Application Configuration

The appRules application configuration settings are stored in the Default.json file in the root folder.

Application Configuration

appRules uses two configuration files in the installation root folder:

File	Purpose
Default.json	Wisej.NET application configuration — UI, session, and client behaviour for the portal. All settings are optional.
appsettings.json	.NET 8 host configuration — service endpoints, ports, logging and connection strings.

Default.json contains credentials: OAuth client secrets, webhook keys and connection strings. The portal blocks it from being served over HTTP, but it must also be protected on disk and excluded from support bundles and screenshots.

---

Default.json

Startup and appearance

Setting	Description
startup	Full name of the startup method, e.g. "MyApp.Program.Main, MyApp".
mainWindow	Full name of a view (Page or Form) created automatically at startup, e.g. "MyApp.MainView, MyApp".
theme	Name of the theme to load at startup, without the file extension.
url	Destination URL. If null, the request must match a web page.
allowedRoutes	Additional URL routes the application handles, separated by semicolons, e.g. "api;admin;query/users".
culture	Default culture. Default: "auto" (detected from the browser).
rightToLeft	Right-to-left mode: true, false or "auto". Default: "auto".

Sessions and timeouts

Setting	Description
sessionTimeout	Session timeout in seconds. Default: 120. Minimum: 60. Set to 0 to disable.
responseTimeout	Request timeout in seconds. Default: 300. Minimum: 300. Increase for long-running requests.
pollingInterval	Automatic server polling interval in milliseconds. Default: 0 (disabled). Minimum: 1000. Ignored for WebSocket connections.
autoReload	Reloads the application automatically when the session expires or Application.Exit() is called. Default: false.

Client behaviour

Setting	Description
showLoader	Loads the Ajax loader. Default: true.
loaderTimeout	Delay before the Ajax loader appears, in milliseconds. Default: 5000. Minimum: 1000. Set to 0 to disable.
browserCheck	Custom expression used to validate the browser, e.g. "navigator.platform == 'Win32'".
enablePWA	Enables PWA mode in browsers that support it. Default: false.
offlineUrl	URL to navigate to when the client loses connectivity. Default: "".
debug	Enables logging to the client browser console. Default: false.
enableWebSocket	Uses WebSocket when available. Default: true.
enableWebSocketCompression	Compresses incoming WebSocket data. Default: true.
maxModalStack	Maximum number of nested modal dialogs. Default: 10.
dropDuplicateClicks	Drops repeated click events fired before the previous one completes. Other queued events are still executed. Default: false.
disableClientObjectModel	Disables creation of the JavaScript object model on the client.

Security

Setting	Description
secure	Forces the client to use SSL. Default: false.
impersonate	Impersonates the authenticated user on the server. Default: false. Windows-only; requires the service account to hold the appropriate privileges.

Authentication settings live under settings and are documented in Sign-in configuration below.

Platform settings

Setting	Description
threadPool	Thread pool configuration, e.g. {minWorkerThreads:100}. All values optional. Default: null.
options	Map of platform options, e.g. {"automation.mode": true, "mobile.mode": true}.
settings	Map of custom application settings (see below).

---

settings

General

Key	Description
deployment	"aws", "azure" or "onpremise".
portaldatafoldersdirectory	Location of the PortalData folder. Defaults to ProgramData\appStrategy when unset. To relocate it, give the full path and escape backslashes, e.g. "D:\\appStrategy\\PortalData".
iconsource	Application icon.
job_timespan	Default time limit for a workflow job; the workflow stops when it is reached. Format hh:mm:ss. Default: 00:20:00.
cache_timespan	Default lifetime before the cache (Garnet or Redis) is cleared. Format hh:mm:ss. Default: 00:20:00.
caching_engine	"MicrosoftGarnet", "Redis"
caching_connectionstring	Connection string for the caching engine, e.g. "127.0.0.1:6379,abortConnect=false".
caching_reconnect_timespan	Delay before reconnecting to the cache. Format h:mm:ss.
enable_adhoc_conditions, enable_adhoc_actions	Allow ad-hoc conditions and actions in workflows.

AI assistance

Key	Description
ai_help_webhookurl	URL of the AI help server.
ai_help_auth_header_name	Webhook authentication header name.
ai_help_auth_header_value	Webhook authentication header value. Treat as a credential.

---

Sign-in configuration

The login page offers whatever auth_methods lists — the user id and password box, one or more external identity providers, or a combination. The user chooses on the page itself.

