaks | - |
mail.encryption |
'tls' |
Options: 'tls', 'ssl', '' | - |
mail.auth |
false |
Whether SMTP requires authentication | - |
mail.sendmail_path |
'/usr/sbin/sendmail -t -i' |
Sendmail binary; -t reads recipients from headers (-bs is SMTP mode and drops piped messages) | - |
misc¶
| Setting | Default | Description | Added in |
|---|---|---|---|
misc.display_stats |
false |
Display memory usage and execution time | - |
misc.timezone |
'UTC' |
Default timezone (e.g. 'Europe/Berlin', 'Asia/Shanghai') | - |
misc.record_comments_sync |
false |
Enable bidirectional comment sync between A and PTR records | 3.9.0 |
misc.edit_conflict_resolution |
'last_writer_wins' |
Options: 'last_writer_wins', 'only_latest_version' | - |
misc.display_errors |
false |
Display PHP errors (false for production) | 4.0.0 |
misc.show_generated_passwords |
true |
Show generated passwords on user creation | 4.0.0 |
misc.template_cache |
false |
Cache compiled templates on disk for faster rendering | 4.5.0 |
misc.template_cache_path |
'' |
Compiled template directory; empty means var/cache/twig | 4.5.0 |
modules¶
| Setting | Default | Description | Added in |
|---|---|---|---|
modules.csv_export.enabled |
true |
- | - |
modules.zone_import_export.enabled |
false |
- | - |
modules.zone_import_export.auto_ttl_value |
300 |
- | - |
modules.zone_import_export.max_file_size |
1048576 |
- | - |
modules.whois.enabled |
false |
- | - |
modules.whois.default_server |
'' |
- | - |
modules.whois.custom_servers |
[] |
- | - |
modules.whois.socket_timeout |
10 |
- | - |
modules.whois.restrict_to_admin |
true |
- | - |
modules.rdap.enabled |
false |
- | - |
modules.rdap.default_server |
'' |
- | - |
modules.rdap.custom_servers |
[] |
- | - |
modules.rdap.request_timeout |
10 |
- | - |
modules.rdap.restrict_to_admin |
true |
- | - |
modules.email_previews.enabled |
false |
- | - |
modules.email_previews.restrict_to_admin |
true |
- | - |
modules.dns_wizards.enabled |
false |
- | - |
modules.dns_wizards.available_types |
['DMARC', 'SPF', 'DKIM', 'CAA', 'TLSA', 'SRV'] |
- | - |
modules.dns_wizards.caa_providers.letsencrypt.org |
"Let's Encrypt" |
- | - |
modules.dns_wizards.caa_providers.digicert.com |
'DigiCert' |
- | - |
modules.dns_wizards.caa_providers.sectigo.com |
'Sectigo (Comodo)' |
- | - |
modules.dns_wizards.caa_providers.comodoca.com |
'Sectigo (legacy domain)' |
- | - |
modules.dns_wizards.caa_providers.awstrust.com |
'Amazon Trust Services' |
- | - |
modules.dns_wizards.caa_providers.amazontrust.com |
'Amazon Trust Services (alt)' |
- | - |
modules.dns_wizards.caa_providers.amazonaws.com |
'AWS Certificate Manager' |
- | - |
modules.dns_wizards.caa_providers.pki.goog |
'Google Trust Services' |
- | - |
modules.dns_wizards.caa_providers.cloudflare.com |
'Cloudflare' |
- | - |
modules.dns_wizards.caa_providers.godaddy.com |
'GoDaddy' |
- | - |
modules.dns_wizards.caa_providers.globalsign.com |
'GlobalSign' |
- | - |
modules.dns_wizards.caa_providers.entrust.com |
'Entrust' |
- | - |
modules.dns_wizards.caa_providers.entrust.net |
'Entrust (legacy)' |
- | - |
modules.dns_wizards.caa_providers.ssl.com |
'SSL.com' |
- | - |
modules.dns_wizards.caa_providers.buypass.com |
'Buypass' |
- | - |
modules.dns_wizards.caa_providers.usertrust.com |
'USERTrust (Sectigo)' |
- | - |
modules.dns_wizards.caa_providers.; |
'Disallow all CAs (no issuance permitted)' |
- | - |
modules.secondary_zone_import.enabled |
false |
Import a zone from a live primary over AXFR (API backend only) | - |
notifications¶
| Setting | Default | Description | Added in |
|---|---|---|---|
notifications.zone_access_enabled |
false |
Enable/disable zone access change notifications | - |
notifications.change_request_enabled |
false |
Mail reviewers on new change requests and requesters on decisions | 4.6.0 |
notifications.change_request_soa_contact |
false |
Also mail the zone's SOA contact about new change requests | 4.6.0 |
oidc¶
| Setting | Default | Description | Added in |
|---|---|---|---|
oidc.enabled |
false |
Enable OIDC authentication | - |
oidc.auto_provision |
true |
Automatically create user accounts from OIDC | - |
oidc.link_by_email |
true |
Link OIDC accounts to existing users by email | - |
oidc.require_verified_email |
false |
Only link by email when the provider sends email_verified | 4.5.0 |
oidc.allow_superuser_provisioning |
false |
Let OIDC mappings grant user_is_ueberuser | 4.5.0 |
oidc.sync_user_info |
true |
Sync user information (name, email) from OIDC provider | - |
oidc.default_permission_template |
'Guest' |
