Configuring local system settings

In special cases it might be necessary to change some local system settings of eperi sEcure Platform.

Local system settings of the eperi sEcure Platform are configured in the file connector.properties. This file is located in the classpath of the eperi sEcure Platform, e.g., in /opt/eperi/gateway/tomcat/webapps/ROOT/.

Table 1. Parameters in connector.properties
Parameter Explanation Possible values Default value
ca.hibernate.connectionpool.hikari HikariCP is a high-performance JDBC connection pool. When enabled, it maintains a cache of database connections so that connections can be reused when future requests to the database are required.
Note: For supporting TLS-enabled connections to Oracle, set this parameter to false.
 true = Enable HikariCP

false = Disable HikariCP

 true
de.eperi.ca.base.tokenization.detokenizationLog With this parameter, you can enable or disable the so-called "Detokenization Logging". By default it is disabled.

The "Detokenization Logging" is started as soon as eperi sEcure Platform detects 5 tokens within 30 seconds which do not exist in the eperi sEcure Platform database. As soon as "Detokenization Logging" is started, all successful and unsuccessful detokenization processes within the next 24 hours are logged in the separate log file .../tomcat/webapps/ROOT/log/detokenization.log.

1 = Enable Detokenization Logging

0 = Disable Detokenization Logging (the logging is also deactivated if the parameter is not set)

 0
de.eperi.ca.base.tokenization.detokenizationLog. maxFailedAttempts With this parameter, you can define the amount of failed detokenization attempts in 30 seconds until the detokenization logging should be started. Integer value range 5
de.eperi.ca.data.object.metadata.api.freshness. check.delay This parameter is related to the automatic refresh of the SFDC metadata cache. With this parameter you set, how often the eperi sEcure Platform will check the state of the metadata cache, until the given api limit quota is reached. Time in minutes, e.g., 1 to perform the check every minute.
Note: It is not recommended to set this value to 0.

By default, the state is checked every 5 minutes, if the given api call quota is not reached (80% of the daily api call limit by default). After that it is refreshed every 2 hours by default.

 5
de.eperi.ca.data.object.metadata.api.quota This parameter is related to the automatic refresh of the SFDC metadata cache. With this parameter you set the api limit quota percentage, e.g., 80 for 80%. 0 - 100 (percent)

If you set the parameter to 0, you disable the automatic refresh of the SFDC metadata cache.

 80
de.eperi.ca.data.object.metadata.api.quota. check.delay This parameter is related to the automatic refresh of the SFDC metadata cache. With this parameter you set, how often the eperi sEcure Platform will check the state of the metadata cache, after the given api limit quota is reached. Time in hours, e.g., 1 to perform the check every hour. Setting this value to more than 24 hours would be counter-productive, since the api call limit refreshes every day. 2
de.eperi.ca.functions.generic.binary Enable or disable the Generic Decryptor for binary files. For a better performance it is disabled by default. true = Generic Decryptor for binary files is enabled.

false = Generic Decryptor for binary files is disabled.

 false
de.eperi.ca.functions.generic.o365 Enable the Generic Decryptor for the specified office file types.

Example:

de.eperi.ca.functions.generic. o365=word,excel

In the example above, files of type Word and Excel are handled by the generic decryption, but not files of type Powerpoint, OpenDocument, and Octet-Stream.

Any combination of the following values (separated by a comma):

  • word
  • excel
  • powerpoint
  • opendocument
  • octet-stream
 None
de.eperi.ca.functions.generic.zip Enable or disable the Generic Decryptor for zipped files. For a better performance it is disabled by default. true = Generic Decryptor for zipped files is enabled.

false = Generic Decryptor for zipped files is disabled.

