accessmanager

<userRegistry
>
required

The AccessManager allows the operation of Cadenza with user management. It can be configured here. For Cadenza Desktop and Cadenza Web, separate configuration files are required in the following directories: Cadenza Desktop: <cadenza_home>/CadenzaDesktop/config/ Cadenza Web: <cadenza_home>/CadenzaWeb/cadenza-config/ . Important: As they contain security relevant data (database connections, URL, usernames, passwords), these files must not be accessible by the client (i.e. via URL query) and therefore must be excluded from the directories. Note: Global Cadenza variables and system variables may be used in this file.

<passwordEncryptor
>
optional
string

Encryption class of the password.

</passwordEncryptor>
<userNameHandling
>
optional
string

toUpperCase - The username will be automatically transformed to upper case before login. toLowerCase- The username will be automatically transformed to lower case before login. default - The username will not be transformed. Thus, it is handled by Cadenza in a case-sensitive way. Note: The password is always case-sensitive.

</userNameHandling>
<userSuggestion
<providers
<provider
xsd:string
OAuth
LDAP
CadenzaDb
Embedded
>
optionalmax. unbounded
</provider>
>
optional
</providers>
>
optional

Specifies the user providers whose users will be shown in user pickers. Default: all user providers; if empty: no user provider.

</userSuggestion>
<userPrintNameSuggestion
<providers
<provider
xsd:string
OAuth
LDAP
CadenzaDb
Embedded
>
optionalmax. unbounded
</provider>
>
optional
</providers>
>
optional

Specifies the user providers whose users will be shown with their real names in user pickers. (User providers must also be listed in userSuggestion.) Default: all user providers; if empty: no user provider.

</userPrintNameSuggestion>
<additionalLoginHelpLink
>
optional

Settings for an additional button in the login dialog. If Cadenza Desktop is started with user management, the login dialog shows the user name and password fields by default. To give users access to information about support, maintenance etc., you can integrate an additional button that opens a given URL in the browser.

<url
>
required
string

Link URL of the button, e.g. http://www.disy.net.

</url>
<label
>
required
string

Label text of the button. One of its letters can be used for operation using a keyboard shortcut (ALT + letter key). To set this, the letter must be preceded by an ampersand (&). It might be necessary to write the ampersand according to the XML encoding used, e.g. as &amp;. Examples: &amp;Help or &amp;Help, if H is the shortcut letter.

</label>
</additionalLoginHelpLink>
<autoLoginUserName
xsd:string
systemVariable
optional
=
boolean

true to define that the value of <autoLoginUserName> should only include the variable name without $SYSTEM{} syntax. In this case, the variable is resolved when needed on client side when running in client/server mode. The setting has no effect in standalone mode. false to define that the value of <autoLoginUserName> must be embedded into the $SYSTEM{} syntax.

Default: false

>
optional

To log in to Cadenza, you can use the same username that was previously used to log in to the operating system (system variable USERNAME on Windows or USER on Linux). Attention: Please note that configuring this feature is a security risk. Anyone who logs in to your computer can access Cadenza. Example: $SYSTEM{USERNAME}.

</autoLoginUserName>
<securityPolicies
<allowedLoginAttempts
>
optional
int

Number of possible failed attempts before a user is locked.

</allowedLoginAttempts>
<allowedChangesIn24Hours
>
optional
int

Number of password changes allowed within 24 hours.

</allowedChangesIn24Hours>
<minimumNumberOfPreviousDifferentPasswords
>
optional
int

Number of previous passwords that must be different from the new password. This only applies to passwords that are changed via the menu. Changes within the user management component for administrators are not affected.

</minimumNumberOfPreviousDifferentPasswords>
<passwordExpirationTimeInDays
>
optional
int

Number of days a password can be used.

</passwordExpirationTimeInDays>
<warnBeforePasswordExpirationInDays
>
optional
int

Number of days before password expiration from which on the user receives a warning on login.

