Server Configuration File
Table of Contents
- 1 Table of Contents
- 2 Introduction
- 3 LDAP / Authentication (30)
- 4 Security & Access Control (29)
- 5 Provisioning & Config Assignment (9)
- 6 Server Connection & Federation (29)
- 7 Registration & Accounts (36)
- 8 Organizations (5)
- 9 Licensing & Quotas (12)
- 10 Storage & Folders (35)
- 11 File Links & Sharing (10)
- 12 Encryption (8)
- 13 Search & Indexing (10)
- 14 SMB File Sharing (8)
- 15 Sync Engine (25)
- 16 Transfers & Bandwidth (16)
- 17 Networking & Ports (26)
- 18 Cluster & High Availability (11)
- 19 SSL / Certificates (9)
- 20 Proxy & HTTP Tunnel (13)
- 21 Web Interface & Features (44)
- 22 Email / SMTP (17)
- 23 Notifications, Events & Monitoring (19)
- 24 Database (9)
- 25 Logging & Diagnostics (12)
- 26 CMIS / Content Migration (17)
- 27 Plugins & Extensions (2)
- 28 Updates (10)
- 29 Distribution & Branding (35)
- 30 System & Maintenance (2)
- 31 Antivirus & Malware Scanning (7)
- 32 Billing & E-commerce (9)
- 33 Analytics & Tracking (5)
- 34 External Integrations (6)
- 35 Client / Desktop UI (6)
- 36 Client Preferences (GUI) (41)
- 37 Miscellaneous (6)
Introduction
PowerFolder.config is the central configuration file of a PowerFolder server. It is a plain-text Java properties file — one key=value setting per line — that holds every server setting: network ports, mail/SMTP, security and permissions, default folder behaviour, LDAP/authentication, licensing, logging and more.
Server PowerFolder.config location:
Priority | Location |
|---|---|
1 — Server (primary) |
|
2 — Fallback (Windows) |
|
2 — Fallback (Linux/macOS) |
|
Almost every entry corresponds to a key in the server code (ConfigurationEntry / ConfigurationServerEntry) and most can also be changed from the web interface under Admin → Preferences. Editing the file directly is useful for headless setups, scripted deployments, and settings that are not exposed in the UI.
LDAP / Authentication (30)
Config Key | Default | Possible Values / Example | Restart | Description |
|---|---|---|---|---|
|
| true / falsee.g. | No | Enables or disables support for nested groups, allowing groups to contain other groups as members. |
|
| true / falsee.g. | No | Enables or disables single sign-on authentication via Kerberos. |
| — | a hostnamee.g. | No | Specifies the hostname or address of the Kerberos Key Distribution Center used for single sign-on authentication. |
|
| a Kerberos realm namee.g. | No | Specifies the Kerberos realm, also known as the domain, used for single sign-on authentication. |
|
| a service principal name in the form service/hostnamee.g. | No | Specifies the Kerberos service principal name as registered at the domain controller, used for single sign-on authentication. |
|
| true / falsee.g. | No | [Deprecated] Controls whether users are authenticated against the internal database when they cannot be found in LDAP. |
|
| true / falsee.g. | No | [Deprecated] Enables or disables LDAP authentication entirely. |
|
| true / falsee.g. | No | Enables or disables multi-factor authentication for user logins. |
|
| PEAP / PAP / CHAP / MSCHAPV2e.g. | No | Specifies the RADIUS authentication method or protocol type used when authenticating against the RADIUS server. |
|
| any positive integer (retry count)e.g. | No | Sets the number of times authentication requests are retried against the RADIUS server before failing. |
| — | a hostnamee.g. | Yes | Specifies the hostname or address of the RADIUS server used for authentication. |
| — | any string | Yes | Sets the shared secret used to establish trust between the server and the RADIUS server. |
|
| any positive integer (seconds)e.g. | No | Sets the timeout, in seconds, for requests sent to the RADIUS server before they are considered failed. |
|
| true / falsee.g. | No | Controls whether LDAP authentication is disabled for a user once they have authenticated via SAML. |
|
| true / falsee.g. | Yes | Controls whether Shibboleth-authenticated accounts are matched to existing accounts based on their e-mail address. |
|
| a Shibboleth attribute namee.g. | No | Specifies the name of the first custom Shibboleth attribute to read from the authentication assertion. |
| — | a Shibboleth attribute namee.g. | No | Specifies the name of the second custom Shibboleth attribute to read from the authentication assertion. |
| — | a Shibboleth attribute namee.g. | No | Specifies the name of the third custom Shibboleth attribute to read from the authentication assertion. |
| — | a Shibboleth attribute namee.g. | No | Specifies the name of the Shibboleth attribute that carries the account expiration information from the authentication assertion. |
|
| a Shibboleth attribute namee.g. | No | Defines the name of the Shibboleth attribute that carries the user's given (first) name. This is used to map the value supplied by the identity provider onto the user's given name during Shibboleth authentication. |
|
| a Shibboleth attribute namee.g. | No | Defines the name of the Shibboleth attribute that carries the user's e-mail address. This value is used to map the address supplied by the identity provider onto the user's account during Shibboleth authentication. |
|
| a Shibboleth attribute namee.g. | No | Specifies the name of the Shibboleth attribute that carries the user's organization, since this attribute is not standardized across identity providers. It is used to map the organization supplied by the identity provider onto the user's account. |
|
| a Shibboleth attribute namee.g. | No | Defines the name of the Shibboleth attribute that carries the persistent, non-reassigned identifier for the user. This identifier is used to reliably recognize a returning user across authentication sessions. |
|
| a Shibboleth attribute namee.g. | No | Defines the name of the Shibboleth attribute that carries the current Shibboleth session identifier. This enables flexible mapping of the session attribute name provided by the identity provider. |