Default permission template for new OIDC users (minimal access until assigned proper role) | - |
oidc.permission_template_mapping |
[] |
- | - |
oidc.group_mapping |
[] |
- | - |
oidc.providers |
[] |
- | - |
pdns_api¶
| Setting | Default | Description | Added in |
|---|---|---|---|
pdns_api.display_name |
'PowerDNS' |
PowerDNS name to identify server | - |
pdns_api.url |
'' |
PowerDNS API URL, e.g., 'http://127.0.0.1:8081' | 3.7.0 |
pdns_api.key |
'' |
PowerDNS API key | 3.7.0 |
pdns_api.server_name |
'localhost' |
PowerDNS server name used in API calls | 4.0.0 |
pdns_api.timeout |
10 |
PowerDNS API request timeout in seconds | 4.4.0 |
pdns_api.webserver_username |
'' |
PowerDNS webserver Basic Auth username (usually '#') | 4.0.3 |
pdns_api.webserver_password |
'' |
PowerDNS webserver Basic Auth password (for /metrics endpoint) | 4.0.3 |
permissions¶
| Setting | Default | Description | Added in |
|---|---|---|---|
permissions.show_user_access_templates |
true |
Show per-user permission template assignment | 4.3.0 |
permissions.show_group_access_templates |
true |
Show group-based permission template management | 4.3.0 |
remote_user¶
| Setting | Default | Description | Added in |
|---|---|---|---|
remote_user.enabled |
false |
Sign users in from the web server's authenticated user | 4.6.0 |
remote_user.server_variable |
'REMOTE_USER' |
Server variable the web server sets to the user name (client-settable HTTP_ and PHP_AUTH_ names are refused) | 4.6.0 |
remote_user.header |
'' |
Read the user from this proxy header instead (e.g. 'Remote-User'), which the proxy must overwrite, not append to; empty = use server_variable | 4.6.0 |
remote_user.trusted_proxies |
[] |
Proxy IPs/CIDRs allowed to send 'header', as PHP sees them (::ffff:10.0.0.5 is not 10.0.0.5); empty = header ignored | 4.6.0 |
remote_user.strip_realm |
false |
Turn user@REALM and DOMAIN\user into user (one realm only: alice@A and alice@B become the same account) | 4.6.0 |
remote_user.email_attribute |
'' |
Variable (or header, in header mode) holding the email address, e.g. 'Remote-Email' | 4.6.0 |
remote_user.name_attribute |
'' |
Variable (or header) holding the full name, e.g. 'Remote-Name' | 4.6.0 |
remote_user.groups_attribute |
'' |
Variable (or header) holding the groups, e.g. 'Remote-Groups' | 4.6.0 |
remote_user.groups_separator |
',' |
Separator between groups in groups_attribute | 4.6.0 |
remote_user.logout_url |
'' |
Where to send users after logout to end the web server's own session; empty = Poweradmin login page | 4.6.0 |
remote_user.hide_login_form |
false |
Hide the password form while the web server signs someone in (posted passwords still work) | 4.6.0 |
remote_user.auto_provision |
true |
Create an account on first sign-in | 4.6.0 |
remote_user.allow_superuser_provisioning |
false |
Let mappings grant user_is_ueberuser | 4.6.0 |
remote_user.sync_user_info |
true |
Update name and email from the attributes on each sign-in | 4.6.0 |
remote_user.default_permission_template |
'Guest' |
Permission template for new accounts (no permissions until an admin assigns a role) | 4.6.0 |
remote_user.permission_template_mapping |
[] |
Group => permission template name, as for 'saml' | 4.6.0 |
remote_user.group_mapping |
[] |
Group => Poweradmin group name or list of names, as for 'saml' | 4.6.0 |
saml¶
| Setting | Default | Description | Added in |
|---|---|---|---|
saml.enabled |
false |
Enable SAML authentication | - |
saml.auto_provision |
true |
Automatically create user accounts from SAML | - |
saml.link_by_email |
true |
Link SAML accounts to existing users by email | - |
saml.allow_superuser_provisioning |
false |
Let SAML mappings grant user_is_ueberuser | 4.5.0 |
saml.sync_user_info |
true |
Sync user information (name, email) from SAML provider | - |
saml.default_permission_template |
'Guest' |
Default permission template for new SAML users (minimal access until assigned proper role) | - |
saml.permission_template_mapping |
[] |
- | - |
saml.group_mapping |
[] |
- | - |
saml.sp.entity_id |
'' |
SP Entity ID (usually your PowerAdmin URL) | - |
saml.sp.assertion_consumer_service_url |
'' |
ACS URL (leave empty for auto-generation) | - |
saml.sp.single_logout_service_url |
'' |
SLO URL (leave empty for auto-generation) | - |
saml.sp.name_id_format |
'urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress' |
- | - |
saml.sp.x509cert |
'' |
SP X.509 Certificate (optional, for signing requests) | - |
saml.sp.private_key |
'' |
SP Private Key (optional, for signing requests) | - |
saml.providers |
[] |
