Wiki source code of Authentication Parameters
Last modified by Thomas Mortagne on 2026/10/14 10:44
Hide last authors
| author | version | line-number | content |
|---|---|---|---|
 |
1.1 | 1 | Authentication is configured in the ##xwiki.cfg## file. Apart from ##xwiki.authentication## itself, every parameter below is prefixed with ##xwiki.authentication.## — the second row of the first table is therefore written ##xwiki.authentication.always=1##. |
| 2 | |||
| 3 | == Login Flow == | ||
| 4 | |||
| 5 | |=Name|=Allowed values|=Default|=Description | ||
| 6 | |##xwiki.authentication##|form, basic|form|How the standard authenticator asks for credentials. | ||
| 7 | |always|0, 1|0|Authenticate on every request instead of once per session. | ||
| 8 | |authclass|Java class name|none|The authenticator to use, overriding the choice made in the wiki administration. The values are listed in [[Authentication Types>>documentation.xs.admin.authentication.types.WebHome]]. | ||
| 9 | |createuser|empty|none|Create a wiki profile for the users an external system authenticated. Required by Container and Kerberos authentication. | ||
| 10 | |realmname|String|XWiki|Realm name sent with an HTTP Basic challenge. | ||
| 11 | |defaultpage|String|the wiki home page|Page to redirect to after login when no ##xredirect## parameter was given. | ||
| 12 | |loginpage|String|##/bin/login/XWiki/XWikiLogin##|Page to redirect to when the user is not logged in. | ||
| 13 | |loginsubmitpage|String|##/loginsubmit/XWiki/XWikiLogin##|URL the login form posts the credentials to. | ||
| 14 | |logoutpage|String|see below|Page to redirect to after logging out. | ||
| 15 | |errorpage|String|##/bin/loginerror/XWiki/XWikiLogin##|Page to redirect to when the login failed. | ||
| 16 | |||
| 17 | The shipped ##xwiki.cfg## already gives ##logoutpage## a pattern that matches the ##logout## action whatever the path in front of it, so that logging out keeps working with short URLs and with path-based subwikis. Replace it only when the wiki is served from a different URL layout. | ||
| 18 | |||
| 19 | Only ##realmname## applies when ##xwiki.authentication## is set to ##basic##; the redirection parameters belong to the form flow. | ||
| 20 | |||
| 21 | == Remember-Me Cookies == | ||
| 22 | |||
| 23 | |=Name|=Allowed values|=Default|=Description | ||
| 24 | |cookieprefix|String|empty|Prefix added to the names of the authentication cookies. | ||
| 25 | |cookiepath|String|##/##|Path the cookies are sent to. Set it to the context path of the wiki, ##/xwiki## for instance, when something else runs on the same server. | ||
| 26 | |cookiedomains|Comma-separated list|the server host name|Domains the cookies are shared with, which is only needed to share a session between the wikis of a farm. | ||
| 27 | |cookielife|Number|14|Number of days before the cookies expire. | ||
| 28 | |protection|all, validation, encryption, none|all|Protection applied to the cookie values. | ||
| 29 | |useip|true, false|true|Bind the cookies to the IP address that obtained them, which forces a new login when it changes. | ||
 |
3.1 | 30 | |validationKey|String|generated|Key used to hash the cookie so that tampering is detected. {{version since="18.9.0RC1"}}Also used to derive the [[CSRF tokens>>doc:extensions:Extension.XWiki Platform - CSRF.WebHome]].{{/version}} |
| |
1.1 | 31 | |encryptionKey|String|generated|Key used to encrypt the cookie values. |
| 32 | |encryptionalgorithm|String|the cipher default|Algorithm used to encrypt and decrypt the cookies. | ||
| 33 | |encryptionmode|String|the cipher default|Cipher mode used to encrypt and decrypt the cookies. | ||
| 34 | |encryptionpadding|String|the cipher default|Padding used to encrypt and decrypt the cookies. | ||
| |
3.1 | 35 | |
| 36 | When ##validationKey## or ##encryptionKey## is not set, XWiki generates a random value the first time it needs it and stores it in the ##configuration.properties## file of the permanent directory. In a cluster, set the same random value on every node, otherwise users are logged out whenever the load balancer switches node{{version since="18.9.0RC1"}} and the CSRF tokens of one node are rejected by the others{{/version}}. Like any parameter of ##xwiki.cfg##, they can also be set without editing the file, for example from a secret store, with the ##XCONF_xwikicfg_xwiki_authentication_validationKey## and ##XCONF_xwikicfg_xwiki_authentication_encryptionKey## environment variables. | ||
| 37 |
