Platform Properties

auth.oidc.rp.client.id

Default value: ""

Client ID provided by Identity Provider. If it is not present, the SSO functionality is disabled.

Yes

Confidentiality

Controls SSO client identity; misconfig can expose access.

auth.oidc.rp.provider.url

Default value: ""

Provide the Base URL to the associated Identity Provider. Read access is required for the /.well-known/openid-configuration file to acquire the relevant Provider Configurations.

Yes

Confidentiality

Points to IdP discovery; wrong URL weakens auth.

auth.oidc.rp.provider.name

Default value: ""

The name of the provider needs to be Azure if it is used and groups are returned as uids.

Yes

Integrity

Ensures correct claim parsing semantics.

auth.oidc.rp.groupPath

Default value "roles"

Path in ID Token or UserInfo object to find an array of users Access groups as defined by the Access Controller, separated with a dot (.).
The groups should be an array of Strings.
Example:
Here the groups array is inside and object.
{ myObject : { myGroups : [ "myGroup1", "mygroup2" ] } }
The path should then be:
groupPath: myObject.myGroups
When the group's array is direct under UserInfo then groupPath is just the name of the group's array.

Yes

Integrity

Maps groups from tokens; wrong path misassigns roles.

auth.oidc.rp.auth.method

Default value: "CLIENT_SECRET_BASIC"

Available authentication methods are CLIENT_SECRET_BASIC and PRIVATE_KEY_JWT

Yes

Confidentiality

Selects RP auth strength (secret vs JWT).

auth.oidc.rp.client.secret

Default value: ""

This is mandatory when CLIENT_SECRET_BASIC is used as an authentication method.

This property sets the relevant Client Secret. 

Yes

Confidentiality

Protects RP credential for IdP access.

auth.oidc.rp.auth.jwt.keystorePath

Default value: ""

Path to JKS keystore when PRIVATE_KEY_JWT is used

Yes

Confidentiality

Locates keys for JWT client auth.

auth.oidc.rp.auth.jwt.alias

Default value: ""

Alias for key in keystore when PRIVATE_KEY_JWT is used

Yes

Confidentiality

Selects key used for JWT client auth.

auth.oidc.rp.auth.jwt.keystorePassword

Default value: ""

Keystore password when PRIVATE_KEY_JWT is used, needs to be Encrypted by MediationZone.

Yes

Confidentiality

Secures keystore holding client keys.

auth.oidc.rp.auth.jwt.keyPassword

Default value: ""

Key password when PRIVATE_KEY_JWT is used, needs to be Encrypted by MediationZone.

Yes

Confidentiality

Secures private key for JWT client auth.

auth.oidc.rp.scopes

Default value: ""

Optional additional scopes. Default scopes are openid, profile, and email.

Yes

Confidentiality

Governs token data exposure.

auth.oidc.rp.claims.username

Default value: ""

Claim to use as the user name, if not specify sub will be used. This value should be unique. 

Yes

Integrity

Ensures unique, correct user identity mapping.

auth.oidc.rp.auth.jwt.keyId

Default value: ""

Optional Key ID for JWT header when PRIVATE_KEY_JWT is used

Depends

Integrity

Optional header hint; correctness aids key selection.

auth.oidc.rp.group.syncDisabled

Default value false.

When the value is set to true, the group synchronization from the Identity Provider is disabled, and the groups are set manually on each SSO User.

Yes

Integrity

Disables IdP group sync; risks stale/incorrect roles.

auth.oidc.rp.group.default

Default value ""

When Group Sync is disabled, the value of this property will be assigned to the user's default group when the user logs in for the first time.

Yes

Integrity

Sets fallback group when sync off; affects entitlements.

auth.oidc.rp.multigroupsync.defaultGroup

Default value ""

This property assigns a default group to the user who is a member of multiple groups when the user logs in for the first time. It takes effect only when the group synchronization is enabled. The default group can be changed after logging in and must be one of the member groups. Changes made to the default group after logging in will persist in the next login.

Yes

Integrity

Picks default among synced groups; affects role-driven behavior.

auth.oidc.rp.auth.debug

Default value false.

Set this to true during the implementation of SSO Access to get more information.