Methods

Key	Description
auth_methods	Comma-separated list of sign-in methods, in display order. credentials enables the user id and password box; every other entry names an external provider scheme. Example: "credentials,google,microsoft".
auth_force_sso	When true, and exactly one external provider is enabled, and credentials is not, the login page is bypassed and the provider is challenged directly. Default: false.
auth_openid_allow_auto_user_add	Whether newly authenticated external users are added to appRules automatically. Default: true.
auth_openid_expiretimeout_minutes	Lifetime of the external sign-in cookie, in minutes. Default: 14400 (10 days).
auth_trace	Writes a step-by-step trace of the external sign-in handoff to the service console. Default: false. Diagnostic only — it records user email addresses.

A provider is offered only when it has both a client id and a client secret. Anything named in auth_methods without usable credentials is skipped and reported at startup.

Per-provider keys

Each key is auth_openid_<scheme>_<name>, where <scheme> matches the entry in auth_methods.

Key	Required	Description
_clientid	Yes	Client id from the provider's console.
_clientsecret	Yes	Client secret. May be stored plaintext or encrypted.
_kind	No	google or microsoft. Inferred from the scheme name when omitted.
_tenant	Microsoft only	Entra directory (tenant) ID. Required for single-tenant app registrations.
_callbackpath	No	Redirect URI path. Defaults to /signin-google, /signin-microsoft.
_displayname	No	Button caption. Defaults to Sign in with <Scheme>.
_icon	No	Brand mark shown on the button.
_prompt	No	OAuth prompt parameter: select_account (default), consent, login, none, or empty to omit.

Deployment-wide fallbacks are available as auth_openid_default_<scheme>_clientid and _clientsecret, used when a site has not set its own.

Registering the redirect URI

Each provider must be told which URL to return to. Register the callback path, not the portal's sign-in entry point:

Register this	Not this
https://<host>/signin-google	https://<host>/signin/google
https://<host>/signin-microsoft	https://<host>/signin/microsoft

Hyphen, not slash. /signin/<scheme> is where the login page navigates; /signin-<scheme> is where the provider returns. Registering the wrong one produces redirect_uri_mismatch.

The service log prints the exact value to register for each configured provider at startup, along with the client id in use.

Single-tenant Microsoft Entra

An Entra app registration limited to one directory rejects the shared /common endpoint with AADSTS50194. Set the tenant explicitly:

"auth_openid_microsoft_tenant": "ccfd13c6-d456-4090-b0de-9bd1ca2c8101"

The Directory (tenant) ID is on the app registration's Overview page. Leave the key unset for multi-tenant registrations and personal Microsoft accounts.

Encryption keys

Sign-in state is protected with keys held in a key ring folder, resolved in this order:

1. auth_dataprotection_keys_path, if set

2. %ProgramData%\appStrategy\appRules\keys, unless portaldatafoldersdirectory is [InstallLocation]

3. the application folder, for upgrades from earlier versions

The service account must be able to write to the chosen folder. If it cannot, sign-in state is held in memory and lost on every restart, which appears as users being returned to the login page after a service restart. The folder actually in use is written to the service log at startup.

Changing the key ring location signs all users out once. Existing sessions were protected with the previous keys.

Access restrictions

Key	Description
allowOnlyDomains	Comma-separated domains. If set, the user's email must contain one of them.
restrictDomains	Comma-separated domains. If set, the user's email must not contain any of them.
allowOnlyEmailAddresses	Comma-separated addresses. If set, the user's email must be in the list.
restrictEmailAddresses	Comma-separated addresses. If set, a user with a listed email is denied access.
allowOnlyProjectDatabases	Comma-separated workflow groups to allow. If a single group is given, an authenticated user is signed in to it automatically.

Example

"settings": {
  "auth_methods": "credentials,google,microsoft",

  "auth_openid_google_clientid": "…apps.googleusercontent.com",
  "auth_openid_google_clientsecret": "…",

  "auth_openid_microsoft_clientid": "…",
  "auth_openid_microsoft_clientsecret": "…",
  "auth_openid_microsoft_tenant": "…"
}

---

Editing Default.json

The file must be valid JSON. Comment lines are permitted only before the opening {:

// This comment is fine.
{
  "settings": {
    "auth_methods": "credentials,google"   // This one breaks the file.
  }
}

A comment inside the document causes the whole file to fail parsing. Every setting then reads as empty, which typically appears as a login page with no provider buttons.

Restart the portal — or the Windows Service — after any change. Settings are read once at startup.