 false
de.eperi.ca.indexing.solr.pass Password for Solr, if Solr is configured to use Basic Authentication. Password in cleartext None
de.eperi.ca.indexing.solr.ssl.key With this parameter, you set the name of the secure client authentication keystore. Name of the keystore, e.g.: solr-ssl None
de.eperi.ca.indexing.solr.urls With this parameter, you set the Solr server instances to which the eperi sEcure Platform should connect. A comma separated list of URLs, e.g.: https://solr1.srv.de:8983/solr,https://solr2.srv.de:8983/solr None
de.eperi.ca.indexing.solr.user Username for Solr, if Solr is configured to use Basic Authentication. Username in cleartext None
de.eperi.ca.salesforce.convertLead. enableSubsequent EncryptionPolicyApplication eperi recommends that the encryption policy for leads, contacts, accounts and opportunities match. But there may be cases where the encryption policy for leads differs from the target object. For example, there might be no encryption policy for Lead.Email, but for Contact.Email. Set the parameter to true to apply the deviating encryption policy of the target object (e.g., Contact) during the lead conversion.
Important: Until the subsequent application of the encryption policy values may be unencrypted in Salesforce. Even after the application audit logs or history logs may still contain unencrypted values!
 true = Apply deviating encryption policy of the target object during the lead conversion.

false = Don't apply deviating encryption policy of the target object during the lead conversion.

 false
de.eperi.ca.salesforce. customhandler[NUMBER]= OBJECTTYPE;OBJECTID;URL With this parameter, custom functions/handlers in Salesforce can be specified, so that policies can be applied to it and values are tokenized/encrypted.

Example:

de.eperi.ca.salesforce. customhandler[0]= Account;accountId; apex://DEAL_SimpleAccount CreationController/ACTION$checkDuplicateAccounts

 None
de.eperi.ca.salesforce. handlers.disablesearch Using the global search and the lookup search in Salesforce Lightning via the eperi sEcure Platform is activated by default. To disable the search, add the parameter and set it to 1. 1 = Disable search

0 = Enable search

 0
DisableGenericNumberDecryption If set to true, the generic decryption of numbers is disabled. true / false false
kerberos.allow.basic Allow fallback to basic authentication if Kerberos fails true / false false
kerberos.allow.delegation Allow delegation for Kerberos SSO true / false true
kerberos.allow.localhost Allow requests from localhost true / false true
kerberos.allow.unsecure.basic Allow fallback to basic authentication if Kerberos fails true / false false
kerberos.exclude.dirs Directories to be excluded in AD for Kerberos SSO String value <empty String>
kerberos.log.debug.enable Debug level log for Kerberos SSO true / false true
kerberos.logger.level Logger level for Kerberos SSO Integer value range 1
kerberos.login.client.module Name of the client module used in the login.conf file String value spnego-client
kerberos.login.server.module Name of the server module used in the login.conf file String value spnego-server
kerberos.preauth.password Pre-authentication password for Kerberos SSO (to be filled only if keytab file is not used) String value <empty String>
kerberos.preauth.username Pre-authentication username for Kerberos SSO (to be filled only if keytab file is not used) String value <empty String>
kerberos.prompt.ntlm Allow fallback to ntlm authentication if Kerberos fails true / false false
kerberos.useSubjectCredsOnly Option to use only the subject credentials for Kerberos SSO true / false false
krb5.conf.path Path to the krb5.conf file for Kerberos SSO Example: /opt/eperi/gateway/tomcat/webapps/ROOT/etc/krb5.conf None
login.conf.path Path to the login.conf file for Kerberos SSO Example: /opt/eperi/gateway/tomcat/webapps/ROOT/etc/login.conf None
loginWithKerberos Indicate if Kerberos should be used for SSO login to the eperi sEcure Admin Console.
Important: Before setting this parameter to true it is required to perform the necessary configuration in your AD and in the eperi sEcure Platform. For details, please refer to section Configuring SSO with Kerberos for admin accounts.
 true / false false
Important: If you have changed some settings in the connector.properties, you must restart the eperi sEcure Platform for the changes to take effect. Please perform the steps as described in section Restarting eperi sEcure Platform.
Important: In a cluster setup, the changes must be made on every eperi sEcure Platform instance and each eperi sEcure Platform instance must be restarted.