> For the complete documentation index, see [llms.txt](https://docs.appstrategy.com/apprules-r-documentation/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.appstrategy.com/apprules-r-documentation/platform/self-hosting/application-configuration.md). # Application Configuration The appRules application configuration settings are stored in the Default.json file in the root folder. ### Application Configuration appRules uses two configuration files in the installation root folder: | File | Purpose | | ------------------ | ------------------------------------------------------------------------------------------------------------------ | | `Default.json` | Wisej.NET application configuration — UI, session, and client behaviour for the portal. All settings are optional. | | `appsettings.json` | .NET host configuration — service endpoints, ports, logging and connection string. | {% hint style="info" %} `Default.json` contains credentials: OAuth client secrets, webhook keys and connection strings. The portal blocks it from being served over HTTP, but it must also be protected on disk and excluded from support bundles and screenshots. {% endhint %} *** ### Default.json #### Startup and appearance | Setting | Description | | --------------- | ------------------------------------------------------------------------------------------------------- | | `startup` | Full name of the startup method, e.g. `"MyApp.Program.Main, MyApp"`. | | `mainWindow` | Full name of a view (Page or Form) created automatically at startup, e.g. `"MyApp.MainView, MyApp"`. | | `theme` | Name of the theme to load at startup, without the file extension. | | `url` | Destination URL. If null, the request must match a web page. | | `allowedRoutes` | Additional URL routes the application handles, separated by semicolons, e.g. `"api;admin;query/users"`. | | `culture` | Default culture. Default: `"auto"` (detected from the browser). | | `rightToLeft` | Right-to-left mode: `true`, `false` or `"auto"`. Default: `"auto"`. | #### Sessions and timeouts | Setting | Description | | ----------------- | --------------------------------------------------------------------------------------------------------------------------- | | `sessionTimeout` | Session timeout in seconds. Default: 120. Minimum: 60. Set to 0 to disable. | | `responseTimeout` | Request timeout in seconds. Default: 300. Minimum: 300. Increase for long-running requests. | | `pollingInterval` | Automatic server polling interval in milliseconds. Default: 0 (disabled). Minimum: 1000. Ignored for WebSocket connections. | | `autoReload` | Reloads the application automatically when the session expires or `Application.Exit()` is called. Default: false. | #### Client behaviour | Setting | Description | | ---------------------------- | ---------------------------------------------------------------------------------------------------------------------------- | | `showLoader` | Loads the Ajax loader. Default: true. | | `loaderTimeout` | Delay before the Ajax loader appears, in milliseconds. Default: 5000. Minimum: 1000. Set to 0 to disable. | | `browserCheck` | Custom expression used to validate the browser, e.g. `"navigator.platform == 'Win32'"`. | | `enablePWA` | Enables PWA mode in browsers that support it. Default: false. | | `offlineUrl` | URL to navigate to when the client loses connectivity. Default: `""`. | | `debug` | Enables logging to the client browser console. Default: false. | | `enableWebSocket` | Uses WebSocket when available. Default: true. | | `enableWebSocketCompression` | Compresses incoming WebSocket data. Default: true. | | `maxModalStack` | Maximum number of nested modal dialogs. Default: 10. | | `dropDuplicateClicks` | Drops repeated click events fired before the previous one completes. Other queued events are still executed. Default: false. | | `disableClientObjectModel` | Disables creation of the JavaScript object model on the client. | #### Security | Setting | Description | | ------------- | ------------------------------------------------------------------------------------------------------------------------------------------------- | | `secure` | Forces the client to use SSL. Default: false. | | `impersonate` | Impersonates the authenticated user on the server. Default: false. Windows-only; requires the service account to hold the appropriate privileges. | Authentication settings live under `settings` and are documented in [Sign-in configuration](#sign-in-configuration) below. #### Platform settings | Setting | Description | | ------------ | --------------------------------------------------------------------------------------------- | | `threadPool` | Thread pool configuration, e.g. `{minWorkerThreads:100}`. All values optional. Default: null. | | `options` | Map of platform options, e.g. `{"automation.mode": true, "mobile.mode": true}`. | | `settings` | Map of custom application settings (see below). | *** ### settings #### General | Key | Description | | ------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `deployment` | `"aws"`, `"azure"` or `"onpremise"`. | | `portaldatafoldersdirectory` | Location of the PortalData folder. Defaults to `ProgramData\appStrategy` when unset. To relocate it, give the full path and escape backslashes, e.g. `"D:\\appStrategy\\PortalData"`. | | `iconsource` | Application icon. | | `job_timespan` | Default time limit for a workflow job; the workflow stops when it is reached. Format `hh:mm:ss`. Default: `00:20:00`. | | `cache_timespan` | Default lifetime before the cache (Garnet or Redis) is cleared. Format `hh:mm:ss`. Default: `00:20:00`. | | `caching_engine` | `"MicrosoftGarnet"`, `"Redis"` | | `caching_connectionstring` | Connection string for the caching engine, e.g. `"127.0.0.1:6379,abortConnect=false"`. | | `caching_reconnect_timespan` | Delay before reconnecting to the cache. Format `h:mm:ss`. | | `enable_adhoc_conditions`, `enable_adhoc_actions` | Allow ad-hoc conditions and actions in workflows. | #### AI assistance | Key | Description | | --------------------------- | --------------------------------------------------------------- | | `ai_help_webhookurl` | URL of the AI help server. | | `ai_help_auth_header_name` | Webhook authentication header name. | | `ai_help_auth_header_value` | Webhook authentication header value. **Treat as a credential.