|
| a Shibboleth attribute namee.g. | No | Defines the name of the Shibboleth attribute that carries the user's surname (last name). This is used to map the value supplied by the identity provider onto the user's surname during Shibboleth authentication. |
|
| a Shibboleth attribute namee.g. | No | Defines the name of the Shibboleth attribute that carries the user's login name. This is typically the eduPerson Principal Name and is used to identify the user's account during Shibboleth authentication. |
|
| true / falsee.g. | Yes | Controls whether organizations are created automatically based on the organization attribute received during Shibboleth authentication. Set this to false to turn off automatic organization creation. |
|
| true / falsee.g. | No | Enables or disables Shibboleth single sign-on authentication. This setting corresponds to the Shibboleth checkbox shown on the preferences page. |
|
| true / falsee.g. | No | Controls whether incoming Shibboleth header values are re-encoded to UTF-8. Enable this when the identity provider sends attribute values in a different character encoding. |
| — | a URLe.g. | Yes | Specifies the URL from which the Shibboleth service provider metadata is retrieved. This metadata is required to establish trust with the identity provider. |
Security & Access Control (29)
Config Key | Default | Possible Values / Example | Restart | Description |
|---|---|---|---|---|
| — | a comma-separated list of IP addresses or IP rangese.g. | No | Restricts admin web login to one or more specific IP addresses or IP ranges, so that administrative access is only possible from trusted networks. |
| — | free text (may include basic HTML)e.g. | No | Defines a custom message that is shown to users on the login page. |
| — | free text (may include basic HTML)e.g. | No | Defines a message that is displayed in a popup dialog to users when they log in. |
| — | free text (may include basic HTML)e.g. | No | Defines a message that is displayed in a popup dialog to reseller accounts when they log in. |
| — | a path to a script or a URLe.g. | No | Specifies a login script or login URL that is called as part of the login process, allowing custom actions or integrations to run when a user authenticates. |
|
| true / falsee.g. | No | Controls whether the server waits for the configured login script to finish executing before completing the login. When enabled, login is only finalized after the script returns. |
| — | db / database / ldap / ad / activedirectory / radius / eduroam / nopw / nopassword (comma-separated, in order)e.g. | Yes | Defines the order of the authenticator chain used to verify credentials. Supported authenticators are the internal database ("db" or "database"), LDAP/Active Directory ("ldap", "ad", or "activedirectory"), RADIUS ("radius" or "eduroam"), and passwordless/standard authentication ("nopw" or "nopassword"). |
| — | a comma-separated list of permission namese.g. | No | Specifies the list of extended security control permissions that are applied by default. |
| — | a comma-separated list of IP addresses or IP rangese.g. | No | Lists IP address ranges that are excluded from the denial-of-service (DoS) filter, so that trusted clients are never rate-limited or blocked by it. |
|
| an access mode name such as OWNER / ADMIN / READ_WRITE / READe.g. | No | Sets the minimum access level a user must hold in order to delete a folder. |
|
| an access mode name such as OWNER / ADMIN / READ_WRITE / READe.g. | No | Sets the default folder access level that is granted to a limited user account. |
|
| an access mode name such as OWNER / ADMIN / READ_WRITE / READe.g. | No | Sets the default access level assigned to shared folders, allowing administrators to change the permission that shared folders receive by default. |
|
| true / falsee.g. | No | Controls whether the server validates the HTTP Host header of incoming requests, which helps protect against host header injection and related attacks. |
|
| true / falsee.g. | No | Enables Argon2id for password hashing. When enabled, new passwords are hashed with Argon2id and existing SHA-256 hashes are migrated automatically on the user's next login; this is not backward compatible with older server versions. |
|
| true / falsee.g. | No | Controls whether organization administrators are granted unlimited access to all folders within their organization. |
|
| true / falsee.g. | No | Controls whether server administrators are granted unlimited access to all folders on the server. |
|
| true / falsee.g. | No | Controls whether the folder administrator permission is shown in the user interface. When disabled, the FolderAdminPermission is hidden from the permission options. |
|
| true / falsee.g. | No | [Deprecated] Enables strict permission enforcement so that certain client options, such as creating folders or changing client preferences, are only available to users holding the corresponding permissions. |
|
| any positive integer (seconds)e.g. | No | Sets how long authentication tokens issued to mobile or desktop apps remain valid before they expire. |
|
| any positive integer (seconds)e.g. | No | Sets how long authentication tokens issued to the desktop client remain valid before they expire. |
|
| any positive integer (seconds)e.g. | No | [Deprecated] Sets the general validity period for authentication tokens before they expire. |
|
| any positive integer (seconds)e.g. | No | Sets how long authentication tokens issued for the web interface remain valid before they expire. |
|
| any positive integer (seconds)e.g. | No | Sets how long authentication tokens issued for WebDAV access remain valid before they expire. The default corresponds to roughly 21 years, effectively making these long-lived. |
|