Depends

Confidentiality

Verbose logs may reveal auth details.

auth.oidc.request.max.buffer.size

The auth.oidc.request.max.buffer.size and auth.oidc.response.max.buffer.size properties control the maximum size of the request and response buffers for OIDC authentication. The default buffer size is 8192 bytes and can be increased up to 512 KB if needed.
Adjusting these values may be necessary if authentication requests or responses contain large tokens or headers, for example, when users belong to many groups or groups with long names.

auth.oidc.response.max.buffer.size

See the description above

cts.source.systems

This parameter (of type list) is valid only for integrations with SAP CTS+. It enables you to restrict the source systems from which exports (regular configuration and Workflow Package)can originate. If the parameter is left empty, exports from any system will be allowed.

Things to note:

• This parameter is only effective when an import is triggered via the CTS+ API. Imports initiated through the System Import UI or the command line interface are not impacted.

• The value of this parameter must exactly match the value specified in the mz.name system parameter of the source system. (mz.name can be changed at any time in the source system but changes will only take effect after the system is restarted. mz.name corresponds to mzexport.mz.name in an export file. This parameter is used to determine if an import should be permitted)

Yes

Integrity

Restricts allowed CTS+ source systems for imports.

mail.smtp.ssl.protocols

Default value: "TLSv1.2"

Specifies the SSL protocols that will be enabled for SSL connections. The property value is a whitespace separated list of tokens, with possible values "TLSv1, TLSv1.1, TLSv1.2, TLSv1.3".
TLSv1 is not recommended.

Yes

Confidentiality

Enforces secure TLS versions for email.

mz.codeserver.saveStateInterval

Default value: 10

Whenever an update to the Codeserver state is made, such as when saving a workflow with a change in its APL code, the Codeserver state will have to be saved. Using this property allows you to set the minimum interval (in seconds)for how often the Codeserver saves its state to the disk. 

Yes

Integrity

Controls frequency of persisting code state/changes.

mz.crypto.hash.algorithm

Default value: SHA-256

This property is to use the crypto algorithm for hashing data, for example, files.

Yes

Integrity

Hash choice affects tamper detection.

mz.crypto.key.crypt

Default value: AES

This property is to use the crypto algorithm to encrypt and decrypt sensitive data within communications, for example, passwords.

The value can be set to AES/GCM/NoPadding for a higher level of security.

Yes

Confidentiality

Cipher choice protects secrets/data at rest.

mz.crypto.key.stream

Default value: PBKDF2WithHmacSHA256

This property is to encrypt configurations when you have a user password for the encryption.

The value can be set to PBEWithMD5AndDES.

Yes

Confidentiality

Algorithm for config encryption (password-based).

mz.cryptoservice.keystore.path

Default value: ""

This property specifies the full path to the crypto service keystore file. This keystore file is used for encrypting/decrypting passwords with specific keys stored in the keystore, and needs to be of JCEKS type. See the JDK product documentation for further information about using keytool in different scenarios. See also the sections describing the mzsh encryptpassword in the https://infozone.atlassian.net/wiki/spaces/MD95/pages/574726639 for further information.

Yes

Confidentiality

Points to keystore for secret encryption keys.

mz.cryptoservice.keystore.password

Default value: ""

This property specifies the password for the crypto service keystore file specified by the mz.cryptoservice.keystore.path property. This keystore is used for encrypting/decrypting passwords with specific keys stored in the keystore. See the sections describing the mzsh encryptpassword in the https://infozone.atlassian.net/wiki/spaces/MD95/pages/574726639 for further information.

Yes

Confidentiality

Protects access to encryption keystore.

mz.database.profile.validation.skip

Default value: false

Set this property to true if you want to bypass the remote database validation in the Database profile. Validation requires that the configured database, tables and columns are available, and if they are unavailable when the validation is performed, the configuration and all its dependents can be marked as invalid. You can set this property if you require to validate your configuration when, or in an environment where, the database or its tables are unavailable.