- | - |
security¶
| Setting | Default | Description | Added in |
|---|---|---|---|
security.session_key |
'change_this_key' |
IMPORTANT: Change this to a unique random string (default was p0w3r4dm1n, added in 2.1.6) | - |
security.password_encryption |
'bcrypt' |
Options: 'bcrypt', 'argon2i', 'argon2id' (md5 and md5salt removed in 4.3.0) | - |
security.password_cost |
12 |
Cost factor for bcrypt | 2.1.8 |
security.login_token_validation |
true |
Enable token validation for login form | 3.9.0 |
security.global_token_validation |
true |
Enable token validation for all forms | 3.9.0 |
security.trusted_proxies |
[] |
Reverse proxy IPs/CIDRs/wildcards allowed to set X-Forwarded-For/X-Real-IP; private/loopback peers are always trusted | 4.5.0 |
security.password_policy.enable_password_rules |
true |
Enable password policy enforcement | - |
security.password_policy.min_length |
6 |
Minimum password length | - |
security.password_policy.require_uppercase |
true |
Require at least one uppercase letter | - |
security.password_policy.require_lowercase |
true |
Require at least one lowercase letter | - |
security.password_policy.require_numbers |
true |
Require at least one number | - |
security.password_policy.require_special |
false |
Require at least one special character | - |
security.password_policy.special_characters |
'!@#$%^&*()+-=[]{}|;:,.<>?' |
Allowed special characters | - |
security.account_lockout.enable_lockout |
false |
Enable account lockout after failed login attempts | - |
security.account_lockout.lockout_attempts |
5 |
Number of attempts before lockout | - |
security.account_lockout.lockout_duration |
15 |
Duration in minutes | - |
security.account_lockout.track_ip_address |
true |
Lock accounts based on IP address | - |
security.account_lockout.clear_attempts_on_success |
true |
Clear failed attempts after successful login | - |
security.account_lockout.whitelist_ip_addresses |
[] |
IP addresses to never lock out (supports IPs, CIDRs, wildcards) - takes priority over blacklist | - |
security.account_lockout.blacklist_ip_addresses |
[] |
IP addresses to always block (supports IPs, CIDRs, wildcards) | - |
security.mfa.enabled |
false |
Enable MFA functionality | - |
security.mfa.enforced |
false |
Enable MFA enforcement (requires user_enforce_mfa permission) | - |
security.mfa.skip_for_external_auth |
false |
Skip MFA enforcement for LDAP/OIDC/SAML logins - the IdP is trusted to enforce MFA | 4.5.0 |
security.mfa.app_enabled |
true |
Enable authenticator app option | - |
security.mfa.email_enabled |
true |
Enable email verification option | - |
security.mfa.recovery_codes |
8 |
Number of recovery codes to generate | - |
security.mfa.recovery_code_length |
10 |
Length of recovery codes | - |
security.mfa.max_verify_attempts |
5 |
Failed second-factor guesses before the code is refused | 4.5.0 |
security.mfa.verify_lockout_duration |
15 |
Minutes to refuse further attempts once the limit is hit | 4.5.0 |
security.password_reset.enabled |
false |
Enable/disable password reset functionality | - |
security.password_reset.token_lifetime |
3600 |
Token validity in seconds (1 hour default) | - |
security.password_reset.rate_limit_attempts |
5 |
Max reset attempts per time window | - |
security.password_reset.rate_limit_window |
3600 |
Rate limit window in seconds (1 hour) | - |
security.password_reset.min_time_between_requests |
60 |
Minimum seconds between requests (1 minute) | - |
security.username_recovery.enabled |
false |
Enable/disable username recovery functionality | - |
security.username_recovery.rate_limit_attempts |
5 |
Max recovery attempts per time window | - |
security.username_recovery.rate_limit_window |
3600 |
Rate limit window in seconds (1 hour) | - |
security.username_recovery.min_time_between_requests |
60 |
Minimum seconds between requests (1 minute) | - |
security.recaptcha.enabled |
false |
Enable reCAPTCHA on login form | - |
security.recaptcha.site_key |
'' |
Your reCAPTCHA site key (public key) | - |
security.recaptcha.secret_key |
'' |
Your reCAPTCHA secret key (private key) | - |
security.recaptcha.version |
'v3' |
reCAPTCHA version: 'v2' or 'v3' | - |
security.recaptcha.v3_threshold |
0.5 |
Score threshold for v3 (0.0 - 1.0) | - |
user_agreement¶
| Setting | Default | Description | Added in |
|---|---|---|---|
user_agreement.enabled |
false |
Enable user agreement system | - |
user_agreement.current_version |
'1.0' |
Current agreement version | - |
user_agreement.require_on_version_change |
true |
Require re-acceptance when version changes | - |