** | *** ### Sign-in configuration The login page offers whatever `auth_methods` lists — the user id and password box, one or more external identity providers, or a combination. The user chooses on the page itself. #### Methods | Key | Description | | ----------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `auth_methods` | Comma-separated list of sign-in methods, in display order. `credentials` enables the user id and password box; every other entry names an external provider *scheme*. Example: `"credentials,google,microsoft"`. | | `auth_force_sso` | When `true`, **and** exactly one external provider is enabled, **and** `credentials` is not, the login page is bypassed and the provider is challenged directly. Default: `false`. | | `auth_openid_allow_auto_user_add` | Whether newly authenticated external users are added to appRules automatically. Default: true. | | `auth_openid_expiretimeout_minutes` | Lifetime of the external sign-in cookie, in minutes. Default: 14400 (10 days). | | `auth_trace` | Writes a step-by-step trace of the external sign-in handoff to the service console. Default: `false`. Diagnostic only — it records user email addresses. | A provider is offered only when it has both a client id and a client secret. Anything named in `auth_methods` without usable credentials is skipped and reported at startup. #### Per-provider keys Each key is `auth_openid__`, where `` matches the entry in `auth_methods`. | Key | Required | Description | | --------------- | -------------- | --------------------------------------------------------------------------------------------------- | | `_clientid` | Yes | Client id from the provider's console. | | `_clientsecret` | Yes | Client secret. May be stored plaintext or encrypted. | | `_kind` | No | `google` or `microsoft`. Inferred from the scheme name when omitted. | | `_tenant` | Microsoft only | Entra directory (tenant) ID. Required for single-tenant app registrations. | | `_callbackpath` | No | Redirect URI path. Defaults to `/signin-google`, `/signin-microsoft`. | | `_displayname` | No | Button caption. Defaults to `Sign in with `. | | `_icon` | No | Brand mark shown on the button. | | `_prompt` | No | OAuth `prompt` parameter: `select_account` (default), `consent`, `login`, `none`, or empty to omit. | Deployment-wide fallbacks are available as `auth_openid_default__clientid` and `_clientsecret`, used when a site has not set its own. #### Registering the redirect URI Each provider must be told which URL to return to. Register the **callback path**, not the portal's sign-in entry point: | Register this | Not this | | --------------------------------- | --------------------------------- | | `https:///signin-google` | `https:///signin/google` | | `https:///signin-microsoft` | `https:///signin/microsoft` | {% hint style="info" %} Hyphen, not slash. `/signin/` is where the login page navigates; `/signin-` is where the provider returns. Registering the wrong one produces `redirect_uri_mismatch`. {% endhint %} The service log prints the exact value to register for each configured provider at startup, along with the client id in use. #### Single-tenant Microsoft Entra An Entra app registration limited to one directory rejects the shared `/common` endpoint with `AADSTS50194`. Set the tenant explicitly: ```json "auth_openid_microsoft_tenant": "ccfd13c6-d456-4090-b0de-9bd1ca2c8101" ``` The Directory (tenant) ID is on the app registration's Overview page. Leave the key unset for multi-tenant registrations and personal Microsoft accounts. #### Encryption keys Sign-in state is protected with keys held in a key ring folder, resolved in this order: 1. `auth_dataprotection_keys_path`, if set 2. `%ProgramData%\appStrategy\appRules\keys`, unless `portaldatafoldersdirectory` is `[InstallLocation]` 3. the application folder, for upgrades from earlier versions The service account must be able to write to the chosen folder. If it cannot, sign-in state is held in memory and lost on every restart, which appears as users being returned to the login page after a service restart. The folder actually in use is written to the service log at startup. {% hint style="info" %} Changing the key ring location signs all users out once. Existing sessions were protected with the previous keys. {% endhint %} #### Access restrictions | Key | Description | | --------------------------- | ----------------------------------------------------------------------------------------------------------------------------- | | `allowOnlyDomains` | Comma-separated domains. If set, the user's email must contain one of them. | | `restrictDomains` | Comma-separated domains. If set, the user's email must not contain any of them. | | `allowOnlyEmailAddresses` | Comma-separated addresses. If set, the user's email must be in the list. | | `restrictEmailAddresses` | Comma-separated addresses. If set, a user with a listed email is denied access. | | `allowOnlyProjectDatabases` | Comma-separated workflow groups to allow. If a single group is given, an authenticated user is signed in to it automatically. | #### Example ```json "settings": { "auth_methods": "credentials,google,microsoft", "auth_openid_google_clientid": "…apps.googleusercontent.com", "auth_openid_google_clientsecret": "…", "auth_openid_microsoft_clientid": "…", "auth_openid_microsoft_clientsecret": "…", "auth_openid_microsoft_tenant": "…" } ``` *** ### Editing Default.json The file must be valid JSON. Comment lines are permitted **only before** the opening `{`: ```json // This comment is fine. { "settings": { "auth_methods": "credentials,google" // This one breaks the file. } } ``` A comment inside the document causes the whole file to fail parsing. Every setting then reads as empty, which typically appears as a login page with no provider buttons. Restart the portal — or the Windows Service — after any change. Settings are read once at startup. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://docs.appstrategy.com/apprules-r-documentation/platform/self-hosting/application-configuration.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.