</warnBeforePasswordExpirationInDays>
<allowedUserInactiveTimeInDays
>
optional
int

Number of days after a successful login in which a user must successfully log in again to prevent being locked.

</allowedUserInactiveTimeInDays>
<forbidUsageOfPasswordsSetByAdmin
>
optional
boolean

true to forbid a user to use a password set by an administrator a second time. It has to be changed after first usage. false to allow a user to use a password set by an administrator more than once.

Default: false

</forbidUsageOfPasswordsSetByAdmin>
<newPassword
>
optional

Specification settings for a new password.

<minimumLength
>
optional
int

Minimum number of characters in a password.

</minimumLength>
<minimumLetters
>
optional
int

Minimum number of letters in a password.

</minimumLetters>
<minimumDigits
>
optional
int

Minimum number of digits in a password.

</minimumDigits>
</newPassword>
<comparedToPreviousPassword
>
optional

Specification settings for a new password compared to the previous password.

<minimumChangedCharacters
>
optional
int

Minimum number of positions where characters of the old password must be changed.

</minimumChangedCharacters>
<minimumChangedLetters
>
optional
int

Minimum number of positions where (different) letters must be in the new password.

</minimumChangedLetters>
<minimumChangedDigits
>
optional
int

Minimum number of positions where (different) digits must be in the new password.

</minimumChangedDigits>
</comparedToPreviousPassword>
>
optionalmax. 1

Security policy settings for users that are saved in the database.

</securityPolicies>
<polling
enabled
optional
=
boolean

true to enable polling. false to disable polling.

Default: false

<duration
>
required
duration

Interval at which polling should be performed. The duration is specified in the PnYnMnDTnHnMnS format, e.g. PT600S means until in 600 seconds from now. For more information see https://www.w3.org/TR/xmlschema-2/#duration.

</duration>
>
optionalmax. 1

DEPRECATED: Principal update polling has been replaced by messaging. For single-node installations, no further configuration is necessary. For clusters consisting of several Cadenza application servers using the same user management databases, consider enabling the 'Message_Broker' plugin and configuring 'messagebroker-config.xml' accordingly.

</polling>
<changelog
enabled
optional
=
boolean

true to activate the change log. false to deactivate the change log.

Default: false

>
optionalmax. 1

Settings for the change log, i.e. the logging of indirect changes to a user's privileges in the two database schemes.

</changelog>
<authentication
>
optional

Authentication settings.

<datasource
<driverName
>
required
string

The name of the driver to use for your particular database. Some common names are: For Oracle: oracle.jdbc.OracleDriver For Postgres: org.postgresql.Driver For H2: org.h2.Driver For MS SQL Server: com.microsoft.sqlserver.jdbc.SQLServerDriver

</driverName>
<jdbcURL
>
required
string

JDBC URL of the database Syntax: For Oracle: jdbc:oracle:thin:@servername:port:sid (and also the other common syntaxes supported by Oracle) For PostgreSQL: jdbc:postgresql://servername:port/instance

</jdbcURL>
<user
>
required
string

Database user to be used to establish the database connection

</user>
<password
>
required
string

Encoded password of the database user. Use the Cadenza encoder for this.

</password>
<connectionPoolSize
>
optional
int

Number of connections the connection pool may create to the database

Default: 10

</connectionPoolSize>
<connectionIdleTimeout
>
optional
int

DEPRECATED: 'connectionIdleTimeout' has been deprecated and should be removed. Due to improvements in connection pooling, Cadenza works with fixed-size connection pools, so the 'connectionIdleTimeout' setting no longer has any effect. A future Cadenza version may fail to start if the configuration is still present.

</connectionIdleTimeout>
<properties
<property
xsd:string
name
required
=
string

Name of the datasource property. General connection properties defined elsewhere, such as username, are not supported.

description
optional
=
string

Description of the datasource property.