Yes

Integrity

Skips DB validation; risks invalid schemas/config.

mz.desktop.accelerators

Default value: "/path/to/accelerators.properties"

Set this property with the default value to set your own key bindings. You require to unpack a properties file from devkit.jar, and go to com/digitalroute/devkit/ui/accelerators/accelerators.properties. Save the accelerators.properties file to disk, and set this property to enable the accelerators.properties file.

Depends

Availability

Custom key bindings can affect operator efficiency only.

mz.dynamicconnections

Default value: true

This property specifies if the pico instances for Desktop, mzsh, and Service Contexts must be registered on pico hosts for access:

true - Instances always have access.

false - Instances must be registered on pico hosts for access.

Yes

Confidentiality

Controls whether clients must be registered to connect.

mz.httpd.security.disabled.cipher

Default value: "^.*_anon_.*$, ^SSL_.*$, ^(.*(3DES)).*$, ^.*_DHE_.*$"

This property allows you to use regex to manually disable the Java security cipher suite when using any picos to connect to the Platform with SSL enabled. This property is used when the Platform uses a different Java version than the rest of the picos. As there may be differences in the security ciphers between versions, the property aims to disable these ciphers to allow the picos to communicate with the Platform.

Yes

Confidentiality

Disables weak ciphers to secure TLS.

mz.httpd.security.redirect

Default value: false

If TLS is enabled and this property is set to true, any attempt to access the webserver using HTTP will cause a redirect to HTTPS. The default behavior is just to return an error.

Yes

Confidentiality

Forces HTTPS when TLS is enabled.

mz.javac.source

Default value: "default"
If the compilation of the system is slow after you import a new configuration, set this property to determine the javac version to be used. The possible values are 7, 8 or default. Setting this value to "7" may improve the compilation time.

Depends

Availability

Build/perf tuning; may affect service stability indirectly.

mz.license.file

Default value: $MZ_HOME/etc

This property specifies the directory that contains the installation license file, i.e. mz.license.

Yes

Availability

License path required for startup/continuity.

mz.mailserver

Default value: ""

This property specifies the name or IP address of the mail server to be used for event generated e-mails.

Yes

Availability

Mail host for alerts; impacts notifications.

mz.mailserver.auth 

Default value: false

Enables SMTP authentication.

Yes

Confidentiality

Toggles SMTP auth usage.

mz.mailserver.auth.user 

Default value: ""

Set the SMTP user to be used for login when having enabled SMTP authentication with the mz.mailserver.auth property.

Yes

Confidentiality

SMTP credential identity.

mz.mailserver.auth.enabled

Default value: false

Set this property to true if you want to enable SMTP authentication. If set to true, you also need to add the properties mz.mailserver.auth.user andmz.mailserver.auth.password.

Yes

Confidentiality

Enables SMTP auth requirement.

mz.mailserver.host

Default value: ""

This property specifies the name or IP address of the mail server to be used for event generated e-mails.

Yes

Availability

Mail host for event notifications.

mz.mailserver.auth.password 

Default value: ""

Set the encrypted password to be used for the SMTP user stated in the mz.mailserver.auth.user property when having enabled SMTP authentication with themz.mailserver.auth property.

To encrypt the password, use the mzsh encryptpassword command, and enter the result in this field. See the Command Line user documentation for further information on how to use this command.

Yes

Confidentiality

SMTP secret; should be encrypted.

mz.mailserver.port

Default value: 25/587

Use this property to configure which port you want to used for sending event generated e-mails. When the mz.mailserver.auth property is not used, i e set to false, the default value is 25. When the mz.mailserver.auth is set to true, the default value is 587. 

Yes

Availability

Port for email delivery; wrong value blocks alerts.

mz.notifier.mailfrom

Default value: ""

This property specifies the sending  e-mail address to be used for event generated e-mails. You must enter an e-mail address for an event notification to be sent by e-mail.

Depends

Availability

Required sender for notifications to work.

mz.picostorage.usecache  

Default value: true

This property enables the cache during a system import.

Depends

Availability

Import-time caching; stability/perf trade-off.

mz.platform.extref.ttl

Default value: 5

Use this property to configure a cache for the external references by entering the number of seconds you want the cache to live. If you require to disable the cache, for example in a development enviroment, set the value to 0.

Yes

Availability

Cache TTL for external refs; affects responsiveness.