>
optionalmax. unbounded

Value of a datasource property.

</property>
>
optionalmax. 1

Additional datasource properties

</properties>
>
required
</datasource>
</authentication>
<authorization
>
optional

DEPRECATED: This used to configures the authorization database schema for the Classic authorization database. Classic authorization has been removed with Cadenza 10, and all authorizations stored in the configured authorization database will be ignored. A future Cadenza version may fail to start if the configuration is still present.

<datasource
<driverName
>
required
string

The name of the driver to use for your particular database. Some common names are: For Oracle: oracle.jdbc.OracleDriver For Postgres: org.postgresql.Driver For H2: org.h2.Driver For MS SQL Server: com.microsoft.sqlserver.jdbc.SQLServerDriver

</driverName>
<jdbcURL
>
required
string

JDBC URL of the database Syntax: For Oracle: jdbc:oracle:thin:@servername:port:sid (and also the other common syntaxes supported by Oracle) For PostgreSQL: jdbc:postgresql://servername:port/instance

</jdbcURL>
<user
>
required
string

Database user to be used to establish the database connection

</user>
<password
>
required
string

Encoded password of the database user. Use the Cadenza encoder for this.

</password>
<connectionPoolSize
>
optional
int

Number of connections the connection pool may create to the database

Default: 10

</connectionPoolSize>
<connectionIdleTimeout
>
optional
int

DEPRECATED: 'connectionIdleTimeout' has been deprecated and should be removed. Due to improvements in connection pooling, Cadenza works with fixed-size connection pools, so the 'connectionIdleTimeout' setting no longer has any effect. A future Cadenza version may fail to start if the configuration is still present.

</connectionIdleTimeout>
<properties
<property
xsd:string
name
required
=
string

Name of the datasource property. General connection properties defined elsewhere, such as username, are not supported.

description
optional
=
string

Description of the datasource property.

>
optionalmax. unbounded

Value of a datasource property.

</property>
>
optionalmax. 1

Additional datasource properties

</properties>
>
required
</datasource>
</authorization>
<authenticators
>
required

Settings for authenticators. Defines the methods used for the authentication, group mapping and property mapping and their order. Multiple authenticators can be defined. If a user is not known by an authenticator, authentication is attempted with the next authenticator in the order. If the password is wrong, login fails.

Some rules should be observed when configuring these authenticators as having the wrong order may cause an authenticator to never trigger: - Non-interactive authenticators must come before interactive ones - OAuth must be named as the last SSO procedure

guestsAllowed
optional
=
boolean

true to enable guest logins, false to disable.

Default: false

disableLoginButton
optional
=
boolean

true to disable login button, false to enable. Applicable only when guestsAllowed is true.

Default: false

<authenticator
>
optionalmax. unbounded

Settings for an authenticator. They are mandatory if guest login is not used (but also can be used in combination with guest login).

refid
optional
=
string

Method or protocol for authentication. Current possible values: CadenzaDb, LDAP, JWT (only for Cadenza Web), SPNEGO (only for Cadenza Web), OAuth (only for Cadenza Web), autologin-httpheader (only for Cadenza Web).

<groupMapping
>
requiredmax. unbounded

A mapping of a user to user groups after successful authentication. Several group mapping variants can be specified. If assignment was not possible with the first group mapping variant, the next one will be tried. The first successful assignment will be used. If assignment was not possible with any group mapping variant, login fails.

xsd:string
refid
optional
=
string

Method or protocol for mapping. Current possible values: CadenzaDb, LDAP, JWT (only for Cadenza Web), OAuth (only for Cadenza Web).

</groupMapping>
<propertyMapping
>
optionalmax. unbounded

A user property from the Cadenza user management or LDAP that should be passed to Cadenza as user variable after successful authentication. If several propertyMappings are defined, the results of all are considered.

xsd:string
refid
optional
=
string
</propertyMapping>
</authenticator>
</authenticators>
</userRegistry>